ICS/OT exposure: what changes when scanners speak Modbus?

TL;DR: A nine-day honeypot for Modbus, Siemens S7, BACnet and IPMI recorded 764 ICS/OT events from 188 source IPs, including protocol-aware scans and exploit-tagged Modbus traffic, showing that exposed industrial services attract deliberate reconnaissance rather than random noise, according to Censys research.

Editorial analysis by NHI Mgmt Group, based on content published by Censys: “Who's Knocking on Your PLC? A Honeypot View of Internet-Wide Interest in ICS/OT Protocols”.

By the numbers:

• The honeypot recorded 764 ICS/OT events across nine days.
• Censys observed 188 unique source IPs hitting the honeypot.
• Modbus accounted for 191 events, or 25.0% of the traffic.

Key questions

Q: What breaks when ICS and OT protocols are exposed directly to the Internet?

A: The main failure is that the protocol boundary becomes a public control surface before any real trust decision occurs.

Q: Why do protocol-aware scanners make exposed Modbus services higher risk?

A: Because protocol-aware scanners are not just checking whether a port exists.

Q: What are the signs that an exposed OT service is being actively probed?

A: Look for valid protocol headers, repeated read or write function codes, malformed packets, multi-step exchanges and session behaviour that lasts longer than a simple port check.

Practitioner guidance

• Remove direct Internet exposure for ICS and OT protocols Place Modbus, S7comm, BACnet and similar services behind segmented remote access paths instead of exposing them on public interfaces.
• Segment OT access from enterprise networks Use zones and conduits, jump hosts or VPN-mediated access so industrial control traffic never relies on open inbound reachability.
• Monitor for protocol-aware scanning patterns Alert on valid function codes, malformed payloads, repeated read or write attempts and multi-packet exchanges that go beyond a TCP handshake.

Bottom line: Exposed industrial services are not merely discoverable, they can be interacted with in ways that reveal control behaviour and increase operational risk.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →