Nozomi Networks Labs: what changed for ICS and OT security teams?

TL;DR: ICS security research, responsible vulnerability disclosure and tool support are being expanded through a formalised Labs effort, including a faster, easier version of Radamsa for testing ICS device software, according to Nozomi Networks. The broader signal is that OT security maturity now depends on shared research, standards work and asset-aware vulnerability prioritisation, not just product deployment.

Editorial analysis by NHI Mgmt Group, based on content published by Nozomi Networks: “Nozomi Networks Labs: Sharing Valuable ICS Cybersecurity Research”.

Key questions

Q: What breaks in OT environments when vulnerabilities are disclosed but not triaged?

A: The control failure is not discovery, but decision paralysis.

Q: Why do ICS vulnerabilities create operational risk even when patching is hard?

A: Because exposure often sits in network-reachable protocols, device software and trust relationships that attackers can exploit without changing the physical process first.

Q: How should teams prioritise OT vulnerabilities after discovery?

A: Teams should prioritise OT vulnerabilities by operational dependency, safety impact, and remediation feasibility, not by vulnerability count alone.

Practitioner guidance

• Build a disclosure triage workflow for OT assets Create a repeatable process that routes advisories to the right asset owner, assesses exploitability and decides on mitigation, maintenance or compensating controls.
• Inventory communications paths between critical assets Map what your highest-value industrial systems communicate with, which protocols they use and where trust assumptions cross network boundaries.
• Add fuzzing to device assurance testing Use fuzzing against ICS software and protocol implementations to uncover parsing failures and unexpected behaviour before production use.

Bottom line: ICS research is a governance function in industrial environments because it helps identify exploitable device flaws, unsafe protocol assumptions and operational fragility before attackers do.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →