In the world of industrial cybersecurity, there is a pervasive myth that compliance equals security. Plant managers, CISOs, and compliance leads often assume that passing an annual audit or achieving NERC CIP certification means their operational technology (OT) environment is safe. The reality, however, is far more nuanced and significantly more dangerous. Auditors are trained to check boxes against static frameworks. They are not trained to understand the physical consequences of a control system failure, nor are they equipped to see the dynamic, living topology of an industrial network.
When we walk into a facility for a Red Trident assessment, we are not looking for compliance certificates. We are looking for the gaps that auditors systematically miss because their tools and methodologies were designed for IT, not OT. Through our engagement history, we have identified specific failure modes that plague industrial operators, from incomplete asset inventories to misconfigured audit policies that leave critical systems blind. These are not theoretical risks; they are evidence-based findings that directly threaten operational continuity.
The Myth of the Complete Asset Inventory
Every effective OT security program begins with a single, non-negotiable truth: you cannot protect what you do not know exists. Yet, one of the most recurring issues we encounter in our assessments is the complete lack of visibility into the OT environment. Auditors often rely on IT-provided network diagrams or static spreadsheets that are months or years out of date. These documents rarely account for the “shadow OT”—unauthorized devices, legacy PLCs, and rogue wireless sensors—that operators plug directly into the process bus to solve immediate production problems.
In our assessments, we have found that incomplete asset inventories are a primary vector for risk. When auditors scan an OT network using standard IT vulnerability scanners, they often miss critical devices because those devices do not respond to ICMP or SMB probes in the way Windows servers do. A Siemens S7-1500 PLC, a Rockwell ControlLogix controller, or a Schneider Electric Modicon processor will simply ignore the scan packet, leading the auditor to conclude the device is offline or nonexistent. In reality, it is actively running the process that keeps the plant operational.
This gap creates a false sense of security. The audit report may show zero vulnerabilities for a specific subnet, but in truth, that subnet contains unpatched RTUs and HMI stations with known default credentials. As recent intel from OT-ISAC highlights, the exposure of OT systems is spreading beyond centralized control rooms into distributed assets, making passive discovery and continuous monitoring far more critical than periodic audits. Without an automated asset inventory that correlates device behavior with asset data, operators are effectively blind to unauthorized devices and hidden vulnerabilities.
When Audit Policies Are Set to “No Auditing”
Even when auditors do find the endpoints within an industrial network, they often miss the most critical configuration failures: disabled audit policies. In two recent endpoint assessments we conducted for the same industrial organization, we discovered a disturbing pattern. At least seven high-value Windows audit subcategories were explicitly set to “No Auditing” on both endpoints. These categories included Process Creation, Process Termination, Credential Validation, Kerberos Service Ticket Operations, Kerberos Authentication Service, Detailed File Share, and Removable Storage.
This is not a minor oversight; it is a catastrophic blindness. When these audit policies are disabled, the operating system stops logging who created a process, what credentials were used to log in, or whether a file was accessed via a network share. In an IT environment, this might mean you lose forensic visibility after a phishing attack. In an OT environment, it means you cannot determine if an attacker has escalated privileges to manipulate a safety instrumented system (SIS) or modify the logic of a Distributed Control System (DCS).
Our findings in Finding 2.9 and Finding 2.11 highlighted that these gaps in process, credential, Kerberos, file-share, and removable-media visibility are not isolated incidents. They are configuration recurrences across multiple endpoints within the same facility. When auditors rely on automated tools that do not explicitly check for these specific audit policy states, they walk away with a clean bill of health while the facility remains wide open to lateral movement and privilege escalation.
Protocol-Specific Blind Spots in Modbus and DNP3
One of the most significant failures in standard OT security assessments is the treatment of industrial protocols like Modbus TCP, DNP3, and OPC UA as if they were HTTP or FTP. Auditors often attempt to apply IT vulnerability scanning methodologies to these protocols, resulting in either no data collected or, worse, data that triggers unintended device responses.
