OT Vulnerability Management: Which Risks Actually Matter?
Summary: Dragos analysis across 2025 found that just 3 percent of vulnerabilities required immediate action, 71 percent were better handled through planned mitigation, and 27 percent offered limited practical risk reduction even if remediated. The same data showed 15 percent of CVEs carried incorrect CVSS scores and 25 percent of advisories included no patch or mitigation guidance, while only about 4 percent of vulnerabilities were observed to be actively exploited in the wild.
Key Takeaway: Adversaries reuse a limited, repeatable set of vulnerabilities, so the 4 percent actively exploited in the wild carries a disproportionate share of real-world risk while most high-severity findings will never be relevant to a given environment. With 22 percent of advisories applying to enterprise-boundary systems adversaries use for initial access, prioritization hinges on reachability and what a compromised system lets an attacker do next, not on severity scores.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026