Risk-Based OT Vulnerability Management for Industrial Microsegmentation

An engineering workstation, a Siemens S7 controller, and a serial-to-Ethernet gateway can all sit on the same flat process subnet, and most inventories describe all three the same way: an IP address and a MAC prefix. That does not answer the question an OT security team actually has, which is whether a specific controller carries a vulnerability an adversary can reach. Active scanning is not a safe way to find out. Unexpected probe traffic sent to a controller running a decades-old stack can drop it, and in a plant that means lost batches, a safety hold, and a very short conversation with operations. So teams end up holding two incomplete pictures: an inventory that cannot say what a device is, and a vulnerability feed with no idea which of those devices exist on the plant floor. Neither one supports a segmentation policy anyone will sign off on. See how network asset discovery closes that gap.

Dragos establishes what each industrial asset is, and Elisity uses that to decide what it is allowed to reach. The Dragos Platform discovers assets passively through native ICS protocol analysis across Modbus TCP, DNP3, EtherNet/IP, PROFINET, OPC UA, and S7comm, profiling device type, vendor, model, and firmware without sending a probe packet. Dragos then correlates each profile with the CVEs that apply to it and assigns a severity and a risk level. That complete record, asset identity plus vulnerability context, flows into Elisity IdentityGraph™ over an API connection you configure in the Elisity Cloud Control Center. IdentityGraph aggregates it with the other identity sources you already run, and Elisity classifies each asset into a Policy Group automatically. The outcome is a segmentation policy written against what a device is and what it is exposed to, rather than against the VLAN it happened to be assigned years ago.

Patching is the recommended fix and it is frequently the one thing you cannot do. A large share of ICS advisories arrive with no vendor patch available. Others carry a patch only the equipment vendor is permitted to apply, or one that voids a safety certification, or one that needs a validated change window you get twice a year. Meanwhile the vulnerability is still there, and so is the controller, and so is the flat network that lets a compromised jump host talk to it. Traditional segmentation projects promise a way out, but re-IPing a plant or rebuilding a VLAN scheme is a multi-year program carrying production risk of its own. What industrial teams need is a mitigation they can apply this quarter, at the network layer, without touching the asset, taking it offline, or waiting on a vendor for permission.

Elisity turns the Dragos Now, Next, Never framework into enforcement. Dragos rates each vulnerability against operational reality instead of CVSS score alone: Now for issues that demand immediate action because they are both exploitable and reachable in your environment, Next for issues to handle on the normal maintenance cycle, and Never for issues with no realistic operational impact that should not consume a change window. Those risk levels arrive in Elisity IdentityGraph alongside the asset profile. When an asset moves into the Now category, Elisity tightens the Policy Group around it, narrowing permitted flows to the specific peers and protocols the process actually requires and denying the rest. Nothing is installed on the asset and nothing is rebooted. Segmentation becomes the compensating control that holds the line while a patch waits for a maintenance window, or indefinitely, if the vendor never ships one.

A CVSS 9.8 on a historian in the industrial DMZ and a CVSS 9.8 on a safety-instrumented controller are not the same problem, yet a spreadsheet sorted by score treats them identically. CVSS describes a vulnerability in the abstract. It does not know that one asset sits three hops from a corporate jump host while the other sits behind a conduit no external traffic reaches, and it has no view of which flows the process genuinely requires. So teams open the report, see several thousand findings, and stall, because there is no defensible way to choose the first twenty. The deeper problem is that the risk that matters most in industrial environments is rarely the individual CVE. It is lateral movement: an adversary landing in IT, pivoting through a shared service, and arriving in the process network with valid credentials and native protocols.

Elisity Cloud Control Center gives security, operations, and engineering one place to track an OT vulnerability from discovery through containment. Dragos network mapping exposes the paths an attacker could take between zones, and Elisity closes the ones the process does not need. Enforcement happens through the network infrastructure you already own, at the access layer, with no agents on the asset, no re-IPing, and no new hardware on the plant floor. Policy Groups update automatically as Dragos reclassifies an asset or revises its risk level, so a controller that becomes exposed is contained without waiting on a manual ticket. Every allow and deny is recorded against the asset identity, which is exactly the evidence an IEC 62443 zone and conduit assessment asks you to produce. Explore lateral movement prevention for industrial networks.