LinkedIn (personal): Selecting ICS/OT Pen Testing Providers for Industrial Assets

Assuming all security firms offer equal industrial expertise is a costly mistake.

Generic IT scanners cannot validate Modbus TCP or DNP3 safely. You need protocol-specific validation, not just CVSS scores.

Safety-first methodology matters. Passive discovery should be primary, with active testing limited to isolated environments or explicit change-control approval.

Remediation must be realistic. Recommendations must work within maintenance windows and legacy constraints, not assume immediate patching on critical PLCs.

Are you vetting for field experience or just compliance frameworks?

#OTSecurity #ICS #Cybersecurity

Selecting ICS/OT Pen Testing Providers for Industrial Assets

Emmett Moore

See Full Bio