There is one fundamental truth in cyber security from which everything else begins: you can’t protect something you don’t know exists. This simple principle is brutally exposed in operational technology (OT) environments, where the chronic lack of a complete and up-to-date asset inventory is one of the most common and critical problems. Many industrial organizations, even those with a global footprint, do not have an accurate map of the devices connected to their production networks, their configurations, software versions or communication interconnections.
This information “black hole” is not the result of negligence, but a side effect of the peculiarities of the OT world - long equipment life cycles, undocumented changes made over the years, and a legitimate fear of using tools that could upset the delicate balance of the manufacturing process. Whatever the reasons, the consequences are extremely dangerous. Lack of visibility prevents risk assessment, vulnerability management, effective incident response and meeting upcoming regulatory requirements.
Building any mature OT security strategy, whether based on segmentation or Zero Trust principles, must start with solving this fundamental problem. The first step in any journey is to know the terrain. In industrial cyber security, this means turning on the lights in a dark room and carefully counting and describing everything in it.
Shortcuts
- Why is the “you can’t protect what you can’t see” rule so painful in the OT?
- Where does the chronic lack of knowledge about resources in industrial networks come from?
- What is the “Shadow OT” phenomenon and why is it so dangerous?
- How does a lack of inventory prevent effective vulnerability management?
- How does incomplete knowledge of resources hinder response to failures and incidents?
- Why don’t traditional IT scanners and Excel sheets work well in the factory?
- What is passive resource discovery and why is it safe for OT?
- How do passive network probes work and what information can they collect?
- What, besides an IP address, should a modern OT resource database (CMDB) contain?
- Anatomy of a Complete Inventory of the OT Asset
- Why is a map of interconnections between devices as important as a list of the devices themselves?
- How does full network visibility become the foundation for segmentation and Zero Trust?
- How does an accurate inventory help meet the requirements of the NIS2 directive?
- How can nFlo help you build a complete picture of your OT network?
- Where to start on the journey toward full visibility in the industrial network?
Why is the “you can’t protect what you can’t see” rule so painful in the OT?
In the IT world, asset visibility, while sometimes challenging, is much easier to achieve. Centralized management systems, agents installed on end devices, and regular proactive network scanning make it possible to maintain a relatively accurate picture of the infrastructure. In the OT world, the same methods are often infeasible or too risky, making the problem of lack of visibility here much deeper and more painful.
The painful part of this principle is that unseen assets are unseen risks. An uninventoried PLC, operating for 15 years in a forgotten control cabinet, may have critical vulnerabilities that have been known for a decade. Without knowing of its existence, we are unable to mitigate these risks in any way. This controller becomes an ideal target for an attacker who, once inside the network, can easily find it and use it as a beachhead for further attack.
Worse, the lack of visibility completely paralyzes the ability to respond to incidents. When security systems detect suspicious activity from an unknown IP address, the response team faces a dramatic question: “What is this device? Is it critical to production? Can we safely isolate it, or will it bring the entire factory to a halt?” In the heat of a crisis, there is no time for such investigations. Lacking a map, we are navigating our own network in the dark.
📚 Read the complete guide: SOC: Security Operations Center - czym jest, jak działa, jak wybrać
Where does the chronic lack of knowledge about resources in industrial networks come from?
The problem of lack of inventory in OT has many sources. First, the long life cycle of equipment means that knowledge of the original installation and configuration is lost when the engineers who implemented it 20 years ago leave the company. Documentation, if it existed at all, has long since become obsolete, and there are still devices in the network that no one remembers anymore.
Second, OT networks are often dynamic and heterogeneous ecosystems, consisting of hardware from dozens of different vendors, each using their own protocols and tools. Making changes is often decentralized - a systems integrator installs a new machine, connects it to the network and does not always fully document all the connections made. Over time, the network “grows” with undocumented resources and connections.
Finally, a third source of the problem is the legitimate fear of active scanning. Traditional network scanners, commonly used in IT, work by sending a series of aggressive queries to devices to identify open ports and services. Many old and sensitive OT devices, such as PLCs, are not designed to handle such unusual traffic. Active scanning can cause them to hang or fail, which is an unacceptable risk to production continuity.
