Seeing the Invisible in OT: Vulnerability Management Without Breaking Production

This training is not about scanning everything. It is about knowing what is exposed, what matters to production, and what to do when patching is not possible. 

In OT environments, the biggest challenge is not simply the existence of vulnerabilities. The real problem is that we often do not know which vulnerabilities are truly critical to production, which systems can be safely scanned, which systems cannot be scanned, which vulnerabilities cannot be patched immediately, and which compensating controls must be implemented to reduce risk without disrupting operations. 

The key question is: how can we gain visibility into risk without unintentionally destabilizing production systems? 

We will walk through several essential topics and conclude the training with a practical exercise. 

 Key Topics 

1. Why vulnerability management in OT differs from IT  

The difference between traditional IT approaches and OT environments, where a poorly executed technical activity can affect production, quality, safety, or system availability. 

2. What we often do not see in OT – and why it matters  

Incomplete asset inventories, legacy devices, unknown communication flows, vendor access, engineering stations, outdated operating systems, and systems outside standard IT oversight. 

3. OT Scanning: what is safe, what is risky, and what should never be done without preparation  

Practical decision-making process between passive detection, active scanning, testing, vendor validation, and operational approval. 

4. CVSS is not enough: How to prioritize vulnerabilities based on OT risk  

How to evaluate vulnerabilities based on production impact, safety, availability, exposure, exploitability, segmentation, and existing compensating controls. 

5. When patching is not possible: Compensating controls in OT  

Segmentation, communication restrictions, monitoring, allow‑listing, hardening, isolation, remote access governance, backups, and recovery readiness. 

6. How to link vulnerability management with NIS2 evidence requirements  

What an organization should be able to demonstrate: asset inventory, risk register, exception decisions, remediation plans, risk ownership, and remediation tracking. 

7. Practical Exercise: Critical vulnerability in an OT System  

Participants will solve a scenario involving a newly announced critical vulnerability in an OT component. The goal will be to decide whether to scan, isolate, patch, monitor, escalate, or accept the risk with compensating controls.