OT/ICS security: why IT pentesting isn't enough for industrial environments

Applying the same IT pentesting methodology to an OT/ICS environment is, at best, ineffective, and at worst, dangerous. Industrial networks prioritize continuous availability and physical safety over confidentiality, use protocols an IT scanner doesn't understand, and a failure in a control system can have physical consequences, not just a data breach.

The inverted priority: availability and physical safety before confidentiality

In IT, the security triad usually prioritizes confidentiality and integrity, with availability as the third criterion. In OT/ICS it's the opposite: the absolute priority is that the production line, the electrical substation or the process control system doesn't stop and doesn't put people at risk, even if that means accepting more data exposure than would be tolerated in an IT environment. This inverted priority completely changes which tests are acceptable and which aren't.

Protocols and equipment IT pentesting isn't designed to touch

OT/ICS environments use industrial protocols — Modbus, PROFINET, DNP3, OPC UA — and equipment like PLCs, RTUs and SCADA systems that don't follow the same network model or robustness assumptions as a server or a web application. Many of these devices run old firmware, unpatched for years because an update requires stopping production, and aren't built to withstand the traffic volume or techniques of a conventional vulnerability scanner: an aggressive scan can crash a PLC and physically halt a production line.

IT/OT segmentation and the Purdue model as a starting point

Before proposing any technical test in the OT environment, you need to understand and validate the segmentation between the corporate network (IT) and the industrial network (OT), usually structured according to the Purdue model in hierarchical levels. A segmentation flaw — a misconfigured server in the industrial DMZ, an unrestricted remote maintenance VPN — is often the most critical vulnerability in the entire environment, because it turns any conventional IT compromise into a potential entry point to critical physical systems.

What to assess in an OT/ICS environment: an adapted, not generic, methodology

An OT/ICS security assessment combines passive network traffic review (to avoid risking availability), IT/OT segmentation analysis, review of remote maintenance access (often the most exploited entry vector), device and firmware inventory, and, when feasible with the client, controlled active testing in lab environments or replicas, never directly on production without agreed maintenance windows. It relies on specific frameworks such as IEC 62443, distinct from those used in conventional IT.

FAQ

Can I request the same pentest I run on my IT network for my industrial plant?

It's not advisable. A scan or pentest designed for IT can cause availability outages on fragile OT devices, and ignores protocols and specific risks (Modbus, PLCs, physical safety) an IT approach doesn't cover. You need an adapted methodology focused on not interrupting production.

Does this service replace IoT pentesting?

No, they're complementary: IoT and hardware pentesting assesses the security of individual connected devices (firmware, communications, physical hardware), while an OT/ICS assessment analyzes the full industrial environment — segmentation, protocols, remote access — in which those devices operate.