OT vulnerability management: is CVSS enough for live operations?

TL;DR: OT vulnerability programmes fail less from poor detection than from remediation backlogs, with internet-exposed OT devices rising from roughly 6 million in 2023 to nearly 20 million in 2024, forcing teams to prioritise by exploitability, exposure, and device criticality instead of raw CVSS, according to Asimily.

Editorial analysis by NHI Mgmt Group, based on content published by Asimily: “A Risk-Based Approach to OT Vulnerability Management”.

By the numbers:

• The internet-exposed OT device count reached nearly 20 million in 2024, up from roughly 6 million in 2023, according to the 2026 Intelligence-Driven Active Defense Report cited by Asimily.

Key questions

Q: What breaks when patching OT and IoMT devices cannot keep pace with exploitation?

A: The assumption that remediation will arrive before attackers operationalise the flaw breaks down.

Q: Why do OT teams need to prioritise vulnerabilities by exposure and criticality?

A: Because a vulnerability only becomes operationally urgent when attackers can reach it and the compromised device matters to the process.

Q: What are the signs that an OT vulnerability programme is failing?

A: Common signs include unknown assets, reliance on active scanning, thousands of findings with no clear order, and remediation plans that ignore maintenance windows or certification limits.

Practitioner guidance

• Build a passive OT asset inventory Map every PLC, HMI, RTU, SCADA node, and supporting host using traffic observation rather than active scanning, then classify each asset by operational criticality and reachability.
• Prioritise by exploitability and exposure Rank vulnerabilities using exploitability, internet or remote exposure, device criticality, and current compensating controls so remediation reflects real blast radius rather than CVSS alone.
• Separate patching decisions from uptime assumptions Approve remediation only where maintenance windows, vendor guidance, and safety certification can all be preserved, and treat unsupported devices as a distinct risk class.

Bottom line: OT vulnerability management fails when teams confuse scan volume with real risk reduction.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →