What signs show that an OT programme is under-monitoring new attack paths?

How under-monitoring shows up in an OT programme

The clearest sign is not a missing alert, it is a missing view. If telemetry only covers the control network, the programme can miss the host, wireless, remote access, and adjacent IT paths that attackers often use before they ever touch PLCs or HMIs. That creates a false sense of coverage because detection looks strong inside the plant boundary while the real ingress paths stay invisible.

A second signal is that incident teams cannot describe how they would detect compromise outside the ICS protocol stack. If the monitoring story stops at Modbus, DNP3, or engineering workstation activity, but does not include identity abuse, endpoint compromise, rogue wireless access, or non-ICS management traffic, the programme is likely detecting symptoms too late. OT Asset Visibility Guide is useful here because it ties inventory to the monitoring surface, not just to asset count.

Why new attack paths are usually the blind spots

Modern industrial intrusions rarely begin as a pure PLC problem. They often start with a workstation, a vendor channel, a reused credential, or a service that sits just outside the OT monitoring baseline, then pivot into the control environment once trust has been established. That means an OT programme can appear mature on paper while still missing the earliest evidence of compromise.

Coverage gaps are especially serious when the programme assumes the network core is the whole environment. New attack paths usually exploit the seams between IT and OT, or the places where asset visibility is weak, such as unmanaged hosts, transient access, wireless links, and third-party connections. NIST’s NIST SP 800-82 Rev 3, OT Security Guide is the right baseline for thinking about those seams, while CISA’s Industrial Control Systems resources help anchor the discussion in operational guidance for critical infrastructure.

OT teams should also treat path visibility as a validation problem, not a reporting problem. If you cannot test whether an unusual remote-access session, a wireless pivot, or a management-plane login would be noticed, then monitoring is probably tuned for compliance evidence rather than adversary movement. That is exactly where Exposure Management and CTEM Guide helps by framing scoping and validation around attack paths rather than static asset lists.

What to look for in a monitoring gap assessment

The practical test is whether detection and response can follow the path an attacker would actually take. If host telemetry is absent, wireless infrastructure is unmanaged, or non-ICS traffic is excluded from routine triage, the programme will struggle to explain how compromise would be detected before operational impact begins. That is a stronger indicator of under-monitoring than any single missed alert.

Look for three concrete conditions: first, assets that exist outside the OT inventory but can still reach OT-adjacent services; second, paths that are monitored only at the perimeter, not at the endpoint or identity layer; and third, segments where the security team has no baseline for “normal” administrative, engineering, or vendor activity. For broader threat context, CISA’s cyber threat advisories are helpful when you need to compare your blind spots against current adversary tradecraft.

Risk and Threat Considerations

Under-monitoring new attack paths creates a detection gap at the exact point where an adversary is most likely to establish foothold, move laterally, or blend in with legitimate activity. In OT, that usually means compromise begins in a less controlled layer, then uses trust relationships to reach systems that the organisation does watch.

Failure mechanism: The programme narrows detection to the control network and misses host, wireless, identity, or non-ICS access paths, so early-stage compromise never enters the alerting and response workflow.

Impact: Intrusions can progress farther before discovery, increasing the chance of operational disruption, loss of visibility, unsafe changes, or delayed containment.

Practitioner Guidance

What to verify: Validate that every path into or around OT has a detection owner, not just every OT segment on the diagram. If a path can reach engineering workstations, jump hosts, remote access brokers, or wireless infrastructure, it needs a monitoring story even when it never speaks an industrial protocol.

Decision rule: If the monitoring design cannot answer “what would show us compromise before the control network is touched?”, treat that as a scoping failure and expand telemetry before you rely on the programme for assurance.

Practitioner takeaway: An OT programme is under-monitoring new attack paths when it can describe assets but not adversary movement, because path visibility matters more than perimeter coverage.

[{"framework_code":"NIST-800-53","control_ref":"AU-6","control_ref_label":"Audit Record Review, Analysis, and Reporting","relevance_note":"OT monitoring gaps require review of logs and events across exposed paths.","framework_summary":"Correlate OT and adjacent IT logs to spot compromise before it reaches control systems."},{"framework_code":"NIST-800-53","control_ref":"CA-7","control_ref_label":"Continuous Monitoring","relevance_note":"The question is about whether the programme continuously sees new attack paths.","framework_summary":"Extend continuous monitoring to host, wireless, and remote-access paths into OT."},{"framework_code":"NIST-800-53","control_ref":"SI-4","control_ref_label":"System Monitoring","relevance_note":"Detecting compromise outside the control network depends on active system monitoring.","framework_summary":"Instrument endpoints, jump hosts, and boundary systems that can precede OT intrusion."},{"framework_code":"CIS-CONTROLS","control_ref":"CIS-8","control_ref_label":"Audit Log Management","relevance_note":"Missing telemetry and poor log coverage are central indicators of under-monitoring.","framework_summary":"Centralise and review logs from OT-adjacent systems that attackers can abuse first."},{"framework_code":"CIS-CONTROLS","control_ref":"CIS-13","control_ref_label":"Network Monitoring and Defense","relevance_note":"The subject concerns whether monitoring extends beyond the control network boundary.","framework_summary":"Monitor wireless, remote access, and inter-zone traffic for unusual OT-relevant activity."}]

Related resources from NHI Mgmt Group

• Guide: Identity Attack Paths Guide
• What are the signs that an SME security programme is leaving common attack paths open?
• What are the signs that a SaaS security programme is too shallow to catch real attack paths?
• What are the signs that cloud authentication monitoring is not covering the most important attack paths?
• What signs show that a continuous monitoring programme is not actually continuous?