Risk-based OT vulnerability management outpaces CVSS in live environments

At a glance

What this is: This guide says OT vulnerability management breaks when teams treat every finding as equally urgent instead of ranking risk against real operational constraints.

Why it matters: It matters because OT security teams must protect uptime, safety, and certified systems while still reducing exploitable exposure across devices that cannot be patched on IT timelines.

By the numbers:

• The internet-exposed OT device count reached nearly 20 million in 2024, up from roughly 6 million in 2023, according to the 2026 Intelligence-Driven Active Defense Report cited by Asimily.

Context

OT vulnerability management is the process of finding, ranking, and reducing flaws in systems that control physical processes rather than ordinary IT workloads. In industrial settings, the problem is not only exposure but also the cost of intervention, because patching can affect production, safety, and certification.

The article’s core governance gap is familiar to identity and security practitioners: teams can discover more than they can safely change. In OT, that gap is widened by long-lived assets, limited maintenance windows, passive monitoring constraints, and the need to govern remediation in a way that does not break the process being protected.

Key questions

Q: What breaks when patching OT and IoMT devices cannot keep pace with exploitation?

A: The assumption that remediation will arrive before attackers operationalise the flaw breaks down. In connected environments, vulnerability disclosure can now precede exploitation by only days or even hours, so patching alone no longer protects safety-critical or production devices. Teams need containment controls that reduce reachable attack paths while the fix is still pending.

Q: Why do OT teams need to prioritise vulnerabilities by exposure and criticality?

A: Because a vulnerability only becomes operationally urgent when attackers can reach it and the compromised device matters to the process. A high CVSS score on an isolated controller may be less risky than a lower-scoring flaw on an internet-facing HMI. Exposure and criticality turn abstract severity into actionable risk.

Q: What are the signs that an OT vulnerability programme is failing?

A: Common signs include unknown assets, reliance on active scanning, thousands of findings with no clear order, and remediation plans that ignore maintenance windows or certification limits. If teams can enumerate vulnerabilities but cannot confidently state which ones threaten production or safety, the programme is not governing risk, only collecting data.

Q: Should OT teams prioritise segmentation before full patch coverage?

A: Yes, when assets are too critical, too old, or too unsupported to patch promptly. Segmentation and access restriction reduce reachability immediately, while patching can lag behind operational constraints. The right sequence is to shrink exposure first and then close the vulnerability when the maintenance and vendor conditions finally allow it.

Technical breakdown

Why OT vulnerability triage cannot rely on CVSS alone

CVSS gives a severity score, but it does not tell you whether a vulnerability is reachable, exploitable in your environment, or dangerous to the physical process it controls. In OT, a low score on an internet-facing HMI can matter more than a high score on an isolated controller because exposure and process criticality change the real risk. That makes the prioritisation problem contextual, not numerical. Teams need a ranking model that combines exploitability, network exposure, device criticality, and compensating controls.

Practical implication: Use contextual risk scoring to decide what gets remediated first, not the raw CVSS list.

Why passive discovery is the only safe starting point in OT

Active scanners can overload stripped-down firmware, trigger malformed packet handling faults, or push a PLC into a watchdog timeout. Passive discovery avoids those failure modes by observing traffic instead of probing devices directly. It also produces an asset inventory that is more credible in OT environments where shadow devices, contractor equipment, and misclassified hosts are common. Without that inventory, prioritisation is guesswork because unknown assets cannot be risk-ranked or remediated coherently.

Practical implication: Build OT visibility from passive network observation before you attempt vulnerability assessment or remediation.

What compensating controls do when a device cannot be patched

Many OT assets cannot be updated quickly because they are unsupported, certified, or too operationally sensitive to take offline. In those cases, compensating controls become the real control plane: segmentation limits reachability, tighter access controls reduce who and what can talk to the device, monitoring surfaces exploitation attempts, and hardening closes configuration gaps. These controls are only useful if they preserve process integrity, because a mitigation that disrupts the control loop simply trades one failure mode for another.

Practical implication: Treat segmentation and access restriction as first-class controls for unpatchable OT assets.

Threat narrative

Attacker objective: The objective is to turn reachable OT exposure into disruption, unsafe operation, or control over physical processes.

