What is Vulnerability Scanning?
Vulnerability scanning is the automated examination of systems, devices and software for known vulnerabilities, such as unpatched software, misconfigurations, default passwords or outdated firmware. A scanner compares what it finds (product names, versions, open ports, settings) with a database of known weaknesses, usually based on CVE identifiers. It is the measurement step within the wider process of vulnerability management: scanning shows what is vulnerable, while the management process decides what you do about it. In OT environments scanning is valuable but risky, because industrial equipment copes poorly with aggressive network traffic.
🧠 Why is vulnerability scanning important in OT?
Industrial installations often run for ten to twenty years with the same PLCs, HMIs and SCADA servers. During that time dozens of new vulnerabilities are published, while it is often unclear which firmware version runs where. A scan makes that visible.
| Challenge | What scanning delivers |
|---|---|
| Legacy systems without patch management | An overview of known vulnerabilities per device and version |
| Unknown components or versions | An inventory of firmware, operating systems and software |
| Supply chain risks | Identification of vulnerable supplier components and libraries |
| Unintended exposure | Open ports, unnecessary services and forgotten remote access |
| Configuration drift | Deviations from the agreed hardening baseline |
Without this insight you prioritise on gut feeling. With an up-to-date picture of your vulnerabilities you can decide which systems need a patch, an extra firewall rule or stricter segmentation first.
🔧 What types of vulnerability scans are there?
| Type | How it works | Suitable for OT? |
|---|---|---|
| Network scan (unauthenticated) | Sends packets to an IP range and infers from ports, banners and responses which software is running | Only in a limited, tested form and in a maintenance window |
| Credentialed scan | Logs into the system and reads installed software, patches and settings directly; more accurate with fewer false positives | Good for Windows and Linux servers in OT, such as historians and engineering workstations |
| Passive scan | Monitors network traffic via a SPAN port or TAP and recognises devices and versions from their communication | Yes, the safest baseline; only sees devices that communicate |
| Active query (native protocol) | Asks devices for their identity and firmware version in their own industrial protocol, read-only | Yes, provided it is tested per controller type beforehand |
| Firmware and software analysis | Compares firmware versions or dissects binaries and SBOMs for known vulnerable components | Yes, it happens offline |
| Web application scan | Tests web interfaces of HMIs, VPN gateways and historians for issues such as weak authentication | Only in a test environment or with great restraint |
A vulnerability scan is not the same as a penetration test. The scan searches broadly and automatically for known weaknesses; a penetration tester actually tries to exploit them and chains them into an attack path.
⚠️ Why is active scanning risky in OT?
Many embedded devices have a minimal TCP/IP stack and little processing power. A standard IT scan opens thousands of connections in a short time and sends unusual packets. A controller may then hang, drop into a stop state or lose communication with its I/O. NIST SP 800-82 cites two well-known examples: a ping sweep on a SCADA network that made a 9-foot (about 2.7 m) robotic arm in standby suddenly swing 180 degrees, and a ping sweep for inventory purposes that hung a system in a chip fabrication plant, destroying 50,000 dollars’ worth of wafers. The same guide notes that automated network scanning does not work on non-routable connections such as serial networks; there you depend on a manual inventory checked against advisories.
That is why OT follows the order passive first, then carefully controlled active:
- Passive monitoring as the baseline - platforms such as Tenable OT, Nozomi, Claroty and Dragos build an asset list from observed traffic and match it against known vulnerabilities (see also Passive Monitoring)
- Active queries instead of broad scans - targeted, read-only requests in the device’s own protocol, for example to retrieve a firmware version; NIST calls this combination of passive learning and device-specific querying “safe active scanning”
- Credentialed scans for IT-like systems - Windows and Linux machines in OT can usually be scanned safely with credentials, provided the control system vendor (DCS or SCADA) has approved the scanner and scan profile
- Slow settings for active scans - in Nmap, for example, the polite template (T2) with 400 milliseconds between probes, without aggressive version or script detection
- Test first - try every scan profile on a spare PLC, in an OTAP test environment or on a digital twin
🛠️ How do you run a vulnerability scan safely in OT?
- Define the scope - which zones and assets, based on your asset inventory and the Purdue Model; exclude safety systems by default.
- Choose the method per asset type - passive for controllers, credentialed for servers, offline analysis for firmware.
- Coordinate through change management - record the timing, scan profile, contacts and a fallback plan, and involve engineering and operations.
- Test the profile - on identical hardware or in a test environment, and note which devices respond abnormally.
- Run it in a maintenance window - preferably during a planned outage, with someone from operations on standby watching the process.
