Across multiple client environments monitored, we observed recurring recommendations that indicate a consistent pattern of security configuration weaknesses within Operational Technology (OT) networks.
These issues primarily relate to unauthorized devices connected to industrial networks and Programmable Logic Controllers (PLCs) operating in insecure modes. Such misconfigurations increase the risk of unauthorized access, malicious code modification, and potential disruption of industrial processes.
Unauthorized Devices Detected in OT Networks
During MDIoT assessments, several environments showed the presence of unauthorized or unmanaged devices connected to the network. These devices were not part of the established asset inventory or network baseline.
Unidentified endpoints pose a serious risk as they could be rogue devices, compromised assets, or unauthorized connections introduced by users or third-party vendors. Such devices may act as entry points for attackers, allowing them to infiltrate the network, move laterally, or exfiltrate sensitive data without detection.
Implementing continuous asset discovery and network segmentation will further help detect and isolate unauthorized connections in real time.
Several environments were also found with PLCs operating in unsecure states, such as Program or Remote, rather than in the recommended Run mode.
When a PLC is left in an insecure mode, it allows unrestricted access to device logic, enabling an attacker or unauthorized user to modify process parameters or upload malicious code. This could result in process interruptions, equipment malfunction, or even physical safety hazards.
Proper PLC hardening not only reduces the risk of malicious modifications but also strengthens operational reliability and safety.
These recurring weaknesses reflect systemic OT security gaps that attackers can exploit to gain control over critical industrial systems. Unauthorized or unmanaged devices expand the network attack surface, while insecure PLC configurations allow potential manipulation of operational processes.
If exploited, these vulnerabilities could lead to production downtime, process disruption, data exfiltration, and even physical damage to industrial assets. Furthermore, they may result in regulatory non-compliance and erode stakeholder trust.
The repeated occurrence of these findings underscores the need for consistent asset management, configuration control, and access governance within OT networks.