Most engineers think…
Most people assume OT vulnerability management works like IT vulnerability management: scan the network, get a list of CVEs, patch the highest CVSS scores first, repeat every week. That model will fail you — and potentially trip a plant shutdown.
In OT, a Nessus-style active scan can crash a PLC or freeze a protection relay mid-cycle. Patching a turbine controller takes a planned maintenance window, vendor approval, and sometimes a safety re-certification. Many devices are end-of-life with no patch ever coming. The real skill is knowing how to use passive CVE matching, risk scoring that weights criticality and exposure — not just CVSS — and compensating controls as first-class remediation. That is what Nozomi is built for.
① Why OT vulnerability assessment is fundamentally different
In IT security, running an active vulnerability scanner against a server is routine. In OT, the same action can crash a PLC, freeze a protective relay, or trigger a safety system trip. OT devices — PLCs, RTUs, HMIs, protection relays — were engineered for reliability and determinism, not for the kind of TCP probing a Nessus scan sends. A malformed packet or unexpected connection attempt is enough to force a fault state.
Nozomi sidesteps this entirely. Guardian passively monitors network traffic via a SPAN/mirror port or TAP, building a rich asset inventory of every device: vendor, model, firmware version, OS, open protocols, and communication patterns. Vulnerability assessment is then performed by matching those attributes against a CVE database — no extra packets, zero operational impact.
The second key difference is the OT patch paradox: a high-CVSS CVE on a protection relay doesn't mean you can patch it this week. OT devices run on long maintenance cycles, vendor-certified firmware, and high-availability requirements that make even a planned reboot a significant event. Nozomi's risk framework is designed around this reality — helping you manage and reduce risk even when patching is months away.
Why does Nozomi perform vulnerability assessment passively rather than with an active scanner?
② How Nozomi discovers, matches and scores vulnerabilities
Vulnerability assessment starts with the asset inventory Guardian has already built passively. For each discovered asset, Nozomi looks up the vendor + model + firmware version in its CVE matching database — enriched by the Asset Intelligence subscription from Nozomi Networks Labs, which provides curated asset profiles and up-to-date CVE mappings. When a match is found, a vulnerability finding is created for that asset.
The four-factor risk score
A raw CVSS score alone is a poor prioritisation tool in OT. Nozomi combines four factors: (1) CVSS severity — the industry base score for the CVE; (2) asset criticality — operator-configurable; a protection relay scores higher than a workstation; (3) network exposure — is the device reachable from the IT network or the internet, or is it isolated on a Level 1 field bus?; (4) exploitability — does the attack require authentication or physical access, or is it unauthenticated and remote? The result is a prioritised vulnerability list where a medium-CVSS CVE on a network-exposed, critically important PLC may rank higher than a critical CVSS on an air-gapped historian.
Guardian cross-references discovered vendor/model/firmware against the CVE database — no probe packets sent, so zero risk of crashing a PLC or relay.
CVSS severity + asset criticality + network exposure + exploitability — combined so a medium-CVSS CVE on a critical exposed device ranks higher than a critical CVSS on an air-gapped one.
A security measure applied when patching must wait — network segmentation, firewall ACLs, enhanced monitoring, or Arc host sensor — reducing exploitability until the maintenance window opens.
Nozomi Labs' subscription feed of curated asset profiles and CVE mappings — improves classification accuracy and keeps the vulnerability database current.
In an interview, always say OT risk scoring combines CVSS with asset criticality and network exposure — not CVSS alone. A 9.1 CVE on an air-gapped Level 1 device may rank below a 5.4 CVE on a network-exposed protection relay. That is the answer that separates OT practitioners from IT generalists.
▶ Watch a CVE finding get triaged and controlled
How a passive match becomes a tracked, mitigated risk. Press Play for the healthy path, then Break it to see the classic failure.
A protection relay has a medium-CVSS (5.4) CVE. A historian has a critical-CVSS (9.1) CVE but sits on an isolated Level 1 field bus with no IT connectivity. Which should you prioritise?
③ OT patching constraints and the compensating control toolkit
Before you can manage OT vulnerabilities, you need to internalise why the IT playbook breaks down. Four constraints drive almost every OT patch delay:
- Long maintenance windows — most OT devices only go offline during a planned shutdown: quarterly, annually, or less. Unplanned reboots are unacceptable.
- Vendor-certified firmware — applying an unapproved patch can void certifications (SIL ratings, CE marks, utility board approvals). The vendor must release and certify the update first.
- High-availability requirements — a protection relay that trips during a firmware upgrade can take a transformer offline; a PLC reboot mid-cycle can ruin a production run.
- End-of-life devices — many OT assets run firmware the vendor no longer supports; a patch will never arrive.
When patching must wait, Nozomi pairs vulnerability findings with compensating control guidance: isolate the device to its own VLAN/zone, add firewall ACLs to block protocols the CVE is exposed through, increase anomaly alert sensitivity on that asset in Guardian, and — where possible — deploy the Arc endpoint sensor to add host-level process visibility. These controls reduce exploitability even before the maintenance window opens.
