Coverage note
OT penetration testing: safety first, then evidence
OT penetration testing examines the networks that run physical processes. So safety comes before evidence, and much of the work is careful observation rather than active testing of live controllers.
- Manual exploit chains
- PTES and the OWASP testing guide
- Authorised scope only
How OT penetration testing differs from IT testing
In an office network, a crashed server is an inconvenience. However, in a plant, an unexpected reaction can stop a process or harm people. Therefore the rules of engagement for OT work are stricter, and they follow NIST SP 800-82, the guide to operational technology security.
| IT testing | OT testing | |
|---|---|---|
| Priority | Confidentiality first. | Safety and availability first. |
| Live systems | Often tested directly. | Usually observed, rarely touched. |
| Timing | Agreed windows. | Planned outages or test benches. |
What OT penetration testing usually covers
Most scopes focus on the boundary between business and industrial networks. So the question is whether someone in the office network could reach the control zone.
- Segmentation between IT and OT zones
- Remote access used by engineers and vendors
- Engineering workstations and their trust
- Passive review of industrial traffic
Readiness for OT penetration testing
Tick what is in place. Gaps are settled before any active work.
Your result appears here as you tick, so you can see what is still open.
Keeping OT penetration testing safe
Active work on controllers happens only on a test bench or during an agreed outage. In addition, the site's operations lead holds the stop procedure throughout. Then every change made during testing is reversed and logged.
What the OT report shows
You receive the routes between zones, with evidence and business risk. Also, fixes are ranked by safety impact first. So the plant team can schedule them around production rather than in a rush.
Fees for OT penetration testing
Full engagements run from $35,000 to $120,000, while the floor is $25,000. Also, the bounded Attack Surface Diagnostic starts at $4,500. Moreover, its fee is credited in full against a full engagement commissioned within ninety days. OT work is scoped site by site, because each plant's safety rules shape the plan.
OT penetration testing questions
Is OT penetration testing safe?
It is when safety rules come first. Active work on controllers needs a test bench or an agreed outage.
Does OT penetration testing touch live controllers?
Rarely, and only inside an agreed outage with the operations lead present.
Which standard guides OT penetration testing?
NIST SP 800-82 is the usual reference, alongside the site's own safety rules.
Who must sign the authorisation?
The site owner, with operations leadership aware of every testing window.
Related guides
Start with the safety rules
Describe the site, the zones and the access engineers use. The penetration hacker who would lead the work replies with draft safety rules, a written scope and one fixed fee.
Send the brief