- Assess and prioritise - combine the CVSS score with reachability, process impact and the KEV catalogue from CISA.
- Record and follow up - log findings in the risk register and pass them on to patch management or compensating controls.
Typical frequencies differ widely between IT and OT:
| Environment | Common approach | Typical frequency |
|---|---|---|
| IT office network | Automated, often credentialed scans | Weekly to monthly; PCI DSS requires at least quarterly |
| Internet perimeter | External scan of public IP addresses | Continuous or monthly |
| OT servers (historian, engineering workstation) | Credentialed scan in a maintenance window | Quarterly or per maintenance shutdown |
| OT controllers and field devices | Passive monitoring plus matching against advisories | Continuously passive; active at most during a planned outage |
An outside-in view helps as well: many organisations also check whether OT systems are unintentionally reachable from the internet (see internet-exposed OT).
🔐 Which standards and laws call for vulnerability scanning?
- IEC 62443-4-1 - in practice 5 (verification and validation), suppliers must test their products for vulnerabilities (SVV-3), including known-vulnerability scanning, software composition analysis and fuzzing, plus penetration testing (SVV-4).
- NIST SP 800-82 - the NIST OT guide (Revision 3, September 2023) recommends ongoing vulnerability identification with passive or active tools, testing scanning tools offline first and scheduling active scans during planned OT outages wherever possible.
- NIS2 - in the Netherlands implemented by the Cyberbeveiligingswet, in force since 15 August 2026; the duty of care in Article 21 explicitly covers vulnerability handling and disclosure.
- Cyber Resilience Act - manufacturers of products with digital elements must identify and document vulnerabilities, including an SBOM, and test their products regularly.
Suppliers increasingly publish vulnerabilities as machine-readable advisories (CSAF and VEX). A scanner or OT monitoring platform can match these directly against your asset list, so you can see which devices are affected even without an active scan.
✅ What are the best practices?
- Combine scanning with Asset Inventory and Asset Discovery: you can only assess what you know
- Only scan at agreed times, coordinated through Change Management
- Document every finding in the Risk Register and assign an owner to each one
- Prioritise on risk: a CVSS score alone says little without the context of reachability and process impact
- Track trends in SIEM or dashboard reports, for example the number of open critical vulnerabilities per zone
- Cover supplier components through Third Party Risk Management and ask suppliers for SBOMs and advisories
- Never run standard IT scan profiles from Nessus or OpenVAS untested on a production network
❓ Frequently asked questions
Can vulnerability scanning crash a PLC?
Yes, an active vulnerability scan can make a PLC or other embedded device hang or drop into a stop state. This is caused by the limited network stack and processing power of many controllers. That is why vulnerability scanning in OT starts with passive monitoring and active scans are tested first.
What is the difference between active and passive vulnerability scanning?
In active vulnerability scanning the scanner sends traffic to systems itself and analyses the responses. In passive scanning the tool only observes existing network traffic and infers devices, versions and vulnerabilities from it. Passive is safer, but it misses silent devices and versions that are not visible in the traffic.
What is a credentialed scan?
A credentialed scan is a vulnerability scan in which the scanner logs into the system with an account and reads installed software and patches directly. This gives more accurate results and fewer false positives than a scan from the outside. In OT it is mainly suited to Windows and Linux servers such as historians and engineering workstations.
How often should you scan for vulnerabilities in OT?
There is no fixed legal frequency for vulnerability scanning in OT. Common practice is continuous passive monitoring, supplemented by credentialed scans of servers each quarter or each maintenance shutdown. In addition, you should check new advisories from suppliers and CISA against your asset list as soon as they appear.
Is a vulnerability scan the same as a penetration test?
No, a vulnerability scan searches automatically and broadly for known vulnerabilities without exploiting them. A penetration test is manual work in which a tester actually exploits weaknesses to demonstrate their impact. In OT a penetration test is preferably carried out in a test environment, because exploitation can disrupt the process.
Which tools are used for vulnerability scanning in OT?
In OT, specialised platforms such as Tenable OT Security, Nozomi Networks Guardian, Claroty and Dragos are mainly used, combining passive monitoring with read-only active queries. General-purpose scanners such as Nessus and OpenVAS suit the IT side and OT servers. On controllers you only use them with tested, restricted profiles.
📌 In summary
Vulnerability scanning makes known weaknesses in your IT and OT systems visible, but in OT it starts with passive monitoring, and active scanning is only carried out when tested, planned and coordinated with operations.
If you link scanning to an up-to-date asset inventory, risk-based prioritisation and a closed-loop process for patching or compensating controls, you meet the expectations of IEC 62443 and NIS2 without putting production at risk.