What is the “Shadow OT” phenomenon and why is it so dangerous?
“Shadow OT” is a term analogous to “Shadow IT,” describing all those devices, software and network connections in the industrial environment that have been deployed and are being used without official knowledge, approval or oversight from IT, OT or security departments. This is a technological “gray market” that arises out of the need of the moment, convenience or lack of awareness.
Typical examples of “Shadow OT” include the aforementioned cellular modem plugged into a controller by an outside service technician for easy remote access. It’s also a simple, unmanaged network switch bought at an electronics store and plugged in by a maintenance technician because “the cabinet ran out of ports.” Finally, it’s an employee’s laptop connected to the guest Wi-Fi network, which simultaneously has a connection to the machine control network.
The danger of “Shadow OT” is that it creates completely invisible and unsecured gateways into our infrastructure. Because these assets do not exist in any official inventory, are not covered by any security policies, and are not monitored or updated. They provide an ideal hidden entry point for attackers, completely bypassing all official lines of defense, such as company firewalls.
How does a lack of inventory prevent effective vulnerability management?
Vulnerability management is the process of identifying, assessing and mitigating (mitigating) software and hardware security vulnerabilities. In order for this process to work at all, it must be based on a solid foundation, which is a complete inventory of assets. If we don’t know what devices and software versions we have, we can’t even begin to identify the vulnerabilities that affect us.
Imagine a media report about a critical security vulnerability in PLCs from a popular manufacturer. The CISO comes to the plant manager with the question: “Are we vulnerable?” Without an up-to-date inventory, it is impossible to answer this question. No one knows exactly how many controllers from this manufacturer are running on the network, what firmware versions they have, and whether they are affected by the described vulnerability.
Such a situation forces manual, time-consuming checking of hundreds of devices, which is inefficient and exposes the company to attack at a time when the vulnerability is already publicly known. Having a central, up-to-date asset database (CMDB) allows for an immediate response. With a simple query to the database, you can identify all vulnerable systems in seconds and start planning mitigation actions, such as implementing compensating controls.
How does incomplete knowledge of resources hinder response to failures and incidents?
Lack of visibility has an equally crippling effect on reactive processes, such as fixing technical failures and responding to cyber security incidents. When a machine fails, the maintenance team must quickly diagnose the problem. If it doesn’t have an accurate connectivity map, finding the cause - whether it’s a controller hardware failure, a network cable problem or a switch configuration error - becomes a tedious trial-and-error process, extending costly downtime.
The situation is even more dramatic in the event of a cyber attack. The incident response team (CSIRT) must operate under tremendous time pressure to stop the attack and restore normal operations. As mentioned earlier, if an analyst sees suspicious traffic from an unknown IP address, he or she faces an impossible choice. Isolating that address can stop a key process, while ignoring it can allow the attack to escalate.
An accurate inventory enriched with business context is key here. If the database next to a given IP address says “PLC, Product X Packaging Line, Criticality: High,” the team knows what it is dealing with. It can immediately contact the business owner of the process and together make an informed decision about the risk, rather than acting in the dark.
Why don’t traditional IT scanners and Excel sheets work well in the factory?
Faced with the problem of a lack of inventory, the natural reflex of IT departments is to try to use proven tools from their world: active network scanners and manually maintained spreadsheets. Unfortunately, both of these approaches in an OT environment are doomed to failure.
Active scanners, as already explained, are too invasive for sensitive industrial equipment. They can cause failures and downtime, making their regular use unacceptable. They are useful under controlled conditions, such as during a planned shutdown, but are not suitable for continuously maintaining an up-to-date picture of the network.
Excel spreadsheets, while better than nothing, are a highly inefficient and error-prone solution. Manually collecting and entering data on hundreds or thousands of devices is extremely labor-intensive. Worse, such an inventory becomes obsolete almost as soon as it is completed. Every change in the network - adding a new device, changing the configuration - requires a manual update of the sheet, which rarely happens in practice. As a result, after a few months the sheet becomes a useless, historical document.
What is passive resource discovery and why is it safe for OT?
