Asset visibility, the ability to know what assets are on your network and with whom they are communicating, is an essential building block of any operational technology security program. To detect, mitigate or contain a threat there are some prerequisites for security and incident response teams: understanding which devices exist on the industrial networks, how those devices communicate, what normal looks like across the environment. Getting that visibility in OT environments, however, is never as easy as it seems; OT systems frequently include legacy kit never intended to be monitored on a network, proprietary industrial protocols which standard IT tools simply cannot interpret and networks so crucial to the operation of the business they allow zero downtime.
Organizations looking to address this challenge will find a range of purpose-built platforms covering the OT security tools for asset visibility category, each approaching discovery and monitoring in ways shaped by their origins and target environments.
The gap between what organizations know about their OT environments and what is actually running on them remains significant. Survey data on the OT visibility gap found that nearly two-thirds of OT security decision-makers lack full visibility into their connected assets and systems. The six companies below are among the most widely deployed in this space.
Fortinet
Instead of viewing asset visibility as a standalone discovery capability, Fortinet considers it an integral part of a broader, integrated security architecture. The platform integrates automated asset identification, network segmentation, and non-stop monitoring to provide industrial operators with both visibility and enforcement tools to proactively respond to what they discover
Fortinet’s support for over 100 OT-specific protocols (two to four times more than many other platforms) allows the vendor to derive useful context about a wide variety of industrial devices, not just detect them. This breadth is especially important in heterogeneous systems, where generations of equipment co-exist and visibility limited to the newest assets leaves lots of parts of the inventory unmonitored.
The depth of protocol-level detail that visibility tools can provide also informs vulnerability management, since understanding what a device is doing on the network determines which risks are real and which can be safely deprioritized. The OT asset inventory guidance published jointly by CISA and international partners outlines this rationale: effective security decisions in OT environments begin with a systematically maintained, categorized asset inventory.
Dragos
Dragos designed its visibility capabilities to focus primarily on the problem of discovering and maintaining passive surveillance of assets, from modern connected systems to legacy equipment that may have been running in isolation for decades across multiple industrial environments. Since the platform only passively observes network traffic and does not interact directly with devices, it is safe to deploy in environments where even minor disruptions of communications could have physical repercussions.
In the asset visibility category, what makes Dragos a standout is the level of context it associates with discovered assets. The platform not only records that a device is present, but also determines the device type, firmware details, communication behaviors, and protocol usage and correlates this to OT vulnerability intelligence. In other words, the inventory is more than a list of IP addresses: it is a live image of the real industrial environment and its correlated threat landscape.
Claroty
Claroty (USA) Claroty has a stepwise approach, addressing an extended view of asset visibility that reaches out from the typical ICS environment to connected medical devices and EMS/ building management systems through the full variety of cyber-physical systems emerging in critical infrastructure environments. This delineation puts Clarity in position for organizations that have moved beyond a narrow definition of OT security (factory floor only) to one capable of covering any connected system that impacts physical operations.
The platform combines passive monitoring and active query techniques to create or update the inventory of the assets within the environment. Notably, passive monitoring records the traffic that devices naturally produce, whereas active targeted queries can extract further detail from devices that either communicate infrequently and/or cannot be fully characterized by passive means. By integrating both approaches, you come up with a fuller inventory than what either technique would deliver on its own.
Nozomi Networks
Nozomi Networks has built a reputation for providing continuous monitoring of industrial network traffic to deliver security and operational insights. Traffic is analyzed at the protocol level so that not only are individual devices identified but also how they behave moment to moment, leading to anomalies large and small being detected which signal a cyber threat or an operational issue worth investigating.
First is the added visibility below the network layer, with endpoint-level monitoring capabilities representing a well-known shortcoming in OT environments, where traffic at lower levels of industrial architecture are typically invisible to network-based monitoring alone. Touches on programmable logic controllers and their field level communications that historically needed physical access to see, and are increasingly being central targets for well-resourced adversaries.
Armis
Armis has a completely agentless and passive view of asset visibility which means it does not need to change anything on the devices it monitors nor does it require any network or industrial system changes. Just turn it on and see what it discovers to take action from there. This design philosophy means Armis is especially well suited to environments with high numbers of legacy devices, where deploying agents or making configuration changes is impractical or outright against operational requirements.
It detects and profiles devices in parallel across IT, OT, and IoT environments to create an aggregate inventory that represents the enterprise holistically as opposed to isolated industrial devices that exist in separate silos requiring different tooling. This becomes especially important as IT and OT networks increasingly converge, with security teams now expected to provide risk oversight for the overall converged environment instead of trying to secure stand-alone IT or OT assets.
Tenable
Tenable provides an extensible process for vulnerability management to provide OT asset visibility as well, through a platform built for converged IT and industrial environments. The asset discovery feature for OT works in a limited (passive) fashion, instead of using active scanning methods that may affect sensitive industrial equipment, and identifies device characteristics like firmware versions, model data, or communication protocols to dive in risk posture.
What Tenable provides that some purpose-built OT visibility tools lack is a consolidated view of exposure that binds together OT findings to the same risk scoring and prioritization framework used for IT assets. This integration is great for organizations already using Tenable for IT vulnerability management because it removes the burden of reconciling separate reporting systems, and enables security teams to prioritize remediation across both domains with shared criteria.
Frequently Asked Questions
Why is passive monitoring in OT environments so important for?
Active scanning techniques commonly used in IT security can lead to unintentional interruptions of industrial devices and processes, thus a passive monitoring approach is chosen when constructing asset inventories without engaging operational risk.
Do any of these platforms cover the legacy OT equipment that is not connected to such networks?
The majority of passive network monitoring tools need a device to produce some kind of traffic over the network in order to be found. Legacy air-gapped systems may need additional means like configuration file analysis, or a manual inventory to be fully covered.
Updating an OT Asset Inventory How often should we update our OT asset inventory?
Continuously, where possible. Industrial environments are dynamic thanks to the addition, replacement or reconfiguration of devices and an inventory that lacks near real-time updates will quickly develop gaps that make both security monitoring and vulnerability management impossible.
