Penetration Testing Plants Safely: IT and OT Boundaries

• Availability and safety come first. A stopped line or a safety trip costs far more than a data leak.
• Devices are fragile. Many controllers fail when scanned at normal speed, and some stop responding.
• Old software stays for years. Equipment can run for decades, and patches wait for a planned shutdown.
• Protocols were built without authentication. Common industrial protocols such as Modbus accept commands from anyone who can reach the device.

The most useful first test is not on the controllers. It is on the path between IT and OT, because an attacker usually arrives through IT. A test of the boundary asks:

• Which IT systems can reach OT systems, and through which firewall rules?
• Is there a demilitarized zone between them, with a jump host, and is remote access to OT multi-factor protected?
• Do vendors have always-on remote access, and who controls it?
• Can a normal office laptop reach an engineering workstation or a controller?
• Are the same domain accounts used on both sides?

From an office laptop, the tester checks which OT addresses answer on a single known port, using the firewall rules as the guide and a slow, polite probe. One historian server in the plant network accepts a remote desktop connection from the whole office subnet, and its local administrator password is the same as that of a server in the office. The finding is not about the historian. It is that the office network and the plant network are one step apart. The fix is a firewall rule that allows only a jump host, a separate administrator password and multi-factor sign-in for remote access.

• Plan with operations staff, not only the IT team. Plant engineers know which devices cannot be touched.
• Prefer passive methods. Listen to traffic and read configuration and firewall rules before sending anything.
• Use read-only checks on OT networks, with slow rates, and agree the list of devices and ports allowed.
• Never write to a controller or change a setpoint during a test.
• Test a copy where possible: a lab setup, a spare controller, or a test system from the vendor.
• Agree stop signals, a contact present during testing and a planned shutdown window for anything intrusive.

• Flat networks where office and plant systems can reach each other.
• Remote access for vendors with shared accounts and no logging.
• Engineering workstations with old operating systems and shared passwords.
• Devices with default credentials and open management interfaces.
• Missing inventory: nobody can list every device on the plant network.

• Draw the path from the office network to the plant network and write down every firewall and jump host on it.
• List all remote-access routes, including those added by vendors.
• Ask for the inventory of devices that talk on the plant network, and for who owns each one.
• Check that backups of controller programs exist and have been restored once.

Segment IT and OT with a firewall and a demilitarized zone, allow only listed flows, give remote access through a hardened jump host with multi-factor sign-in and session records, keep separate accounts for the two sides, and plan patches and replacements around shutdown windows. The ISA/IEC 62443 series and NIST SP 800-82 describe these zones and conduits in detail.

We scope plant work together with network Penetration Testing and agree the safety rules in writing before any test.

To plan a test for your own systems, request a scoping call, or download the pre-test checklist and scoping questionnaire.

Links checked on 5 November 2026.

• NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, OT architecture and safeguards
• ISA, ISA/IEC 62443 series of standards, zones and conduits