Since active scanning is too risky and manual inventory is inefficient, the solution is a third way: passive resource discovery. This is a method of building a picture of a network not by actively “querying” devices, but by quietly and safely “listening” for traffic that naturally circulates in that network anyway.
This approach is 100% safe for OT environments because the passive monitoring tools do not send a single packet of their own to the network. They act as an observer standing by and taking notes on who is talking to whom and how. They do not interfere in any way with communications or equipment operation, eliminating any risk of disruption to the production process.
Passive monitoring is a continuous process. The network probe runs 24/7, automatically detecting every new device that arrives on the network and every new communication session. This ensures that the inventory is always up-to-date and reflects the actual state of the network at any given moment, rather than the state six months ago, as with an Excel spreadsheet.
How do passive network probes work and what information can they collect?
Implementation of passive monitoring involves connecting a special device, called a network probe (or sensor), to a key point in the network. This is most often done by configuring a mirror port (SPAN port or mirror port) on central network switches, which copies all network traffic and sends it to the probe for analysis.
The probe, receiving this copy of the traffic, performs a deep analysis of it. Thanks to built-in engines that “understand” hundreds of industrial protocols (e.g. Modbus, Profinet, S7, DNP3), it is able to identify not only the IP and MAC addresses of devices, but also obtain extremely detailed information about them.
Based on the analysis of communications, the probe can determine the type of device (e.g., “Siemens S7-1500 controller”), its role in the process (e.g., “master” or “slave”), firmware version, and even read serial numbers or status information of modules in the control cabinet. All of this data is collected in a completely passive manner, merely by intelligently interpreting normal operational communications.
What, besides an IP address, should a modern OT resource database (CMDB) contain?
A modern automated inventory, often referred to as a Configuration Management Database (CMDB), is much more than just a list of IP and MAC addresses. To be realistically useful for security and operations purposes, it must contain a rich set of attributes for each identified resource.
The key information , of course, is technical data: manufacturer, model, device type, operating system and firmware version. This data is essential for vulnerability management. Equally important is network information: all IP and MAC addresses assigned to the device, as well as the ports and services on which it listens.
However, the real added value comes from enriching this data with business context. Each resource should have an assigned owner, a defined **production process**in which it participates, and an assessment of its criticality to the company’s operations. In addition, a good CMDB should automatically correlate resource information with known vulnerability databases (CVEs), immediately flagging devices that have known security vulnerabilities.
Anatomy of a Complete Inventory of the OT Asset
CategoryKey informationData sourceIdentificationIP address, MAC address, DNS name, Manufacturer, Model, Serial number.Passive network monitoringSoftwareOperating System, Firmware Version.Passive network monitoringBusiness ContextPhysical location, Manufacturing process, Owner, Criticality.Data entered manuallySecurityList of known vulnerabilities (CVEs), Open list of ports and services.Correlation with CVE databases, Passive monitoringCommunicationsConnection map (with whom, how often, and through what protocols it communicates).Passive network monitoring
Why is a map of interconnections between devices as important as a list of the devices themselves?
A list of resources alone, even a very detailed one, is still an incomplete picture. The second, equally important part of the puzzle is a communication map that shows how these resources are connected to each other and how they exchange data. Knowing that there is a PLC running on the network is important. But knowing that this controller only communicates with the HMI station in its line, and has recently started sending data to an unknown computer on the IT network as well, is invaluable from a security perspective.
The linkage map is the foundation for building segmentation and Zero Trust policies. It allows you to define a normal, baseline communication pattern. Any deviation from this pattern - for example, an attempt to establish a new, unauthorized connection - can be immediately detected and alerted as a potential incident.
Understanding communication dependencies is also key to risk assessment. A vulnerability on a server that does not communicate with any critical systems has a much lower priority than the same vulnerability on an engineering station that has direct access to all PLCs in the factory. A connectivity map allows you to prioritize your activities and focus resources where the risk is greatest.
How does full network visibility become the foundation for segmentation and Zero Trust?
As previous articles have shown, segmentation and Zero Trust are some of the most effective strategies for building resilience in OT networks. However, neither of them can be implemented blindly. Attempting to segment a network we don’t understand, or creating “zero trust” policies without knowing what communications are trusted and necessary, must end in disaster and halted production.
