The Value of Penetration Testing ICS/OT Environments
Summary: Dragos describes penetration testing as a late-stage maturity activity for ICS/OT environments, to be ordered only after an architecture review and site assessment have surfaced and remediated findings. Its standard pentest runs within a 40-hour work week, so Dragos uses an "assumed breach" approach and "defanged" exploits to limit risk to production ICS networks, where availability takes priority over test thoroughness.
Bottom line: A standard Dragos pentest is capped at 40 hours while real adversaries can dwell for extended periods, and the availability-first constraint means some tools and techniques are deliberately left out - so a clean test result reflects a narrower scope than an adversary's actual window.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026