What is Asset Discovery?
Asset Discovery is the process by which an organisation detects, identifies and classifies all devices, systems and software in its IT and OT networks, creating a complete and current picture of what is actually present. The result of that process is the Asset Inventory: the recorded list of assets and their attributes. Discovery underpins virtually every cybersecurity measure, because you can only protect what you know about.
In OT environments, the focus is on PLCs, SCADA servers, HMIs, RTUs, field equipment and other embedded components, often spread across multiple sites and decades old. There, how you discover matters as much as what you find: the wrong scan can bring a production process to a halt.
🎯 Why is Asset Discovery essential?
In practice, spreadsheets and drawings always lag behind reality. A technician adds an extra switch, a vendor installs a 4G router for remote maintenance, or a replacement PLC arrives with different firmware. Discovery reveals the gap between what is documented and what is actually communicating. It delivers:
- Inventory - a complete overview of devices, operating systems, firmware and network interfaces
- Risk assessment - vulnerable or outdated assets become visible and can be matched to CVEs
- Access management - determining who has access to which systems and over which connections
- Monitoring and detection - a known baseline enables anomaly detection and makes a rogue device stand out immediately
- Management and patching - supports updates, maintenance planning, lifecycle management and the replacement of legacy systems
Regulation demands it too. IEC 62443-3-3 requires a current component inventory through SR 7.8 from Security Level 2 upwards, and NIS2 explicitly lists asset management in the duty of care of Article 21. In the Netherlands, that duty applies through the Cybersecurity Act (Cyberbeveiligingswet), which entered into force on 15 August 2026.
🔍 What Asset Discovery methods are there?
| Method | How it works | Strength | Limitation in OT |
|---|---|---|---|
| Passive | Listening to network traffic via a SPAN port or TAP and dissecting the protocols | No extra traffic to devices, so no risk to the process | Only sees devices that communicate; serial equipment behind gateways stays invisible |
| Active (broad scanning) | Ping sweeps and port scans across entire subnets | Fast and complete in IT networks | Can make older controllers hang; in production networks only during maintenance windows |
| Selective active (native queries) | Targeted, read-only requests in the device’s own protocol | Retrieves firmware, serial number and modules, even from silent devices | Requires protocol and device knowledge; always test first |
| Agent-based | Software on Windows or Linux hosts reports on itself | Detailed software and patch information | Impossible on PLCs and field devices; the vendor must allow it |
| Configuration analysis | Reading engineering projects, switch configurations, ARP tables and DHCP logs | No network impact, also covers serial networks | A snapshot; depends on up-to-date files |
| Physical inspection | Walking the cabinets and recording nameplates | Also finds disconnected and serial equipment | Labour-intensive and error-prone |
No single method is complete on its own. Modern OT platforms therefore combine passive monitoring with selective, read-only queries. Tenable OT calls this Active Query and Nozomi Smart Polling; Claroty and Dragos offer a similar combination.
⚠️ Why is active scanning risky in OT?
Many controllers have a limited network stack and little processing power. An unexpected packet, a half-open TCP connection or a rapid burst of requests can cause a device to stall, restart or drop into a fault state. Two incidents from 1998 are classic examples:
- Semiconductor plant - a ping sweep intended to inventory all hosts caused the system controlling the production of integrated circuits to hang, destroying around 50,000 dollars’ worth of wafers
- Robotic arm - during a ping sweep on a SCADA network, a 9-foot robotic arm that had been in standby suddenly became active and swung 180 degrees
That is why OT follows firm rules: passive first, active only when targeted, at low speed, outside production or in agreement with the process owner, and never with standard IT scan profiles. The same applies to vulnerability scanning.
🔧 How does a tool recognise an OT device?
Specialised tools use the identification functions that industrial protocols provide themselves:
| Protocol | Identification mechanism | What it returns |
|---|---|---|
| ProfiNET | DCP Identify (layer-2 multicast) | Station name, device type, IP settings |
| IP | ListIdentity request on UDP port 44818 | Vendor, product type, revision, serial number |
| Modbus TCP | Function code 43, MEI type 14 (Read Device Identification) | Vendor, product code, version (if the device supports it) |
| BACnet | Who-Is / I-Am | Device instance and vendor ID |
| S7 | Reading system status lists (SZL) | CPU type, order number, firmware version |
| SNMP | MIB reads from switches and hosts | Interfaces, MAC tables, neighbours |
With passive analysis, the tool picks up the same information whenever an engineering station or SCADA server requests it. Traffic in DNP3 and OPC UA also reveals the role and relationships of devices. In addition, the OUI part of the MAC address (the first three bytes) reveals the manufacturer of the network interface.
✅ What is captured during Asset Discovery?
