ICS Penetration Testing, Attack Path Validation, and Bench Proof

Prove Whether an Attacker Can Reach Your Controllers

A typical route into a plant runs through a phished office account, a vendor login nobody retired or an engineering laptop that sits on two networks at once. A Global Digital Forensics industrial penetration test follows those footholds through jump hosts, firewalls and remote access tools to show whether anyone could reach the systems that change your process. Every step runs under written operating limits, and anything a controller cannot tolerate is proven on a bench or a replica instead of the plant floor.

Scope Your Assessment Call (800) 868-8189

Water treatment and electrical utility infrastructure.

From a Phished Office Account to the Control Network

Controllers are rarely the front door. The realistic path runs through an enterprise identity, a retained integrator account or a historian that trusts the business network, and the finding your engineers can act on is the single point where one control would have broken the chain. We follow each credential, permission and network dependency from the agreed starting position to the industrial boundary and record the condition that let every step succeed.

Industrial equipment runs a physical process, so each test carries a business objective and a written stopping point before it starts. Demonstrating authorized access to an engineering workstation is usually a material finding on its own. Whether anything is done from that workstation is a separate decision made with your operators, and the answer is often reached on a test bench.

Scope Your Assessment

Engagement types

Choose Where the Attacker Starts

Each starting position tests a different exposure, so we agree them with your engineers and spend the testing effort on the scenarios that matter rather than spreading it evenly across everything you own. From each position we follow permissions, services and trust relationships, keep evidence for every validated step and mark clearly any step that was plausible but outside the authorized test.

External Connection
Internet facing remote access, exposed services and cellular gateways tested the way an outsider would find them.
Compromised Employee
A standard enterprise account used to measure how far an ordinary credential travels toward supervisory systems.
Vendor Route
Integrator and support access examined across its lifecycle, from approval and multifactor enforcement to the session that never closed.

Rules of Engagement Written Before the First Packet

Written rules of engagement name the targets, the excluded actions, the operating windows, the communication channels, the stop conditions and the person who can halt the work. Sensitive controller actions are examined through configuration records, spare equipment or an isolated bench, so the agreed operating boundary holds while we prove the point.

When a finding comes from a laboratory or a representative system, we compare firmware, project files and network settings against production and record every difference. Your engineers can then see exactly which conditions would have to match for the path to apply to the live plant.

Settle the operating limits with your operators before the scoping call using the worksheets in the OT assessment planning library, and the rules of engagement come together faster.

Methodology

From First Foothold to the Control That Breaks It

01 / Entry: the agreed starting positions

An internet facing gateway, a standard office account or a vendor login, each fixed with your engineers along with its objective and the point where the test stops.
02 / Route: credentials, trusts and conduits

From each position we trace the identities, jump hosts, firewall rules and shared services that lead toward the industrial boundary, working from records and approved captures first.
03 / Proof: bench, replica or approved window

Each step toward the controllers is demonstrated where the process can tolerate it. A step that would act on a controller moves to a test bench or a replica.
04 / Break: the control that cuts the path

Every proven route ends with the rule, identity change or vendor control that would have stopped it, and the retest walks the same route after the fix.

Where zones, controls and governance need a broader review first, an OT, ICS and SCADA security assessment sets the baseline that a penetration test then validates.

Bring your system list and your next deadline to a free first call. Start here.

Find the Controls That Break the Attack Path

The attack path diagram records the starting position, the condition that permitted each step and the control that would have stopped the progression. Engineers see the practical intervention points. Management sees why an identity or firewall change may close a more direct exposure than a capital equipment project, which is often the difference between a fix this quarter and a fix in the next budget cycle.

The report carries the tested path, the supporting evidence, the operating consequence, corrections with named owners and a retest plan that follows the original path to confirm the exposure is gone. Sensitive detail follows the handling and distribution rules agreed at the start.

Evidence we work from

Industrial Records Behind Every Step

An attack path stands or falls on records. Directory exports and group memberships show which office accounts reach a jump host. Firewall and VPN configurations show which conduits were open and to whom. Vendor approvals and session logs show whether a support login ended when the job did, and controller project backups let us compare the bench with the equipment in service.

What you receive

Call (800) 868-8189 or request a scoping call to plan the assessment around production.

Attack Path Findings and a Retest Plan

An asset and trust path map for the agreed scope, a record of each check your operators approved and the evidence it produced, findings ranked by operating consequence with the conditions needed to reach them, and a remediation, maintenance and retest plan your team can schedule.

Historian, firewall or remote access records incomplete? Say so on the first call, and we will show what the test can still prove.

Technical methods and scope

ICS Penetration Testing Begins With Operating Authority

The written scope names the process owner, the target assets, the operating window, the excluded actions, the safety constraints, the stop conditions, the communication channels and the recovery support. Testers and operators agree what evidence will be sufficient before any active step.

Architecture review, passive traffic, configurations, a digital twin, spare hardware and hardware in the loop testing are all considered before production validation is proposed. If a limited production step is approved, we choose the least disruptive action that confirms the specific control behavior in question.

IT and OT Boundaries and Remote Access

We map the authorized path across identity systems, jump hosts, vendor access, dual homed engineering workstations, firewalls and data exchange services, recording the credentials, reachability and configuration each step required.

Boundary testing covers firewall enforcement, DMZ pivot resistance, jump servers, the vendor access lifecycle, multifactor authentication, session records, file transfer and administrative role separation. The report states the coverage achieved route by route, so a reachable port is never mistaken for a working exploit.

