Reviewing security across OT and IoT
An operator whose operational technology had been assessed with methods designed for corporate IT, producing findings its engineers could not act on.
The challenge
Operational environments do not tolerate the assumptions that IT assessments make. Systems cannot always be patched on an IT cadence, active scanning can be genuinely unsafe, and availability is frequently the dominant concern rather than confidentiality.
Applying an IT playbook produced a report full of findings the engineering team could not implement without unacceptable operational risk — so nothing changed.
Our approach
- Understand the process firstStart from what the plant or service actually does and what must never stop, so recommendations respect operational reality.
- Assess without disruptingUse passive and non-intrusive techniques where active testing would introduce unacceptable risk to a live environment.
- Prioritise by consequenceRank findings by their operational and safety consequence rather than by a generic severity score derived from IT assumptions.
- Recommend what can be doneWhere patching is not viable, focus on segmentation, monitoring and compensating controls that are actually deliverable.
What changed
The findings were framed in terms the engineering team could act on, so remediation actually happened instead of stalling on impossible recommendations.
Security and operations ended up working from a shared view of risk rather than competing priorities.
This is an anonymised, representative engagement. We do not publish client names, or figures we cannot substantiate, without explicit permission — in government and critical infrastructure, naming a client can itself be a security concern.
Other case studies
- Getting ready for GovAssure — A department facing its first GovAssure cycle, unsure which systems were in scope and whether its evidence would survive independent review.
- Clearing a supplier assurance backlog — An organisation with far more suppliers than it could assess, treating every one of them to the same depth and therefore assuring none of them well.
- Adopting Secure by Design in live delivery — A delivery programme told that Secure by Design was mandatory, with the self-assessment treated as a document to complete near go-live.