The joint guidance Foundations for OT Cybersecurity: Asset Inventory Guidance from CISA and partners, including the Dutch NCSC (August 2025), lists fourteen high-priority attributes, such as protocols, criticality, role, hostname, IP and MAC address, manufacturer, model, operating system, location, ports and user accounts. An example entry:
| Attribute | Example value |
|---|---|
| IP and MAC address | 192.168.10.45 – 00:1B:1B:01:23:AF |
| Device type | Siemens S7-1200 CPU 1214C |
| Firmware version | V4.6 |
| Communication protocols | PROFINET, Modbus TCP |
| Serial interface | CM 1241 RS-485 module |
| Physical location | Production line 2, cabinet 3 |
| Criticality | High (controls filling machine) |
| Last seen | 2026-09-14 10:36 |
🛠️ How do you approach Asset Discovery in an OT environment?
- Define scope and objectives - which sites, zones and levels of the Purdue Model are in scope, and what counts as an asset
- Gather existing sources - drawings, engineering projects, CMMS and CMDB data
- Choose capture points - SPAN ports or TAPs on the core switches of each segment, so that east-west traffic is visible too
- Start passively - let the sensor listen for a few weeks so that weekly or batch-driven communication also shows up
- Fill the gaps selectively - retrieve silent devices and firmware details with tested, read-only native queries and a cabinet inspection
- Validate and enrich - record criticality, owner and location together with operators
- Keep it continuous - discovery keeps running; new devices raise an alert in monitoring or the IDS
As a benchmark, CIS Controls v8.1 asks for an active discovery tool that runs at least daily (safeguard 1.3) and passive discovery that updates the inventory at least weekly (safeguard 1.5). Smaller organisations without a commercial platform can use open-source tools such as Wireshark for manual analysis and Malcolm, an analysis suite from Idaho National Laboratory and CISA built on Zeek and Arkime. The older NSA tool GRASSMARLIN was archived in April 2023 and is no longer maintained.
🔁 How does Asset Discovery relate to other processes?
| Process | Relationship to Asset Discovery |
|---|---|
| Patch management | Requires insight into versions and vulnerabilities per asset |
| Access Control | Restricting access to known and approved systems |
| Monitoring | Discovery provides the baseline for detecting anomalies |
| Incident Response | Quickly determining which assets are affected or vulnerable |
| Backup | The inventory determines which systems and projects need backups |
| Network Segmentation | Communication relationships from discovery form the basis for zones and firewall rules |
📦 What is the difference between Asset Discovery in IT and OT?
| IT | OT |
|---|---|
| Servers, laptops, printers | PLCs, HMIs, RTUs, field components |
| Active scanning via SNMP and WMI | Passive analysis of industrial protocols plus selective queries |
| CMDB or endpoint agent | Integration with Historian, SCADA and CMMS |
| Devices live 3–5 years | Devices often run for 15–25 years |
| Cloud-native tools | On-premise or network-isolated sensors |
OT requires tools that recognise protocols such as Modbus, S7, DNP3 or OPC UA without affecting the process.
❓ Frequently asked questions
What is the difference between Asset Discovery and an Asset Inventory?
Asset Discovery is the process of detecting and identifying devices and software. The Asset Inventory is the result: the recorded, managed list of attributes per asset. Without ongoing discovery, an inventory quickly goes out of date.
Is passive Asset Discovery always safe for OT?
Passive Asset Discovery sends no traffic to devices itself and is therefore safe for the process. The risk lies in the connection: installing a TAP may need a brief interruption, and a poorly configured SPAN port can put load on a switch. Plan that installation together with the process owner.
Why does passive discovery not find every device?
Passive discovery only sees devices that communicate on a monitored network segment. Silent spare equipment, devices on serial networks behind a gateway and traffic on unmonitored switches stay invisible. Selective queries, configuration analysis and cabinet inspections close those gaps.
How often should Asset Discovery be performed?
In OT, Asset Discovery should run continuously through passive sensors, so that new or changed devices stand out immediately. CIS Controls v8.1 sets a minimum of a daily active scan and a weekly inventory update from passive discovery. A periodic physical check is needed as well.
Which tools are used for OT Asset Discovery?
Well-known commercial platforms are Claroty, Nozomi, Dragos, Tenable OT and Microsoft Defender for IoT. Open-source alternatives include Malcolm from Idaho National Laboratory and CISA and, for manual analysis, Wireshark. The choice depends on the protocols in use, the number of sites and the integration with SIEM and CMDB.
Does NIS2 require Asset Discovery?
NIS2 does not use the term Asset Discovery, but the duty of care in Article 21 includes asset management. A current overview of systems is only achievable in practice with some form of Asset Discovery. For OT asset owners and suppliers, IEC 62443-3-3 SR 7.8 aligns with this requirement.
📌 In summary
Asset Discovery is the foundation of OT Security: without complete and current visibility of assets, no measure, from patching to access management, can be relied upon.
In IT an active scan is often enough, but in OT you start passively, fill the gaps with safe native queries and physical inspection, and keep discovery running continuously. The result is an inventory that underpins risk analysis, segmentation, detection and the duty of care under NIS2 and the Dutch Cybersecurity Act.