Applying an IT patching cadence to OT will get you into trouble. OT devices run on annual or quarterly maintenance windows, require vendor-certified firmware, and may be end-of-life. If you promise a 30-day patch cycle in an OT context, you will miss it every time. Plan compensating controls as a first-class response, not a fallback.
A PLC running end-of-life firmware has a known CVE with no vendor patch available. What is the correct Nozomi-guided response?
④ Closing the loop — remediation workflow and verification
Identifying a CVE is step one; closing the risk is the goal. Nozomi Guardian and Vantage export vulnerability reports in multiple formats (PDF, CSV, API) so findings can be pushed into a ticketing system — natively integrated with ServiceNow, among others. Each ticket captures the asset, the CVE, the risk score, the recommended action (patch, compensating control, or accepted risk with justification), and the target maintenance window.
Vantage IQ (the AI analytics add-on) helps large teams triage across many sites — correlating vulnerabilities, flagging which assets share the same unpatched CVE across regions, and surfacing the highest-risk cluster for immediate action. After compensating controls are applied, Guardian's anomaly detection actively monitors the asset for exploitation attempts, giving early warning even before a patch exists. Once a maintenance window delivers a patch, the asset is re-assessed — the vulnerability should no longer appear in the prioritised list, confirming closure.
Deepa Krishnan, OT security analyst at IndusGrid Power Pvt. Ltd. in Chennai, faces this
Guardian flags 47 CVEs on a GE UR-series protection relay, including one with a high CVSS score. Management immediately asks 'when will it be patched?'
The relay runs firmware the utility board has certified; the vendor has not released a patch for this version; the next maintenance window is six months away.
In Vantage ▸ Vulnerabilities — filter by the relay asset and review the top-ranked CVE: attack vector is Network, authentication required is None — unauthenticated remote exploit. Guardian confirms the relay is reachable from the IT VLAN.
Vantage ▸ Vulnerabilities ▸ Filter by asset + Export ▸ ServiceNow ticketMove the relay to an isolated VLAN, add firewall ACLs blocking all traffic except the required DNP3 polling from the SCADA server, increase Guardian anomaly alert sensitivity on that asset, and create a ServiceNow ticket targeting the next maintenance window for firmware update.
Confirm in Guardian that no IT-zone traffic reaches the relay; verify anomaly alerts are active on the asset; re-assess after the maintenance window — the CVE should drop from the prioritised list once firmware is updated.
Don't close a vulnerability ticket on 'patch applied'. Run Guardian re-assessment to confirm the CVE no longer matches the updated firmware. The asset's vulnerability list should be clean — or clearly shorter — for the ticket to be closed legitimately.
How does Vantage IQ add value to vulnerability management in a multi-site OT estate?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why is CVSS score alone a bad prioritisation tool for OT vulnerability management? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- CVE (Common Vulnerabilities & Exposures)
- A public identifier for a known security flaw in a product, with a CVSS severity score and remediation guidance.
- CVSS (Common Vulnerability Scoring System)
- A 0–10 numeric score rating a CVE's severity based on exploitability, scope, and impact — used as one input, not the only input, in OT risk scoring.
- Passive vulnerability assessment
- Matching discovered asset attributes to CVEs without sending active probe packets — essential in OT where probes can crash PLCs or relays.
- Asset Intelligence
- Nozomi Labs' subscription feed of curated vendor/model/firmware profiles and current CVE mappings that keeps the vulnerability database accurate and up to date.
- Compensating control
- A security measure applied when a vulnerability cannot be patched immediately — network segmentation, firewall ACLs, enhanced monitoring, or Arc host agent — that reduces exploitability until a patch window opens.
- OT maintenance window
- A scheduled period (often annual or quarterly) when OT devices can be taken offline for firmware updates — the only safe time to patch most PLC, RTU and relay firmware.
- Risk prioritisation
- Ranking vulnerability findings by combined score (CVSS + criticality + network exposure + exploitability) so teams address the highest real-world impact items first.
- Vantage IQ
- The AI analytics add-on for Nozomi Vantage that correlates vulnerabilities across many sites, surfaces shared CVE clusters, and accelerates triage in large multi-site OT estates.
📚 Sources
- Nozomi Networks — Guardian sensor: passive OT network monitoring & vulnerability assessment. nozominetworks.com/products/guardian
- Nozomi Networks — Vantage: cloud-native SaaS OT/IoT security management. nozominetworks.com/products/vantage
- Nozomi Networks — Asset Intelligence subscription: curated asset profiles & CVE mappings. nozominetworks.com/products/asset-intelligence
- Nozomi Networks Labs — OT/IoT Security Report: vulnerability trends in industrial control systems. nozominetworks.com/labs
- CISA ICS-CERT — ICS vulnerability advisories and CVSS scoring for OT devices. cisa.gov/ics
- NIST National Vulnerability Database — CVE reference and CVSS scoring methodology. nvd.nist.gov
What's next?
Mastered vulnerability management? Next, explore how Nozomi threat intelligence and asset intelligence subscription feeds enrich detection — YARA rules, IOCs, and curated asset profiles that sharpen CVE matching and cut false positives.