An unknown connection or an older computer can compromise security throughout the entire production environment. At the same time, the equipment must continue to function as security measures are enhanced. During his presentation at our “ Plantvision ” Technology Insight 2026 event, Marcus Skymne, a consultant in OT cybersecurity and architecture, described a practical approach to gaining better control over the OT network. This article summarizes how inventory, monitoring, and protection can be combined with production’s availability requirements.
The inventory system needs to work in the production environment
The first step is to identify what needs to be protected. Marcus focused on network equipment, such as PLCs, operator panels, computers, and servers. This information needs to be collected and kept up to date. Separate Excel spreadsheets and local systems do not automatically provide a comprehensive overview of what exists or what is changing.
The method used to detect the equipment must also be chosen with operational considerations in mind. Active scanning sends queries to devices on the network. Marcus warned that older equipment in a production environment may respond to such queries in a way that disrupts its normal operation. The inventory must therefore be planned so that it does not jeopardize the production it is intended to protect.
Furthermore, the asset inventory is only part of the picture. Every device has potential points of attack, such as network connections, software, services, and USB ports. Even temporarily connected computers and vendors’ remote connections need to be accounted for. Anything that isn’t documented may still be present on the network and pose a risk.
Passive monitoring shows how the equipment communicates
To understand the network, you need to know which devices are communicating and what the traffic looks like. Marcus described a passive network sensor that monitors traffic to build a picture of the equipment and communication patterns. This provides a basis for detecting anomalies and investigating traffic that shouldn’t be present.
Nozomi was used as an example of how network traffic can provide information about a PLC, its model, modules, and versions. This data can be linked to known vulnerabilities and serve as a basis for further work. Marcus also explained how a customer with good control over their network nevertheless detected communication between two devices that were not supposed to communicate with each other.
Computer monitoring can supplement the network view by recording events within the device, such as when a service is started or shut down. These different perspectives help us understand both the network traffic and what is happening within the systems. Marcus also emphasized that detected problems need to be addressed: the information may reveal things we’d rather not know, but the risks remain even if we’re unaware of them.
Vulnerabilities must be addressed with a feasible action plan
Once equipment and vulnerabilities have been identified, they need to be classified based on how critical the assets are and what can be done to address them. An update can sometimes fix a vulnerability, but major version changes can affect compatibility with the rest of the environment. Obsolete equipment may instead need to be replaced, which also raises questions about spare parts and continued operation.
Marcus used older Windows XP-based systems as examples. The cost does not necessarily lie in purchasing a new operating system, but rather in modifying or replacing the hardware that the computer controls. Updates and other interventions must therefore be scheduled during appropriate service windows. The inventory provides a basis for prioritizing what needs to be addressed when the opportunity arises.
Hardening and segmentation were highlighted as key measures. Hardening involves limiting functions and services to what is necessary and strengthening control over access. Segmentation divides the network so that equipment can only communicate where there is a need. The segmentation must take into account both function and criticality, so that an incident has a harder time spreading further.
Older equipment may need protection around it
In practice, an older device may not support personal accounts or may rely on a password that cannot be easily changed. Marcus presented Xertified as an example of how a separate layer of protection between the device and the network can provide features that the device itself lacks.
The solution was described as a way to manage personal logins, traceability, and controlled remote access. Access rights can be restricted to specific users and times, which is particularly relevant when staffing levels and the ability to handle disruptions vary throughout the day. Communication security was also addressed, with encryption applied along the path where the security solution is in use.
A project using Siemens-based equipment demonstrated how access can be maintained when the equipment is moved. The team needed to continue working while the equipment was being transported from the lab through various locations to the customer. Marcus explained how a remote access solution and a mobile connection made it possible to continue working. This example demonstrated a specific use case for remote access, rather than a general guarantee of how every legacy environment can be protected.
Be resilient at the start of the project
The clearest practical advice from the lecture came during the Q&A session: perform hardening early. If services and features are disabled only after the solution is complete, it may turn out that production depends on them. In that case, security work becomes a last-minute change that risks causing downtime or requiring rework.
Testing the limitations from the outset makes it possible to adapt the solution as it is being built. Marcus highlighted hardening and segmentation as key priorities, along with necessary updates. This requires that security measures be considered in relation to what the equipment is intended to do and what impact the business can handle.
Summary of the Lecture
Better control over the OT network begins with an up-to-date overview of the equipment, its communications, and potential attack vectors. Passive monitoring can provide the basis for detecting anomalies and prioritizing vulnerabilities. Security measures must then be adapted to the specific conditions of the production environment, especially when legacy systems must remain in use. The key takeaway from the presentation was to combine inventory assessments with actionable measures and to incorporate hardening measures right from the outset when designing a solution.
Which part of your OT network would you like to gain a better understanding of? We’d be happy to discuss what you already know, what you’re unsure about, and what needs to continue functioning as security is strengthened. Get in touch, and we’ll work together to identify a first step that fits your production needs.