For example, a standard port scan might reveal that Modbus TCP port 502 is open on a PLC. An auditor might then run a generic vulnerability scanner against that port, which could send malformed packets to the device. In an IT server, this results in a closed connection or a timeout. In an OT environment, it can cause a CPU reset, a watchdog timer expiration, or a momentary loss of control—a direct threat to physical safety. We have seen cases where aggressive scanning caused a water treatment pump to restart unexpectedly, disrupting the entire treatment process.
Effective assessment requires passive discovery and controlled testing. We must understand the normal traffic baseline for DNP3 master-slave communications before we can identify an anomaly. We must verify that OPC UA endpoints are not exposing sensitive metadata or allowing unencrypted connections. Auditors who do not specialize in OT protocols miss the subtle signs of protocol abuse, such as unauthorized Modbus write requests to a control register or DNP3 commands sent from an unexpected source IP.
Segmentation That Looks Good on Paper But Fails in Practice
Network segmentation is a cornerstone of OT security, yet it is often implemented incorrectly and verified inadequately. Auditors may look at the VLAN configuration or firewall rules and declare the network “segmented.” However, they rarely test whether those segments are actually enforced or if there are undocumented bypasses.
In our engagements, we have found that many facilities rely on a single, flat OT network with no proper demilitarized zones (DMZs) between the corporate IT and operational networks. This allows threats to flow freely from an email gateway to a historian server, and potentially to a control valve. Recent research from Forescout Vedere Labs on attacks against Minnesota water utilities revealed major OT security gaps, including inadequate network segmentation for OT systems. Legacy OT equipment remains unpatched and exposed because there is no effective boundary to stop the initial intrusion.
Furthermore, even when segments exist, they are often permeable due to misconfigured routing or unnecessary trust relationships. For instance, a maintenance engineer might have created a “temporary” exception in the firewall to allow direct RDP access from the corporate office to a DCS HMI for troubleshooting. This exception may never be revoked, creating a permanent backdoor that auditors miss because they are not actively testing connectivity between segments.
From Gap Analysis to Actionable Roadmap
The ultimate failure of many OT security assessments is not the discovery of vulnerabilities, but the inability to translate those findings into an actionable roadmap. Operators are often overwhelmed by hundreds of findings, many of which are generic IT recommendations that do not apply to their specific industrial context. A recommendation to “patch all Windows servers” is useless if the HMI stations cannot be patched without violating vendor support agreements or risking process stability.
At Red Trident, we approach assessment differently. We align our findings with IEC 62443 and NIST SP 800-82 standards, but we contextualize them for the industrial operator. We prioritize risks based on operational impact, not just CVSS scores. For example, a high-severity vulnerability in a non-critical office printer is less urgent than a medium-severity misconfiguration in a safety-related PLC that controls chemical injection rates.
We also recognize that continuous monitoring is not tied to business objectives unless it is integrated with the OT environment’s specific needs. As noted in recent Nozomi Networks Labs research, real-time ICS network visualization and automated asset inventory can proactively identify hidden vulnerabilities. Behavioral analysis of assets enhances threat detection in OT environments by correlating device behavior with asset data, allowing operators to detect anomalies early, before they result in a physical event.
Conclusion: Moving Beyond Compliance
OT security is not about passing an audit. It is about ensuring the safe, reliable, and uninterrupted operation of industrial processes. Auditors miss critical risks because they lack the specialized tools, protocols knowledge, and operational context required to assess OT environments accurately. From incomplete asset inventories and disabled audit policies to protocol-specific blind spots and ineffective segmentation, the gaps are real and they are dangerous.
Operators need assessments that provide evidence-based visibility into their industrial networks. They need findings that are actionable, prioritized, and aligned with their operational realities. If you are unsure whether your current security posture reflects the true state of your OT environment, it is time to look beyond compliance.
Ready to uncover what standard audits miss? Contact Red Trident today for a free OT security assessment consultation. Let us help you build a defense strategy that protects your people, your processes, and your bottom line.