Describe the plant and the constraints your operators set and the first call plans the work around them.

Industrial Protocols and Controller Access Tests

Modbus TCP, DNP3, EtherNet/IP, OPC UA, PROFINET, BACnet and IEC 61850 differ in security design and in how each vendor implemented them. We select checks for the actual device, firmware and configuration, including whether supported authentication, signing or encryption is turned on and configured correctly.

Checks may cover unauthorized reads, restricted writes on a test instance, replay, certificates, trust settings, roles, sessions and exposure across zones. Controller writes, state changes, flooding and denial of service need explicit approval and belong in an isolated environment.

Laboratory and Representative System Validation

Representative testing allows deeper examination at a safe distance from the live process. The report records differences in topology, logic, firmware, settings and hardware, then explains which conditions must match before a finding applies to production.

Hardware in the loop work can combine real controllers, HMIs or gateways with simulated process inputs, and digital twins support broader path and control validation, each paired with configuration comparison and operator review.

Send the sites, the control systems and the windows you can offer, and a senior assessor will propose the scope.

Evidence, Remediation and Retesting

Each finding identifies the authorized path, the preconditions, the evidence, the operating consequence, the safety considerations and the affected assets. Corrections may involve segmentation, identity, vendor access, protocol restrictions, hardening, monitoring, a vendor fix or equipment replacement, and the retest follows the original path to record whether the change removed, reduced or displaced the exposure.

For a line, a substation or a treatment train, we propose the positions, the limits and the bench work in writing during scoping.

Testers Whose Findings Are Built to Be Defended

An attack path claim is only as good as the record behind it, and our examiners have testified in federal and state courts, so the record separates what was demonstrated from what was inferred. Founder Joseph Caruso and Robert Knudsen both hold the CISSP, and their full credentials are on the GDF team page.

To scope this work for your environment, request a free consultation with a senior specialist.

Free scoping tools

Write the Rules of Engagement With Your Operators

The OT readiness pack is the workbook a test plan is built from: targets, owners, maintenance windows, excluded actions and the person who can say stop. The security review checklist adds the inventory and access records the starting positions depend on. Our article on scoping SCADA and OT testing around operational risk explains how we choose between bench, replica and production window.

OT Assessment Readiness Pack

Inventory, boundaries and rules of engagement captured in an editable workbook.

Format: ZIP with a CSV workbook and a printable checklist.

Download the OT Readiness Pack (ZIP)

Read the OT readiness checklist online
OT Security Review Preparation Guide

Process scope, system inventory, access records and operating constraints to gather first.

Format: PDF.

Download the OT Security Review Guide (PDF)

Read the OT security review guide online
Assessment Preparation Worksheet and Planning Library

A scope and permissions worksheet, plus sector packs and a project workbook for multi site programs.

Format: CSV worksheet; ZIP library with PDFs, XLSX and CSV.

Download the Preparation Worksheet (CSV)

Download the OT Planning Library (ZIP)

Read the OT and utility audit preparation guide

Every package, sorted by subject, is in the GDF preparation package library.

Frequently asked

Call (800) 868-8189 or request a scoping call to plan the assessment around production.

Before You Authorize an Industrial Penetration Test

Will you exploit live controllers?

Only with explicit written authorization for the actual process conditions, and only when a bench, a spare or a configuration review cannot establish the point. Many objectives can be answered on representative equipment, and we choose the least disruptive proof with your operators.

Can we limit testing to the IT and OT boundary?

Yes. A boundary engagement concentrates on the crossing points between enterprise and industrial networks, such as vendor routes, jump hosts and firewall enforcement, and keeps the industrial devices themselves out of the test.

What happens if the test is stopped?

The report records where we stopped, the evidence held at that point and which routes remain untested, so you know exactly what was proven and what is still open for a later window.

Which starting position should we test first?

Usually the one your board already worries about: a stolen office credential, an integrator login or an exposed remote access gateway. If the worry is vague, the first call ranks the positions against your remote access arrangements and picks the one with the shortest route to the control zones.

Do you need test accounts from us?

For an assumed breach or vendor route scenario, yes: a standard account or a vendor style login created for the test and disabled afterward. Credentials and diagrams move through a secure exchange we arrange.

How does the retest work?

After your team applies the corrections, we walk the original route from the same starting position and record where it now stops. The retest record shows each path as closed, narrowed or still open.

Talk with an examiner

Understand the Paths Into Your Control Environment

Tell us the plant systems, the proposed starting position and the maintenance window. We will review the operating authority, the expertise and the test scope your objective requires before anything is engaged.

Global Digital Forensics has practiced since 1992. The 24/7 hotline reaches an examiner.

Talk with an OT tester

Schedule the Test Around Your Next Maintenance Window

On the first call a senior tester ranks the attacker starting positions worth testing, separates the proofs that need a bench from those a production window can carry, and walks through timeline and pricing. The consultation is free.

Scope Your Assessment Call (800) 868-8189

24/7 hotline: (800) 868-8189

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.

Prove Whether an Attacker Can Reach Your Controllers

From a Phished Office Account to the Control Network

Choose Where the Attacker Starts

External Connection

Compromised Employee

Vendor Route

Rules of Engagement Written Before the First Packet

From First Foothold to the Control That Breaks It

01 / Entry: the agreed starting positions

02 / Route: credentials, trusts and conduits

03 / Proof: bench, replica or approved window

04 / Break: the control that cuts the path