OT inventory built from operational purpose
OT Asset Discovery (Passive-First)
Vendor, model, firmware, protocol, address, zone, owner, process role, and recovery dependency belong in the same record. Passive observations become useful inventory only after operators reconcile purpose and ownership.
The engagement
Discovery as a maintained operating record
Passive-first asset discovery reduces the risk of disrupting fragile controllers and legacy protocols. GDF combines packet observation, switch and firewall records, engineering files, maintenance systems, drawings, purchase records, and operator knowledge. The result is reconciled against what the organization already believes it owns.
Active follow-up is used only when operator-designated authority approves the method, process conditions, stop points, and recovery plan. Sensor placement determines visibility. An appliance on one trunk may miss isolated cells, serial gateways, maintenance laptops, cellular modems, and dormant assets.
Analysts document collection points, observation periods, inaccessible segments, encrypted traffic, and the operational states represented during capture. Discovery is a baseline, not a one-time count.
Scope
Passive network observation
Traffic capture at documented collection points across the industrial network. Observation periods, operational states, and inaccessible segments are recorded.
Device reconciliation
PLC, HMI, historian, engineering workstation, gateway, network device, and safety system reconciliation against controller projects, HMI configurations, network drawings, asset registers, and personnel knowledge.
Remote access and cross-zone paths
Unmanaged remote access, vendor gateways, cellular modems, jump hosts, and engineering laptops identified. Cross-zone communication is flagged for review.
Criticality and recovery enrichment
Process function, safety relevance, zone, normal peers, remote-access path, backup location, vendor support, and recovery owner recorded per critical asset.
Governance handoff
Export to the client's CMDB or governance workflow. Change review, exception handling, passive monitoring, and periodic reconciliation are defined.
Methodology
How passive-first discovery runs
-
Prepare
Sensor placement, observation windows, and safe collection method are agreed with the operator. Existing inventories and drawings are gathered as reconciliation input.
-
Observe
Passive traffic is collected at agreed points across representative operational states. Documented gaps in visibility are captured as they are encountered.
-
Reconcile
Observed assets are matched to engineering files, asset registers, and operator knowledge. Conflicts are retained for resolution rather than silently resolved.
-
Enrich
Critical assets are enriched with process role, safety relevance, backup, recovery owner, and vendor support. Output is exported to the client's governance system.
Evidence commonly examined
Evidence reviewed
- Passive packet captures at documented collection points
- Switch, firewall, and router configuration and MAC/IP tables
- Engineering project files and HMI configurations
- Asset registers, purchase records, and maintenance system exports
- Operator interviews and site walkthrough notes
- Vendor support records and remote access agreements
What you can expect
What you receive
- Reconciled asset inventory with reason for each entry
- Coverage map showing where visibility is limited
- Cross-zone communication and unmanaged remote access findings
- Recovery, backup, and vendor support enrichment per critical asset
- Maintained-record plan for change review and reconciliation
Frequently asked
Common questions
Will passive discovery disrupt operations?
Passive observation does not inject traffic. Sensor placement is agreed with the operator. Any active follow-up requires operator-designated authority, an approved process condition, and recovery steps.
Does passive discovery see every asset?
No. Isolated cells, serial gateways, dormant assets, encrypted traffic, and out-of-band paths may be invisible without additional collection points or active checks. Visibility gaps are documented rather than assumed away.
How is the output used by the operator?
The reconciled inventory is exported to the client's CMDB or governance system. Change review, exception handling, and periodic reconciliation are defined so new assets and vendor connections do not become permanent blind spots.
Related capabilities
Related services
Talk with an examiner
Discuss the matter and the next step.
Call to discuss timing, scope and the safest way to share information. Do not send evidence or credentials by email.
24/7 hotline: 1-800-868-8189