Vulnerability Management (OT)
Vulnerability management in OT is the continuous process of identifying known weaknesses in operational assets, assessing the risk they pose in context and deciding how to treat them. In rail, patching is often impossible or slow because of safety certification, so the emphasis shifts to visibility, prioritisation and compensating controls.
How it works
The process begins with an accurate asset inventory: vendor, model, firmware and software versions for every device. In OT this is usually built passively from network traffic, because active vulnerability scanners can disrupt or crash controllers and are prohibited on certified signaling systems. The inventory is then matched against vulnerability databases such as the CVE list and vendor advisories to find applicable weaknesses.
Each finding is assessed in context: is the vulnerable service actually reachable, does the asset sit in a well-segmented zone, is the vulnerability known to be exploited, and how critical is the asset's function. Treatment options range from patching during a planned maintenance window, after supplier validation, to isolating the asset, restricting the vulnerable protocol at a conduit, or monitoring it closely until a fix is possible.
Why it matters for security
Rail assets live for twenty to forty years and accumulate vulnerabilities that can never all be patched. Regulators recognise this: NIS2, the TSA directives and IEC 63452 require a vulnerability management process and documented risk decisions, not a zero-vulnerability state. What they do expect is that operators know what they have, know what is exposed and can show how each risk is handled.
The supplier side is changing too: the EU Cyber Resilience Act and IEC 62443-4-1 oblige manufacturers to disclose and fix vulnerabilities throughout the support period, which gives operators more to work with. Continuous, passive asset and exposure visibility is what makes the operator's side of the process feasible at network scale.
Related solution
Vulnerability assessment in safety-critical rail environments
Assessing exposure without active scanning of certified systems.
See the solution →
