OT Vulnerability Management: A Risk-Based Approach

The Problem

The IT vulnerability-management playbook — scan continuously, rank by CVSS, patch monthly — collapses in OT.

Active scans crash fragile controllers. Vendor patch certification lags releases by months; end-of-life platforms are never patchable at all. Applying a patch to a DCS or substation system requires an outage scheduled around demand, weather, and regulation — not Patch Tuesday. And an ill-timed change can trip a unit or degrade a safety system, so the tolerable failure rate for remediation is near zero. The result in most industrial estates is a backlog of thousands of "critical" findings that operations cannot act on and nobody believes in. The fix is not to manage vulnerabilities faster; it is to change the unit of work from "patch the CVE" to "reduce the risk of the exposure."

Foundation: Know the Asset, the Consequence, and the Exposure

Three layers of knowledge precede any scoring. (1) An asset register — make, model, firmware, support status — seeded by passive network monitoring and reconciled with engineering sources, since dormant and serial-connected devices never appear on the wire. (2) A consequence tier (C1 safety/grid-critical to C4 negligible) inherited from the process each zone serves, not the asset's unit cost. (3) An exposure rating from the IEC 62443 zone-and-conduit model: is the asset internet- or IT-reachable, DMZ-reachable, OT-internal, or isolated? This single attribute sorts a backlog better than any refinement of severity scores.

Identification then becomes correlation, not scanning: advisory matching against the register, passive traffic analysis, credentialed assessment of Windows/Linux hosts in supervisory zones, and active queries only where vendor-approved and window-scheduled.

The Prioritization Framework

CVSS measures intrinsic severity under worst-case assumptions; it says nothing about exploitation in the wild, reachability, process consequence, or existing controls. The framework scores each asset-vulnerability pair on four deliberately coarse factors and routes it through an SSVC-style decision tree to one of four dispositions.

The model is monotone in evidence — a KEV addition or a firewall change re-routes the exposure automatically — and it prices compensating controls into the decision, which finally aligns security's ranking with operations' reality.

Remediation Beyond Patching

• Segmentation & conduit hardening. Highest leverage — de-risks every vulnerability in the zone at once.
• Virtual patching. IPS signatures at the conduit blocking the specific exploit; bridges certification lag, permanent for unpatchable assets.
• Hardening. Disable unused services, remove default credentials, allowlist HMIs/EWS, lock controller modes.
• Detection & response. Protocol-aware monitoring and rehearsed playbooks — a flaw with guaranteed detection is a different risk from the same flaw in the dark.
• Replacement. The permanent fix for EOL platforms; the program supplies the exposure evidence that pulls refresh forward in capital planning.

Operations, Governance, and Metrics

Attach the prioritized queue to a rolling twelve-month outage calendar with pre-built, vendor-certified work packages and rollback plans; run every change through management of change; pre-authorize an emergency isolation path for ACT NOW items. Govern through a monthly joint security–operations forum.

Measure risk movement, not activity: dwell time for ACT NOW / NEXT WINDOW items, KEV coverage (patched + mitigated + accepted), closure mix, count of C1/C2 assets IT-reachable with weaponized flaws (the board number), outage-window utilization, and inventory confidence. The structure maps cleanly to IEC 62443-3-2, NIST SP 800-82r3, NERC CIP-007/005, and — for Indian CII operators — CEA cyber security regulations and NCIIPC expectations.

Conclusion

OT vulnerability management succeeds when measured by the only standard that matters: is the exploitable, reachable, consequential attack surface shrinking? Four honest questions, four defensible dispositions, compensating controls treated as engineering rather than excuse — and scarce outage windows spent on the work with the highest risk return.