Visibility is the Foundation of OT Security

Most manufacturers cannot identify every device connected to their operational technology environment. 

That may sound like a failure of management or documentation, but the reality is more complicated. Modern manufacturing environments are built over decades. Equipment is installed by different vendors, employees develop workarounds to solve immediate production problems, facilities expand, and ownership changes. Documentation may be incomplete when a system is installed, and it may not be updated when equipment, personnel, or processes change. 

Over time, workstations, control systems, communication paths, and other devices can become effectively orphaned. They continue to operate, but no one actively maintains them, understands their purpose, or knows how they connect to the rest of the environment.

Unless a facility is small enough for one person to understand everything that has ever been installed, visibility gaps are likely to occur. In most plants, no single person has a complete picture.

That lack of visibility is more than an inventory problem—it creates real security and operational risk.

What OT Endpoint Management Includes

OT endpoint management is the process of understanding and maintaining the workstations, servers, control systems, human-machine interfaces, and other devices connected to a manufacturing network or involved in plant-floor operations.

In an IT environment, endpoint management typically focuses on relatively standardized devices, such as employee laptops, servers, and mobile devices. In an OT environment, the definition is broader. An endpoint may be a Windows workstation, a Linux server, a programmable logic controller, a supervisory control and data acquisition system, a vision system, or another specialized device supporting production.

Some devices may be directly visible on the network. Others may sit behind another controller or use industrial protocols that standard IT tools do not recognize. A single IP address may represent a programmable logic controller (PLC) chassis containing several connected devices.

As a result, identifying IP addresses or walking through the plant and recording visible equipment does not provide a complete understanding of the environment. Effective endpoint management requires deeper discovery of the devices, relationships, communication paths, software, firmware, and access methods that support operations.

Why Unknown Assets Are So Common

Unknown assets rarely appear because of one isolated mistake. They accumulate as plants evolve. A vendor may install equipment without following the organization’s documentation standards. An employee may connect a workstation to address a production problem and later leave the company. A remote access connection may remain active long after a project ends. An older system may continue to run because it performs a critical function, and replacing it would require significant downtime or capital investment.

In some cases, equipment was installed before cybersecurity and network visibility became major considerations. Manufacturing facilities may still operate systems using outdated operating systems, including Windows XP, Windows Server 2003, or, in uncommon cases, Windows 2000.

These systems remain in place because they continue to perform their intended functions. However, the vendors may no longer provide security updates, the plant may not have a process for applying available updates, or the organization may not know the equipment is still connected. 

The longer an environment operates without consistent standards, ownership, and documentation, the more likely it is that devices and connections will become invisible.

OT Evolved Differently from IT

The visibility challenge also reflects a fundamental difference between IT and OT.

IT environments generally emphasize standardization. Organizations can establish approved hardware, operating systems, applications, configurations, and update schedules. Those standards make it easier to deploy security controls consistently.

OT environments prioritize operations and safety.

The first questions are usually whether a system performs its intended function, whether it supports production, and whether it operates safely. Uniformity is secondary. A control system may have been designed specifically for one machine, production line, or process. Different vendors may use different hardware, protocols, and configurations within the same facility.

OT equipment also remains in service much longer than standard IT hardware. A production system may operate for 10, 15, or 20 years because replacing it could require extensive validation, redesign, or downtime. Even a routine software update may require careful planning because a reboot or configuration change could interrupt production.

An office computer can often be patched and restarted during a scheduled maintenance period. A plant-floor device controlling a continuous process cannot be treated the same way. A poorly timed update could stop a line, affect product quality, or interfere with a safety function.

This operational focus explains why standard IT practices cannot be applied to OT environments without modification.

Why Visibility Has Become More Urgent

Many OT systems were originally designed to operate in relative isolation. Plant-floor controls communicated locally, and there was little need to connect them to business systems or the internet.

That model has changed.

Business leaders increasingly want production data for planning, performance analysis, maintenance, quality control, and other purposes. Connections were first established between the plant floor and corporate networks. More recently, cloud-based applications, remote support tools, Industrial Internet of Things devices, and connected analytics platforms have created additional communication channels outside the plant.

These connections can generate meaningful operational value, but they also expand the potential attack surface.

At the same time, older equipment continues to age, software vulnerabilities continue to be identified, and attackers have become more aware of the financial impact they can create by disrupting production. Advances in technology have also made it easier to identify and exploit weaknesses in widely used systems.

Historically, in manufacturing cyberattacks were often associated with stolen information. The potential consequences now include production disruption, ransom demands, safety concerns, intellectual property theft, and operational shutdowns.

A device that was considered low risk when it was isolated may present a different risk once it connects to a business network, a vendor, or a cloud platform.

Unknown Assets Create Unknown Risk

An organization cannot evaluate the risk associated with a device it does not know exists.

Unknown or poorly understood endpoints may contain unsupported software, unpatched vulnerabilities, outdated credentials, undocumented remote access, or hidden trust relationships with other systems. They may also provide a pathway into more critical areas of the network.

The potential impact extends beyond cybersecurity.

An intrusion or compromise might require systems to be isolated or shut down. Production may stop while teams investigate the incident, restore systems from backups, validate configurations, and bring equipment safely back online. The resulting losses can include reduced output, remediation costs, lost data, missed client commitments, and extended operational disruption.

During the WannaCry outbreak, for example, one large enterprise used different service providers across its facilities. Plants where OT assets had been identified and remediation measures had been implemented were able to maintain their security and operational objectives. A facility managed by another provider was infiltrated, and the issue spread to additional plants supported by that provider.

