Utility defenders should inspect, in this order: what OT assets exist, every remote access path, the software vendors supply into control environments, how updates arrive, and any AI tool that touches control data. Each step feeds the next, and none needs an exploit to find real gaps.
This is a planning order built from published guidance. It does not describe any incident, and it does not replace the reliability standards your utility is subject to. Check those with your compliance team.
1. What assets exist?
NIST SP 800-82 Revision 3, the guide to operational technology security, defines OT as programmable systems and devices that monitor or control physical processes and equipment, and says security measures must account for performance, reliability and safety. Start there. Build an inventory with engineers who run the plant or grid, since they know the equipment. For each asset record function, location, software or firmware version, owner and support status.
Use passive methods. Active scanning can disrupt fragile devices, so agree on rules with operations before any technical check.
2. Who can connect remotely?
List every remote path: vendor VPNs, remote desktop gateways, cellular modems, jump hosts and cloud-managed devices. For each, note who approves a session, whether it is logged, whether credentials are shared, and whether multifactor authentication applies. This list is often shorter in policy than in practice, so confirm with network evidence.
3. What software do vendors supply?
Vendors deliver engineering workstations, historians, human machine interfaces and device firmware. Ask each for a software bill of materials and a way to report vulnerabilities. CISA describes an SBOM as a nested inventory, a list of ingredients that make up software components, and treats it as a building block of supply chain risk management. The ISA/IEC 62443 series divides responsibility among asset owners, product suppliers, integrators and service providers, and its part 4-1 sets secure product development lifecycle requirements, so supplier questions can follow that structure.
4. How do updates arrive?
Trace the path from vendor fix to device. Who tests it, who approves outages, who installs it, how it is verified as authentic? Utilities often cannot patch on short notice, so know the compensating controls: isolation, filtering, monitoring. Record how long the last three updates took from release to deployment.
5. Where does AI touch control data?
Joint guidance published in December 2025 by CISA, Australian partners and others covers integrating AI into OT, including machine learning, large language model systems and AI agents. As summarized by the Canadian Cyber Centre, its principles are AI literacy, evaluating where AI fits in OT, governance and assurance, and safety and security by design. Ask where analytics, assistants or vendor cloud services receive control data, and whether any model output can reach a controller without human approval.
What do you do with the findings?
Rank by consequence and ease: a shared remote account to a control network ranks above a lagging patch on an isolated device. Fix the top items, document accepted risk for the rest, and revisit quarterly.
For the software your own teams write, such as integration code or internal tools, normal application security tooling applies, and Safeguard can produce SBOMs and findings for that code. It cannot inspect vendor firmware you do not hold.
What to do
- Build the OT asset inventory with operations staff.
- List and log every remote access path, and end shared credentials.
- Send suppliers a standard request for an SBOM and a disclosure contact.
- Document the update path and typical delay for each system family.
- Map where AI tools or vendor cloud services receive control data.
- Review findings with engineering and safety leaders and set owners.
Quick check
Should we run an active vulnerability scan on control systems?
Not without operations approval and a tested method. Prefer passive monitoring and documentation review first.
Which standards apply to us?
That depends on your jurisdiction and role. Confirm with your compliance team. NIST SP 800-82 and ISA/IEC 62443 are widely used references.
Sources
- NIST SP 800-82 Revision 3
- ISA/IEC 62443 series overview
- CISA: Software Bill of Materials
- Canadian Centre for Cyber Security: joint guidance on AI in OT
Last reviewed: 18 October 2026.