1. Entry often begins through internet-exposed OT assets or via an IT foothold that can later reach operational systems.
2. Once inside, attackers exploit reachable weaknesses on devices that are difficult to patch or poorly visible in the asset inventory.
3. The impact is operational disruption, unsafe process conditions, or damage to physical equipment rather than a simple data-only loss.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Risk-based remediation is the only defensible OT security model when patch windows are scarce. OT programs fail when they treat every vulnerability as a queue item instead of a business-risk decision. In environments where uptime, safety, and certification matter, the control question is not whether a flaw exists but whether it is reachable, exploitable, and operationally consequential. The practitioner conclusion is to make remediation decisions on exposure and process criticality, not on scan volume.

Asset visibility is the governance bottleneck that determines whether OT vulnerability management is real or theatrical. Passive discovery is not a convenience feature in OT, it is the precondition for any credible control model. If a device cannot be seen without risking outage, it cannot be governed by conventional IT playbooks. The practitioner conclusion is to treat inventory quality as the first security outcome, because unknown devices cannot be prioritised or protected.

OT exposes a broader truth for identity and access governance: reachability is a privilege question, not only a network question. When a vulnerable controller sits behind segmentation, its effective risk is constrained by who and what can reach it. That makes access paths, remote administration, and contractor connectivity part of the OT vulnerability problem, not a separate issue. The practitioner conclusion is to align segmentation, access governance, and remediation sequencing as one control decision.

Compensating controls are not second-best in OT, they are the practical control architecture for long-lived assets. Many environments will never patch at the pace IT expects, so segmentation, monitoring, and configuration hardening become the durable risk-reduction layer. The practitioner conclusion is to define compensating control ownership with the same discipline used for patching, because unowned mitigations degrade silently.

What this signals

Risk-based OT vulnerability management is really reachability management. The question is not how many CVEs exist, but which devices an attacker can actually touch and which failures would matter to operations. For practitioners, that means remote access, contractor pathways, and segmentation deserve the same attention as patch backlog.

Passive discovery becomes the enabling control when active scanning is unsafe. OT programmes that cannot see their assets without disrupting them are forced to govern from partial data, which weakens every subsequent decision. For readers running mixed IT and OT environments, the practical move is to make visibility a security control, not just an inventory task.

For practitioners

• Build a passive OT asset inventory Map every PLC, HMI, RTU, SCADA node, and supporting host using traffic observation rather than active scanning, then classify each asset by operational criticality and reachability.
• Prioritise by exploitability and exposure Rank vulnerabilities using exploitability, internet or remote exposure, device criticality, and current compensating controls so remediation reflects real blast radius rather than CVSS alone.
• Separate patching decisions from uptime assumptions Approve remediation only where maintenance windows, vendor guidance, and safety certification can all be preserved, and treat unsupported devices as a distinct risk class.
• Deploy compensating controls for unpatchable assets Use segmentation, tighter access controls, continuous monitoring, and configuration hardening to reduce risk on devices that cannot be updated safely.
• Track IT-to-OT pivot paths Review remote access, contractor connectivity, and IT assets that can bridge into OT so attackers do not move laterally from business systems into operational environments.

Key takeaways

• OT vulnerability management fails when teams confuse scan volume with real risk reduction.
• Exposure, exploitability, and device criticality are more useful than CVSS for deciding what to fix first.
• Passive discovery and compensating controls are the practical backbone of security for unpatchable OT assets.

Key terms

• Operational Technology (OT) Vulnerability Management: The process of finding, ranking, and reducing security flaws in systems that control physical processes. OT vulnerability management has to account for uptime, safety, and certification constraints that make conventional IT patching and scanning methods unsafe or impractical.
• Passive discovery: Passive discovery is the act of learning about devices, topics, and communication patterns by observing traffic rather than actively probing the target. It is especially relevant in brokered industrial protocols because normal messages can expose topology, asset names, and operational state.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.
• Risk Prioritisation: A method for ranking NHIs by exposure, privilege, business criticality, and age so remediation effort lands on the identities most likely to widen blast radius. It prevents lifecycle programmes from treating every credential as equally urgent, which is rarely true.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle, and secrets management for practitioners responsible for access and risk control. It helps security leaders connect identity governance to broader security programmes without losing operational detail.