Why OT Asset Discovery Needs More Than Software

Discover why passive monitoring, controlled active scanning and physical inspection can all play a role in building an accurate OT asset inventory. 

Specialist software platforms can provide valuable information about the devices and communications operating across an industrial network. 

But software discovery should not automatically be assumed to provide a complete picture. 

Why discovery tools can miss assets 

Industrial networks rarely remain exactly as originally designed. 

Machines are added. Production lines change. PLCs and HMIs are replaced. Remote access systems are introduced and new network infrastructure is installed. 

Documentation does not always change at the same pace. 

Over time, the actual industrial environment can become very different from the drawings, asset registers and architecture diagrams held by the business. 

What is OT asset discovery? 

The information a discovery platform can identify depends on factors including network architecture, where monitoring takes place and whether equipment is communicating during the discovery period. 

An asset might physically exist within the production environment without being visible to the software. 

For example, equipment may be: 

• powered down during the discovery period  

• located behind a router or firewall  

• communicating intermittently  

• connected through an unmanaged switch  

• operating on a legacy serial or proprietary network  

• isolated from the point where network traffic is monitored  

That is why OT asset discovery often benefits from a combination of techniques. 

Passive network discovery  

Passive discovery observes existing network communications without unnecessarily introducing additional traffic. 

This can be particularly valuable in operational environments containing legacy or sensitive equipment. 

Controlled active scanning 

Where additional information is needed, controlled active scanning may also be considered. 

Active techniques communicate directly with devices and can identify information that passive monitoring may not reveal. 

However, industrial environments are different from conventional IT networks. 

Before active techniques are used, the potential impact on equipment should be understood and the activity agreed with the relevant engineering, operations and cybersecurity stakeholders. 

Physical inspection 

Physical inspection provides another important layer of information. 

Control panels, network cabinets, PLC systems, switches, engineering workstations and communications infrastructure can be compared against network discovery data, drawings and existing asset registers. 

This can identify equipment that software alone may miss. 

An engineering-led approach 

At FAIRFIELDS, our approach can combine passive discovery, controlled active techniques where appropriate, and physical inspection. 

The objective is not simply to generate a software-produced asset list. 

It is to establish a more complete engineering picture of the OT environment. 

If your existing asset records do not reflect what is really installed, FAIRFIELDS can help establish an accurate baseline for future engineering and cybersecurity work.