OT Asset Inventory: You Cannot Protect What You Cannot See

01Key takeaways

1. 01

   An accurate asset inventory is the foundation that every other OT security control depends on.

2. 02

   OT inventory is hard because fragile devices can be disrupted by the active scanning IT relies on.

3. 03

   Passive discovery, observing traffic rather than probing, is the safer way to find OT assets.

4. 04

   A useful inventory captures more than a list: function, connectivity, criticality and dependencies.

5. 05

   Inventory is not an end in itself; its value is in driving segmentation and exposure reduction.

02Why inventory is the foundation

You cannot protect, segment, patch or monitor what you do not know exists. Every meaningful security decision in OT depends on knowing the assets involved, which is why frameworks consistently place asset management at the very start of the process.

An incomplete inventory undermines everything built on it. Unknown assets are unsegmented, unmonitored and unpatched by definition, and they are often exactly where incidents begin. The inventory is not paperwork; it is the map without which the rest of the program is guesswork.

Every other control silently assumes the inventory is complete. Where it is not, those controls have blind spots.

03Why OT asset inventory is hard

In IT, building an inventory often means actively scanning the network. In OT, that approach can be dangerous. Fragile devices may respond badly to unexpected probes, and active scanning has been known to disrupt or crash industrial equipment.

• Legacy devices can be destabilized by scans they were never designed to handle.
• Real-time systems cannot tolerate the disruption active probing may cause.
• Many devices do not report themselves in ways IT tools expect.
• Environments are diverse, with equipment from many vendors and eras.
• Undocumented changes accumulate over years, so records drift from reality.

04Passive discovery

The safer approach to OT asset discovery is passive: observe the traffic already flowing on the network and infer what devices exist from what they say, rather than actively probing them.

Passive monitoring listens to industrial communications and builds a picture of assets, protocols and connections without injecting traffic that could disrupt operations. It is not instantaneous or perfect, quiet devices reveal little, but it is the OT-appropriate way to gain visibility without putting the process at risk.

05What to capture

A useful inventory is more than a list of addresses. To drive security decisions, it needs to capture what each asset is, what it does and how it fits into the environment.

• Identity and type: what the device is, its vendor and role.
• Function and criticality: what it does and how much its compromise would matter.
• Connectivity: what it communicates with, and over which protocols.
• Exposure: whether and how it is reachable from less-trusted networks.
• Dependencies: what relies on it, so changes do not break operations.

06Using inventory to drive exposure reduction

An inventory delivers value only when it informs action. Its most powerful use is to reveal where exposure is unnecessary: assets that are reachable but need not be, connections that exist out of habit, and paths that should not be there.

Once the inventory shows what each asset needs and how it is reachable, exposure can be reduced deliberately. For assets that do not need continuous connectivity, an AIRGAPNET controlled connectivity pattern can keep them disconnected by default and reachable only when required, turning the visibility the inventory provides into a concrete reduction in attack surface.

07Keeping the inventory current

An inventory is only as useful as it is accurate, and OT environments change: devices are added, replaced and reconfigured over long lifecycles. A one-time inventory decays quickly into a misleading snapshot.

• Use continuous passive monitoring so new and changed assets are noticed.
• Integrate inventory with change processes so additions are recorded.
• Review and reconcile the inventory regularly against reality.
• Flag unexpected new assets as both an inventory update and a possible security event.

08Closing thought

Asset inventory is the least glamorous and most foundational part of OT security. It does not stop an attack by itself, but nothing else works well without it, because every other control is shaped by what you believe is on the network.

Build the inventory safely with passive discovery, capture enough to make decisions, keep it current, and above all use it to reduce exposure. Seeing what you have is the first step; the value comes from acting on what you see.

FAQFrequently asked questions

SRCSources of record