Full visibility, achieved through passive asset discovery and communication mapping, is an absolute prerequisite for these advanced strategies. It is the accurate inventory that allows us to intelligently plan segments. It is the map of normal traffic that allows us to create a precise “whitelist” of rules for our firewalls.
Without this fundamental layer of visibility, segmentation and Zero Trust remain mere theoretical concepts. Only when we know exactly what we have on the network and how it talks to each other can we begin to build on this foundation to the next, more advanced floors of cyber security. Visibility turns guesswork into engineering.
How does an accurate inventory help meet the requirements of the NIS2 directive?
The NIS2 directive imposes a number of obligations on key and important players that are impossible to fulfill without having an accurate inventory of assets. One of the basic requirements is to implement risk-based measures. It is impossible to conduct a credible risk analysis without knowing what assets we have and what their vulnerabilities are.
Another responsibility is incident handling and reporting. As mentioned earlier, effective incident response requires rapid identification of attacked systems and assessment of their criticality. Having an up-to-date CMDB drastically reduces response time and allows you to provide supervisors with the precise information required in a report.
The directive also emphasizes supply chain security. The inventory, which includes information on the manufacturer and model of each piece of equipment, makes it possible to quickly identify all systems coming from a supplier with security problems. Finally, auditors checking for NIS2 compliance are sure to start their work by asking: “Please show us what you have on your network.” Having a ready-made, automatically generated answer is the best proof of an organization’s maturity.
How can nFlo help you build a complete picture of your OT network?
At nFlo, we fully understand that gaining full visibility in a complex industry environment is a huge challenge. That’s why our approach is based on a fundamental value: “First we understand, then we act.” We don’t offer a one-size-fits-all solution, but a partnership designed to help you build an OT network picture that is realistically useful to your organization.
Our process begins with a workshop with your IT and OT teams, where we take an in-depth look at the specifics of your environment, production processes and business goals. We help you select and implement the right technology for passive asset discovery, tailored to your infrastructure and budget. Our engineers support your team in the process of installing network probes and configuring the system in a way that is 100% secure for your operations.
However, our role does not end with the implementation of the tool. The key value we bring is to help interpret the collected data and translate it into a concrete, strategic action plan. We help enrich the raw technical data with business context, identify the most critical risks and develop a roadmap for further actions, such as segmentation or implementation of access control. Our goal is not only to provide you with a map, but also to help you understand it and chart the best path forward.
Where to start on the journey toward full visibility in the industrial network?
The journey toward full visibility may seem complicated, but like any journey, it must begin with a first step. That first step doesn’t have to be a large, expensive enterprise-wide project right away. The best approach is to start with a Proof of Concept (PoC) pilot project on a single, selected but representative segment of the network.
Choose one key production line or one area of the factory. Implementing passive monitoring in such a limited area allows you to familiarize yourself with the technology, assess its value and build internal competence with minimal risk and cost. The success of such a pilot is the best argument to convince management to expand the project to the rest of the organization.
The most important thing is to start at all. Every day of operation without full visibility is a day in which we accept unknown and unmanaged risks. The first step is to make a strategic decision: “We want to know what we have.” With this decision, the transformation from reactive firefighting to proactive and informed management of cyber security in your industrial infrastructure begins.
Related Terms
Learn key terms related to this article in our cybersecurity glossary:
- Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
- SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
- Network Security — Network security is a set of practices, technologies, and strategies aimed at…
- Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
- Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
Learn More
Explore related articles in our knowledge base:
- What is a Honeypot? How it Works and How to Protect Yourself? Everything You Need to Know
- Cyber Resilience Act (CRA): 3 vulnerability definitions you need to know
- What is IT Risk Analysis? Everything You Need to Know
- Poland’s NIS2 Implementation 2025/2026: From Draft to Law - Everything You Need to Know
- You have won 1.3 million zlotys from the grant. What is your plan for building a digitally resilient water supply?
Explore Our Services
Need cybersecurity support? Check out:
- Security Audits - comprehensive security assessment
- Penetration Testing - identify vulnerabilities in your infrastructure
- SOC as a Service - 24/7 security monitoring
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Related topics
See also:
