Most engineers think…
The most dangerous assumption in OT security is: 'We can just run our standard vulnerability scanner across the factory floor and see what's there.' In OT environments, an active scan can crash a PLC mid-cycle, trip a relay, or stop a production line.
Forescout eyeInspect takes the opposite approach: it receives a passive mirror of OT network traffic and decodes hundreds of industrial protocols — Modbus, DNP3, EtherNet/IP, PROFINET, BACnet, HL7 for medical — without sending a single packet to any device. The result is a complete Purdue-aware asset inventory that includes the PLCs, RTUs, infusion pumps and SCADA historians that no IT tool can see, scored by real-world exploitability, not just CVSS.
① Why OT/IoT security demands passive discovery — not active scanning
In an enterprise IT environment, an Nmap sweep across a /16 is routine housekeeping. On an OT network the same sweep can crash a PLC, corrupt a SCADA historian state, or trigger an unexpected relay in a power substation. Active scanning is unsafe in OT — this is not a policy limitation but a physical-world safety issue.
Forescout addresses this with passive, agentless discovery. A network TAP or SPAN port mirrors a copy of OT traffic to the eyeInspect sensor. The sensor never sends anything onto the OT network; it only reads. Because industrial protocols like Modbus, DNP3 and EtherNet/IP carry device identity, firmware version and function codes in plain-text headers, passive deep-packet inspection can build a richer asset profile than most active scanners produce on IT networks.
Medical devices face the same constraint: infusion pumps, patient monitors, and MRI controllers often run embedded real-time operating systems that respond to unexpected traffic by halting or alarming — a clinical risk no security tool should create. IoMT visibility therefore requires exactly the same passive approach as OT.
Why is active scanning dangerous on an OT network?
② eyeInspect and the Purdue Model — visibility layer by layer
The Purdue Model divides OT into six levels. Forescout eyeInspect (formerly SilentDefense) delivers visibility at every one of them — not just at the IT/OT boundary (Level 3/4) where most tools stop.
What you see at each level
- Level 0 (Field): sensors, actuators, field transmitters — eyeInspect detects them by their Modbus/PROFINET traffic fingerprint.
- Level 1 (Control): PLCs, RTUs, IEDs — the most targeted layer in 2025 according to Forescout research; identified by function codes in protocol headers.
- Level 2 (Supervisory): SCADA, DCS, BMS — eyeInspect maps communication paths between supervisory systems and the Level 1 controllers.
- Level 3 (Operations): historians, MES, PLM — often sitting at the dangerous IT/OT boundary where lateral movement originates.
- Levels 4–5 (Enterprise): standard IT and cloud assets managed by the broader Forescout platform, providing the unified view.
Because eyeInspect decodes over 150 industrial protocols via DPI, it automatically classifies each discovered device with vendor, model, firmware version, open communication ports and recent protocol behaviour — without any agent or device configuration change.
Forescout's passive OT/ICS sensor — decodes 150+ industrial protocols via DPI on mirrored traffic, building a full asset inventory without sending a single packet to any OT device.
Six-level reference architecture separating physical processes (L0–L2), operations (L3) and enterprise IT (L4–L5). eyeInspect provides visibility at every level, not just the IT/OT boundary.
Triggered when eyeInspect detects a device communicating on an OT VLAN with no baseline entry — carries derived identity, first-seen timestamp and communication peer for rapid triage.
A composite 0–10 score combining asset criticality, network exposure and CISA Known Exploited Vulnerabilities (KEV). Surfaces the highest-priority remediations across the converged IT/OT estate.
In an interview, go beyond 'we deployed eyeInspect'. Say where: SPAN ports on the Level 2/3 boundary switch and TAPs at the IT/OT demilitarised zone (DMZ). Placement determines whether you see Level 1 control traffic or only the historian-to-IT path — and examiners know the difference.
At which Purdue Model level are PLCs, RTUs and IEDs found — the layer Forescout's 2025 research identified as most targeted?
③ Unmanaged and rogue device detection — finding what should not be there
Two distinct problems exist in OT/IoT environments. Unmanaged devices are legitimate assets that were never enrolled in any asset management system — legacy PLCs installed years ago, a smart UPS added by facilities, or an IoMT pump whose purchase bypassed the IT procurement process. Rogue devices are unauthorised additions — an attacker's Raspberry Pi bridging OT to IT, or an unsanctioned wireless access point connected to the control network.
eyeInspect distinguishes these by comparing discovered devices against a learned baseline of authorised communication paths and device identities. Any device communicating on an OT VLAN that has no baseline entry generates an alert. The alert carries the device's derived identity (vendor, firmware, protocol spoken), the first-seen timestamp, and the communication peer — enough for an operator to confirm 'new PLC we just installed' versus 'unknown device, escalate immediately'.
For IoMT, Forescout also integrates with clinical asset data to detect devices operating outside their approved network segment (for example, an infusion pump communicating with an external IP address) — a common indicator of compromise or misconfiguration in hospital environments.
eyeInspect's first-time baseline phase typically surfaces hundreds of 'unknown' devices — most are legitimate but unenrolled legacy assets. Jumping straight to isolation causes operational disruption. Always spend the baseline period classifying devices by protocol fingerprint before defining rogue-detection rules.
▶ Watch eyeInspect passively discover a rogue device on the OT network
A Modbus traffic mirror reveals an unauthorised device on the Level 1 segment. Press Play for the healthy discovery path, then Break it to see the classic passive sensor failure.
An infusion pump appears in the eyeInspect discovery log with no baseline entry and is communicating with an external IP. What is the correct classification?
④ Risk scoring and IT/OT convergence — the unified security picture
Knowing a device exists is not enough. Forescout eyeInspect computes a composite risk score for every OT/IoT asset using three factors: asset criticality (what would fail if this device were offline or compromised?), network exposure (what can reach it and what can it reach, including cross-zone paths?), and Known Exploited Vulnerabilities (KEV) from CISA's catalogue. The 2025 Forescout report found the average device risk score rose to 8.98, a significant increase from the prior year, driven primarily by vulnerabilities in Purdue Level 1 and Level 3 devices.
IT/OT convergence is the hardest operational challenge: historians at Level 3 bridge the OT network to enterprise systems and cloud services, creating lateral movement paths that adversaries actively exploit. Forescout addresses this by feeding the eyeInspect asset and risk data into the Forescout platform alongside IT device posture, so a single dashboard shows the full estate — managed laptops, unmanaged PLCs, IoMT pumps and cloud workloads — with a common risk vocabulary.
Practical convergence workflow
The recommended approach is to deploy eyeInspect passive sensors at the IT/OT boundary VLANs first, confirm coverage of Level 2–3 assets, then extend sensors deeper into Level 1 segments. Import the OT asset inventory into the Forescout platform, define criticality tags (safety-critical, revenue-critical, low-impact), and let the risk engine surface the highest-priority remediations before touching any device.
Kavita at a Mumbai pharmaceutical plant faces this
After a Forescout eyeInspect deployment, the risk dashboard shows 47 devices with scores above 8.5 — far more than the security team expected. Management wants an explanation and a remediation plan within 48 hours.
Dozens of legacy PLCs and unpatched SCADA historian servers at Levels 1–3 were never enrolled in any asset management system. Several have CISA KEV entries and communicate across the IT/OT boundary with no segment controls.
eyeInspect asset report: filter by risk score >8.5, sort by network exposure. Historians at Level 3 with routes to enterprise IT appear at the top — they have KEV matches and high criticality tags.
eyeInspect ▸ Asset Intelligence ▸ Risk Dashboard ▸ Filter: exposure=cross-zone, KEV=yesTag the Level 3 historians as safety-critical in Forescout, immediately enforce micro-segmentation policies to block unnecessary cross-zone paths, apply compensating controls (IDS alerts) on KEV-matched Level 1 PLCs that cannot be patched, and schedule firmware updates for devices where patches exist.
Re-check the risk dashboard after 72 hours: cross-zone exposure count should drop, and the average risk score for tagged devices should reflect the compensating controls applied.
A PLC with CVSS 9.8 but no active exploit matters less than one with CVSS 6.5 and a CISA KEV entry actively used in ICS campaigns. Always verify your OT risk prioritisation filters on KEV flag, not raw CVSS — that is what Forescout's composite scoring enforces.
A legacy PLC has a CVSS 9.8 vulnerability but sits on an isolated Level 1 segment with no cross-zone reach. How does Forescout's composite risk score reflect this?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does Forescout use passive discovery for OT/IoT instead of active scanning, and what makes the Purdue Model relevant to how it deploys sensors? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- eyeInspect (SilentDefense)
- Forescout's passive OT/ICS sensor — decodes 150+ industrial protocols via traffic mirroring to build a full asset inventory without sending any packets to OT devices.
- Purdue Model
- Six-level reference architecture (L0 field → L5 enterprise) separating OT physical processes from operations management and IT — used to define security zones and sensor placement.
- Passive discovery
- Asset identification by reading mirrored network traffic only, with no packets sent to target devices — mandatory in OT/IoT to avoid disrupting PLCs and medical devices.
- IoMT (Internet of Medical Things)
- Networked clinical devices in healthcare settings — infusion pumps, patient monitors, ventilators, imaging systems — requiring the same passive discovery approach as industrial OT.
- Known Exploited Vulnerabilities (KEV)
- CISA's catalogue of vulnerabilities actively exploited in real-world attacks, used by Forescout as one factor in the composite OT risk score.
- Rogue device
- An unauthorised device communicating on an OT network segment with no baseline entry — distinguished from unmanaged devices by anomalous identity or communication path.
- IT/OT convergence
- The integration of enterprise IT networks and operational technology networks, creating lateral movement paths that adversaries exploit — especially through Level 3 historian systems.
- Deep Packet Inspection (DPI)
- Reading the full payload of a network packet — not just the header — to extract device identity, protocol state and operational data from industrial protocol frames.
📚 Sources
- Forescout — eyeInspect product page: passive OT/ICS security and protocol coverage. forescout.com/products/eyeinspect/
- Forescout Press Release — First Solution to Cover Managed and Unmanaged Devices Across All Purdue Levels (eyeInspect 5.5, 2024). businesswire.com/news/home/20240919149447/
- Forescout — 2025 Riskiest Connected Devices Report: average device risk score 8.98, Level 1 and Level 3 most targeted. forescout.com/press-releases/forescout-announces-riskiest-connected-devices-of-2025/
- Industrial Cyber — Forescout OT Security SaaS: asset intelligence, risk management and threat detection for hybrid OT environments (2025). industrialcyber.co/technology-solutions/forescout-ot-security-saas
- Forescout Blog — Providing Scalable ICS Visibility for Converged IT-OT Cybersecurity. forescout.com/blog/providing-scalable-ics-visibility-for-converged-it-ot-cybersecurity/
- CISA — Known Exploited Vulnerabilities (KEV) Catalogue — used by Forescout for OT risk prioritisation. cisa.gov/known-exploited-vulnerabilities-catalog
What's next?
Got the OT/IoT visibility picture? Next, go deep on Forescout eyeSegment — how dynamic segmentation policies enforce micro-perimeters around PLCs, IoMT devices and cloud-connected OT assets without touching existing network infrastructure.