Scoping OT Remote Access Pen Tests: Key Considerations
Learn how to scope penetration tests for OT remote access infrastructure—rules of engagement, passive discovery, active testing, and validation.
As industrial control systems become ever more interconnected, it’s key to ensure their cyber resilience. Penetration testing, also known as pen testing or ethical hacking, can provide valuable insights into the vulnerabilities of an organization’s IT and OT infrastructure. Our team of OT cyber security professionals will analyze network environments to discover potential vulnerabilities and attempt to exploit those vulnerabilities just like a malicious actor would, but without disrupting your operations.
Red Trident’s OT and ICS penetration tests are custom-tailored to each organization. We assess specific aspects including critical systems, networks, and/or applications. By leveraging real-world advanced persistent threats (APTs) tactics, techniques, and procedures, Red Trident can bridge the gap between the IT and OT teams of your organization. Rather than each department working separately, this approach produces a holistic view of your ICS security posture and reduces conflicts often seen between these two departments.
We work directly with customers to tailor a penetration test specifically for their organization. We uncover potential misconfigurations and/or vulnerabilities without negatively impacting or disrupting processes.
Find Vulnerabilities Others Overlook
There are many penetration testing companies, but very few focus on ICS environments and OT security. The Red Trident Team has decades of experience across multiple ICS environments and verticals. We understand that production environments are sensitive and often very complex. We recognize that even potential small interruptions to the operation can have a profound impact on the outputs.
Red Trident’s Penetration Scoping Process
We understand that common mitigation controls, such as patching, might not be possible due to the sensitivities of solutions and technology commonly found within ICS environments. For reasons like this, our penetration testing process includes collaboration and working with your team to make sure we’re addressing your concerns and unique business environments.
What’s Included in the Penetration Test
Once testing is concluded, customers can expect to receive a report consisting of the following components:
Why Red Trident
At Red Trident, we do more than provide cybersecurity assessments—we build partnerships. Your business goals and risk profile drive everything we do. From the moment we engage, our focus is on understanding your unique operating environment, listening to your concerns, and aligning our recommendations with your organizational priorities.
Our team is comprised of recognized leaders in industrial cybersecurity, with decades of experience across critical infrastructure, manufacturing, government, and defense sectors. You may have seen us on stage at global security conferences like DEF CON, Black Hat, or SANS ICS Summits. But what truly sets us apart is our commitment to clear, actionable communication—translating complex risk into practical insights your executive team can act upon.
When you choose Red Trident, you get a proactive partner committed to your long-term security posture, not just a report. Let’s move your security program forward—together.
Safe ICS/OT Penetration Testing in a Live Plant
The difference between an OT penetration test and an IT one is the blast radius of a mistake. A port scan that an office network shrugs off can crash a legacy PLC or trip a process. So our method is built around a safety envelope agreed before anyone connects: passive reconnaissance and read-only analysis first, exploitation only of the systems and paths in scope, no write commands or logic changes on production controllers, no high-volume or fuzzing traffic toward the control network, and testing windows and no-go periods set by your operations team. We prefer to run these engagements on site, and for live production environments we strongly recommend it: on the plant floor our engineers can see the physical network and the panels, coordinate with your control engineers shift by shift, and make safety calls in real time.
Validating IT-to-OT Attack Paths Without Touching Control Logic
Most real intrusions into a plant start on the enterprise network and walk into the control zone through a path that segmentation was supposed to close: a flat VLAN, a dual-homed engineering workstation, a vendor remote-access route, a historian that sits on both sides. We prove those paths the way an attacker would, from the IT side inward, and stop at the boundary of the process: the test demonstrates that a controller or HMI is reachable and what could be done from there, without sending commands that change the process. The finding is the path and its consequence, documented so the fix is obvious.
What an OT Penetration Test Covers
Scope is set with you, but a typical ICS penetration test covers the enterprise-to-OT boundary, the control network and its segmentation, remote and third-party access, engineering workstations and servers, HMIs and controllers (observed and queried within the safety envelope), wireless and cellular paths where they exist, and, when you want it, physical and social-engineering vectors. You receive the exploited attack paths with evidence, the vulnerabilities and misconfigurations behind them, risk rated by consequence to the process, and a remediation plan sequenced for a running plant, followed by a retest once fixes are in place.
Penetration Test or Vulnerability Assessment?
A vulnerability assessment catalogues exposure across the environment; a penetration test proves what an attacker can actually do with it. If you have never had a baseline, start with the assessment or with asset discovery; if you need evidence that the segmentation and controls you paid for hold up, test them. Findings from either feed the same remediation work.
How OT Penetration Tests Are Scoped and Priced
Engagements are sized by the environment and the rules of engagement: the number of sites and network zones in scope, how many control assets and of what kind, which access paths you want tested, whether physical or social-engineering vectors are included, the testing windows your operations allow, and the depth of reporting and retesting you want. A single-site boundary test and a multi-site program with physical access testing are different engagements. A scoping call sets the envelope and the price before anyone is on site.
ICS/OT Penetration Testing FAQ
Can ICS penetration testing be done without disrupting production?
Yes. The method is passive and read-only first, exploitation is limited to what is in scope and agreed, no write commands or logic changes are sent to production controllers, and testing windows and no-go periods are set by your operations team.
Do you test on site or remotely?
We prefer on-site testing, and for live production environments we strongly recommend it. Remote testing is reserved for external-facing scope, document review and follow-up validation, or environments where site access is not practical.
How do you validate IT-to-OT attack paths without affecting control systems?
By working inward from the enterprise side and stopping at the boundary of the process: we demonstrate that a controller or HMI is reachable and what could be done from there, without sending commands that change it.
Can you test an ICS network without scanning PLCs?
Yes, and we also scan them when the engagement calls for it. Generic port scanning run by someone who learned it on IT networks can crash legacy controllers, which is why many firms avoid it. Our engineers have performed active scans on live production control networks for years, with protocol-aware tools and settings chosen for the controllers in front of them, after a passive phase has shown us what is on the wire. Active scanning returns detail a passive capture never can: open services, firmware and software versions, configuration weaknesses and the paths that are actually reachable. Any interaction with a controller is agreed with your engineers, scheduled into a window, and performed by people who understand the potential impact, which is the question you should ask of any team before you let them scan.
How will this affect operations?
We work with you to develop rules of engagement such as respecting windows of time where testing should not be performed, not using tools that may result in high volume network traffic or could cause denial of service situations, etc. Our goal is to discover your vulnerabilities without negatively impacting your operations. We’re happy to work within whatever constraints you have.
Can OT networks be tested during normal operations?
Often yes, for the passive and read-only portions. Active exploitation is scheduled in windows agreed with your shift supervisors so that it never competes with production or safety systems.
What happens after remediation?
You send the fixed items back for retesting and receive a revised report confirming which attack paths are closed. We recommend scheduling the next test on a regular cadence, because environments change.
How often do you recommend pentesting?
The minimum recommended interval is once per year or after significant changes to infrastructure or business operations have been made. However, depending on the business criticality of the systems being tested, some businesses opt for quarterly or monthly testing. Organizations with high-security requirements may also be required to complete a pentest at specific intervals for compliance or when a merger or acquisition (M&A) is being considered.
Schedule a Call
Schedule a brief call to learn more about Red Trident’s penetration tests to see if it’s a good fit for you