Affected systems had to be isolated and shut down. Several were restored from backups, and the work required to resume operations safely created additional downtime. The financial impact included both lost production and recovery costs.

The incident illustrates an important distinction: Visibility does not guarantee that an organization will never experience a cyberattack, but it improves its ability to identify exposure, implement safeguards, respond quickly, and limit the effects of an incident.

Which Unknown Assets Deserve Attention First?

Not every unidentified device presents the same level of risk.

Risk depends on several factors, including the device’s purpose, its connection to production or safety systems, the potential consequences of disruption, the number of people capable of exploiting it, and the likelihood that a known vulnerability will be targeted.

Windows-based devices often warrant early attention. Engineering workstations and Windows-based HMIs may run common operating systems and applications familiar to many attackers. They may also provide access to critical configuration or control functions.

Specialized industrial or Internet of Things devices can also contain serious vulnerabilities. However, fewer attackers may understand how to exploit more specialized devices. That does not mean the organization should ignore them. It means the assets should be evaluated based on both the potential impact and the likelihood of exploitation.

Visibility provides the information required to make those distinctions. Without it, organizations may spend resources protecting easily identified systems while leaving more significant risks unaddressed.

Discovery Is More Than an Inventory Exercise

Asset discovery is the first security control because nearly every other security activity depends upon it.

An organization cannot develop a meaningful patching strategy without knowing which operating systems, applications, and firmware versions are in use. It cannot segment the network effectively without understanding which systems communicate with one another. It cannot manage remote access if it does not know which vendor connections exist. It cannot monitor for abnormal behavior without understanding normal communication patterns.

Even an existing asset list may not provide enough information.

A spreadsheet may identify a workstation or controller, but it may not show the connected devices behind it, the services it runs, the systems it depends on, or the access paths available to users and vendors. A general network scan may identify an IP address without revealing the full set of devices associated with that address.

Meaningful discovery requires a combination of observation, OT-aware tools, protocol knowledge, and operational context. Teams must understand not only what appears on the network but also what each device does, what it communicates with, and how changes could affect production.

Discovery is not the final objective. It is the prerequisite for making informed security decisions.

Discovery Must Be Performed Carefully

In an IT environment, teams may use active scanning, ping sweeps, or other standard methods to identify devices and services. Those techniques can create risk in an OT environment.

Some industrial devices are highly sensitive to unexpected communication. An aggressive or improperly configured scan can interfere with normal operations, overwhelm a controller, or disrupt data being transmitted to a production system.

Consider a high-speed manufacturing line producing hundreds of razor blades per minute. If an inappropriate scan interferes with the data sent to a vision or control system, even a small deviation could cause products to fall outside specifications. Scrap could continue accumulating until the issue is identified and the line is corrected.

A discovery activity intended to improve security could therefore cause immediate financial loss if not planned and executed appropriately.

OT discovery should use methods and tools designed for industrial environments. Teams must understand production schedules, device sensitivity, system dependencies, and operational constraints before interacting with equipment. Plant operations, engineering, IT, and security personnel should coordinate the work so the organization can improve visibility without introducing unnecessary disruption.

Visibility Improves Every Downstream Control

Once organizations understand their assets and how those assets relate to one another, they can make better decisions about where to act.

They can identify unsupported systems, prioritize vulnerabilities, and determine which devices can be patched during normal maintenance windows. They can use network segmentation to limit communication between systems and reduce potential lateral movement. They can consolidate vendor access through managed connection points and remove undocumented or unnecessary remote pathways.

They can also establish stronger access controls, define who owns each device, monitor for configuration changes, and develop more effective incident response plans.

Without visibility, these controls are based on assumptions. With visibility, organizations can align them with actual operational risk.

The distinction matters because OT security is not about applying the largest possible number of controls. It is about applying the appropriate controls to the appropriate systems without creating more operational risk than the controls are intended to reduce.

Visibility Is an Ongoing Responsibility

Discovery cannot be treated as a one-time project. New equipment is installed. Vendors connect devices. Employees make changes. Software is updated. Communication paths are added to support new applications. Even a well-documented environment can become outdated quickly if the organization does not maintain the information.

The objective is not to reach a point where leaders can declare the environment permanently complete or fully secure. The objective is to create a reliable baseline, monitor for changes, and maintain enough visibility to make informed decisions over time.

That responsibility may be handled internally, by a third party, or through a combination of both. Some organizations have mature cybersecurity programs and need only additional strategy, specialized OT tools, or implementation support. Others are beginning with limited internal knowledge and need help determining what they have, what the risks are, and where to start.

The structure may vary, but the responsibility cannot remain unassigned. Someone must own the process of discovery, visibility, assessment, maintenance, and security.

The First Questions Leaders Ask

Once leaders understand that visibility gaps exist, their next questions are usually practical: 

• What should we address first? 
• How much effort and expense will this require?
• How long will it take?
• What does the path from our current state to a more secure environment look like?

Those questions cannot be answered responsibly until the organization understands its starting point. The most urgent device may not be the oldest one. The most visible vulnerability may not create the greatest operational risk. A tool that works well in one facility may be inappropriate for another.

Visibility provides the foundation for developing a phased plan that reflects the organization’s equipment, production requirements, internal capabilities, and risk tolerance.

The next step is turning that visibility into action: safely discovering assets, creating a reliable inventory, classifying and prioritizing systems, stabilizing configurations and access paths, implementing layered controls, and monitoring the environment as it changes.

You can’t secure what you can’t see. But once you understand what is there, you can begin making deliberate, risk-based improvements without losing sight of the operational systems the security program is intended to protect.