OT and SCADA Security Testing Built Around Your Production Line
Non-intrusive assessment of industrial control systems, IT/OT boundaries, and remote access paths, delivered by a CERT-In empanelled team with hundreds of OT engagements a year across power, manufacturing, oil and gas.
Trusted by India's leading enterprises
The inversion
In OT the priority order turns upside down, and so does the testing
-
IT
Confidentiality first
On the business network the worst outcome is usually disclosure, so controls optimise for keeping data in and testing optimises for finding the path to it.
-
OT
Availability and safety first
On the plant floor the worst outcome is a process that stops or behaves unsafely. Confidentiality matters and it is not what the environment is engineered around.
-
What follows
The test has to change shape
A probe that is routine on an IT network can halt a controller. Availability is the property under protection, so an assessment that risks it to find a finding has misunderstood the job.
-
And the estate
Equipment older than the threat model
Controllers commissioned before network security was a design input, running protocols with no authentication because none was contemplated. Patching is bounded by vendor certification and by outage windows measured in months.
Where the real path runs
Almost nobody attacks a PLC first
The realistic intrusion path into a control environment starts on the business network and crosses a boundary that everyone believes is tighter than it is. Engineering workstations are the recurring route: dual-homed by convenience, carrying vendor software with broad privileges, often on an older operating system because the engineering suite requires it. Vendor remote access is the second: standing connections created for support, rarely inventoried, frequently sharing credentials across sites, and usually invisible to the team that owns the firewall. Historians and reporting servers are the third, because they exist specifically to move data from the control network to the business one and are therefore permitted to cross. Then there is the flat legacy segment that predates the segmentation project and was never migrated, and the wireless link installed for a contractor in a hurry. Our assessments concentrate there, because that is where an attacker who is not already inside would actually go, and because every one of those can be tested without touching a live controller. Establishing the boundary honestly is the thing most sites have never had done, and it is worth more than a finding list on any single device.
How we assess it
Methods matched to what the system can tolerate
Architecture and configuration review
Network design, firewall rule sets, segmentation between levels, remote-access paths and account structure, assessed from documentation and configuration exports without touching the environment.
Passive traffic analysis
Observation of control-network traffic from a span or tap to identify assets, protocols and communication patterns, including devices nobody knew were there. No packets are generated.
Active testing at the IT boundary
Full testing from the business side against the boundary itself, which is where the realistic attack path runs and where testing carries no process risk.
Engineering workstations and jump hosts
Assessed directly, including the vendor software, the privilege model and the remote-access tooling installed on them.
Deep testing in an agreed window
Anything that could affect a live process is scoped explicitly and scheduled into a planned outage, or performed against a test rig where one exists. Never by surprise.
Mapped to IEC 62443
Findings expressed against zones, conduits and security levels so the output feeds a certification path instead of sitting beside it.
What we usually find
Four states, in roughly the order of how often we meet them
| State | What it means | What follows |
|---|---|---|
| Segmented and verified | A boundary between the business and control networks that is enforced by rules matching the diagram, with crossings inventoried. | The target state. Where it exists, the remaining work is about monitoring and about the vendor access paths. |
| Segmented on paper | The diagram shows separation; the rule set, the shared directory, the management network and a historian with interfaces on both sides do not. | The commonest finding by a wide margin, and it is discovered by reading configuration, not by scanning anything. |
| Vendor access uninventoried | Standing remote-access paths for equipment suppliers that the site owns commercially and does not track technically. | A route in that bypasses the boundary entirely, and one where the credentials are frequently shared across sites and across customers. |
| Asset inventory incomplete | Devices on the control network that no current list records, found by listening to the traffic. | Not a failure of diligence so much as of turnover: plants change over decades. It is also the precondition for everything else, since a zone model cannot be drawn around assets nobody has named. |
- Target state
- Blocks the zone model
- A live route across the boundary
Methodology
What happens between kickoff and the report
Every engagement follows this process through Lemon, our proprietary audit management platform.
1. Zone and Conduit Architecture Validation
Our engineers validate that OT-DMZ segmentation, zone isolation, and conduit controls enforce the intended data flows. Configuration drift between design and reality is where most OT compromises begin.
2. IT/OT Boundary Testing
Assessment of the complete attack chain from phishing and credential harvest through lateral movement in IT, OT-DMZ traversal, and PLC access. This is the realistic threat model for industrial environments.
3. Network Segmentation Verification
Validation that IT and OT networks are truly segmented, firewall rules enforce the intended policy, and no uncontrolled paths exist between enterprise and control networks.
4. Industrial Protocol Analysis
Deep analysis of Modbus, DNP3, OPC UA, PROFINET, and EtherNet/IP. Protocol-level authentication, command exposure, and access from network-adjacent positions.
5. Remote Access Security Assessment
Testing every remote access path: VPN, cellular and GSM modems, vendor connections, jump servers, and bastion hosts. Vendor cellular access is how most real OT compromises begin.
6. Physical Security Assessment
Where scope permits: badge cloning, physical access control bypass, NFC and RFID testing using Flipper Zero, and tailgating. Physical access often bypasses every network control.
7. External Attack Surface Discovery
ShadowMap identifies internet-facing industrial assets, exposed SCADA and HMI interfaces, leaked credentials associated with OT, and shadow assets missing from inventory.
"We needed an assessment on a 3-week timeline because of a partner integration deadline. Security Brigade turned it around in 18 days, including the L2 and L3 reviews. The report was regulator-ready — we submitted it to our partner's compliance team unchanged. When speed and credibility both matter, they're the only call we make."
FAQ
OT and SCADA security, answered
Safety, method and what we actually find. Talk to our team about your control environment.
Contact usWill testing disrupt production?
Where do attacks on control environments actually start?
Our equipment is twenty years old and cannot be patched. What then?
How does this relate to IEC 62443?
Do you need to be on site?
Stay protected between assessments with ShadowMap
Continuous attack surface monitoring: it discovers new assets, detects credential leaks, and alerts on new exposures the day they appear.
Discuss Your Industrial Security Requirements
Scope a non-intrusive OT and SCADA assessment with engineers who understand industrial constraints.
Typically responds within 1 business day · No commitment required