OT Asset Discovery

The inventory is the control that every other control depends on

Most plants have an asset list. Few have one that matches the network. The list says a line has four controllers; the traffic shows six. A vendor gateway installed during commissioning is still online and nobody owns it. An operator workstation has a second network card because the integrator needed it that way for a week, years ago. None of this shows up until someone looks.

Operational technology, or OT, covers the systems that monitor or control physical equipment: the programmable logic controller running a production step, the operator workstation that runs an entire line, the historian feeding the business reports, and the gateway a vendor uses for remote support. An IP address tells you a device exists. It does not tell you what the device does, who can reach it, what it depends on, or what you would need to bring it back after a failure. GDF's OT asset discovery work answers those questions, so operations, engineering, security and leadership are all working from the same record.

Where the records and the network disagree

We put four sources side by side: observed traffic, engineering drawings and device records, whatever inventory already exists, and the people who maintain the plant. Each one is wrong in a different way. Drawings show the design intent. Traffic shows what was talking during the capture window. The existing inventory shows what someone remembered to enter. The maintenance lead knows about the laptop that lives in a cabinet and only comes out during the monthly service visit.

The disagreements are the findings. Equipment added during a turnaround and never drawn in. A temporary cross-connect that became permanent. A controller on firmware the vendor stopped supporting. A cellular modem someone installed because the approved remote access path was too slow. Each goes into the inventory with a note on how we found it and what still needs confirming.

Passive discovery first, active probes only with your approval

Passive discovery means listening to traffic the network is already carrying, from a tap or a span port, rather than sending anything to the controllers. For most industrial environments it is the right place to start. It also has limits, and we write them down: coverage depends on where the collection points sit and which parts of the process were running while we listened. A batch line that sat idle all week will look empty.

Where passive data leaves a gap, we talk it through with your operator. Approved active probes, purpose-built hardware and tools GDF developed in-house can fill some of those gaps. Nothing active runs against a controller until the method has been reviewed with the person responsible for that process and a stop condition has been agreed.

Confirmed details stay separate from inferred ones

When two records conflict, we do not pick the more convenient one. The discrepancy stays visible in the inventory until someone with authority resolves it. A device we saw on the wire and matched to a drawing is confirmed. A device we saw on the wire and could only identify by its vendor MAC prefix is inferred. A device the drawings show but the network never did is unresolved. Your team needs to know which is which before it checks a vendor advisory against the fleet or plans a firmware upgrade. Mislabeled equipment is how a routine change turns into an outage.

What the record looks like when we hand it over

For critical assets, each entry ties the device identity to its process function, network zone, authorized peers, support status, recovery procedure and owner. Where the backup is missing, the configuration was never exported, or nobody has the vendor contact, the entry says so. Those blanks are often the most useful part of the deliverable. They tell the plant manager exactly what a recovery would stall on.

Take the maintenance laptop again. A two-week capture may never see it. Engineering records and a conversation with the technician who carries it will tell you what it connects to and what access it needs. The inventory records both, with the source noted, which is more than any single discovery tool would produce.

Your handoff typically includes the reconciled inventory, a visibility map showing where we could and could not see, and a prioritized list of unresolved assets and connections. We can also help you define how future changes get recorded, so the OT asset discovery work is still accurate when the next project starts instead of decaying the day we leave.

Plan your OT inventory with GDF

Talk with GDF before the next outage, upgrade or audit forces the question. Tell us what you operate, where visibility is weakest and what you need to decide. We can scope an OT asset discovery engagement and explain the safest collection approach for your environment. You get an industrial inventory your team will actually use. Your initial consultation is free.

Plan your OT inventory with GDF

Related services and resources: OT network assessment, OT vulnerability management.