OT Pen Testers: what's your actual criteria for moving from passive recon to active testing on a live asset?
This is a scoping decision we hit on basically every OT engagement, and I don't think there's a clean industry-standard answer, so genuinely curious how others draw the line.
The core tension: unlike IT, even routine scanning carries real risk on OT gear.
- Many PLCs run on embedded CPUs with very limited headroom - a scan that's unremarkable on a Windows server can overload one.
- Most industrial protocols (Modbus, DNP3, etc.) have no built-in authentication, so once you're on the network there's often nothing stopping you writing directly to a controller.
- A lot of the hardware is end-of-life and permanently unpatched, so patch level isn't a reliable signal either.
Given that, we always start with passive reconnaissance only, mapping the environment without generating any traffic that could disturb operation, before any active testing happens. Even then, we try to stick to non-production systems or agreed maintenance windows wherever possible.
What I'm actually asking: what's your practical criteria for deciding it's safe to move from passive to active on a specific live asset? Ops team sign-off, documented maintenance windows, device-specific research beforehand or something else? And has anyone had a client push back and insist on IT-speed active scanning against OT assets - how did that conversation go?