Know what connects to your equipment.
Document the reviewed vendor connections, gateways, and accounts, including gaps that need further investigation.
00OT security service
OT Remote Access and Exposure Review
Who can reach—and change—the equipment your business depends on?
Pilot review: $2,500 · One site · Up to five remote-access paths
Discuss your OT access reviewThe fixed-price pilot is subject to confirming that your environment fits the agreed scope.
Equipment suppliers need access to diagnose faults and keep production moving. You need to know who has that access, what they can change, and how to revoke it when necessary.
Product Cybersecurity reviews vendor remote access and external exposure affecting your operational technology (OT). Get documented findings and a prioritized action plan that accounts for production schedules, equipment support, and recovery.
01Review outcomes
Know your access paths. Understand the consequences. Assign the next steps.
Understand what that access permits.
Connect security findings to the equipment and operations they could affect.
Give your team a workable plan.
Identify priorities, responsible owners, operational constraints, and the evidence needed to confirm improvements.
02Who it is for
OT security for smaller manufacturers and connected facilities
Operational technology monitors or controls physical processes. It includes programmable logic controllers (PLCs), operator screens known as HMIs, industrial gateways, and systems used to operate production equipment, refrigeration, or building services.
This review is designed for smaller manufacturers and facilities that rely on equipment vendors, controls integrators, or maintenance contractors for remote support.
Your team cannot confidently list every remote connection to operational equipment.
A supplier uses a shared account or maintains access between service visits.
A machine has a cellular modem or cloud connection that is absent from your network diagram.
You have added connected equipment, changed suppliers, or inherited an existing installation.
Your IT provider and equipment supplier each manage part of the connection, but ownership is unclear.
You need a practical starting point for an OT security program.
The review can involve your operations lead, internal IT team, equipment supplier, or integrator. You do not need a dedicated OT security department to begin.
03Review scope
What we review
Vendor remote access
We examine how approved suppliers connect, which accounts they use, and what their access allows. The review considers individual accountability, multifactor authentication at supported access gateways, session approval, access expiry, and revocation procedures.
Internet exposure and alternate connections
We review agreed external assets and available records for publicly reachable management interfaces and other access routes. Cellular modems and cloud-mediated support connections are included when identified and within scope.
Connections between IT and OT
We review supplied diagrams and configuration evidence to understand the documented boundaries between business networks, remote-support systems, and operational equipment. Findings identify access that needs clarification or further technical validation.
Logging, escalation, and recovery
We examine available evidence of remote-session logging, responsibility for reviewing unusual activity, escalation contacts, and configuration backup procedures. This identifies preparation gaps; it does not include a live recovery exercise.
A public exposure check provides one part of the picture. It does not establish a complete equipment inventory or prove that internal access controls work.
04Deliverables
What you receive
| Deliverable | What it helps you do |
|---|---|
| OT access register | Track reviewed connections, equipment, suppliers, accounts, permissions, and access owners. |
| Evidence-based findings | See what was observed, what was reported, and what remains unverified, with evidence dates. |
| Operational consequence review | Understand which production, monitoring, configuration, or recovery functions a finding could affect. |
| Prioritized action plan | Assign recommended actions to operations, IT, or suppliers, with constraints and verification steps. |
| Findings readout | Discuss the report and agree on practical next steps with the people responsible for the equipment. |
For example, a finding might identify a documented supplier connection with no named access owner or no evidence that remote sessions are logged. Those conditions would be recorded separately from any confirmed vulnerability or evidence of compromise.
05Pilot boundaries
A review planned around your operating environment
Operational equipment has maintenance windows, vendor requirements, and process dependencies. Our starting point is a review of records and configuration evidence, supported by interviews and agreed external observations.
The pilot excludes intrusive production scanning, exploitation, controller commands, live configuration changes, and equipment rebooting. Any additional testing or implementation requires a separately agreed scope and an operating procedure coordinated with your operations team and equipment vendor.
Fixed-price pilot: $2,500
One operational site, an agreed equipment list, and up to five remote-access paths. A path means a distinct route into the reviewed environment, such as a vendor VPN, remote-support service, or cellular gateway. A route serving many machines still requires an agreed equipment scope.
Included in the pilot
- Two stakeholder interviews.
- Review of agreed documents, configuration exports, and available logs.
- External observations of specifically authorized assets.
- A written report, OT access register, and action plan.
- One findings readout.
We confirm the evidence required, review schedule, and boundaries before work begins. Additional sites or access paths, on-site work, implementation, penetration testing, continuous monitoring, and incident response require separate scope and pricing.
06How it works
How the review works
- 01
Define the operating environment.
Identify the equipment, important processes, suppliers, and access routes to include.
- 02
Collect the available evidence.
Review records and speak with the people who operate and support the equipment. Share technical material through an agreed secure channel.
- 03
Evaluate the reviewed access paths.
Document observations, assess potential consequences, and distinguish confirmed findings from missing evidence.
- 04
Walk through the priorities.
Review the report together and identify who can carry out and verify each recommended action.
07Method
Grounded in established OT security practices
The review draws on the SANS Five ICS Cybersecurity Critical Controls: ICS-specific incident response, defensible architecture, network visibility and monitoring, secure remote access, and risk-based vulnerability management.
It provides a focused starting point and identifies where deeper work is needed across those controls. It is not a certification or a complete assessment of all five.
The need to understand alternate access routes is practical. In its July 2026 water-sector warning, CISA highlighted cellular modems installed by operators, vendors, or integrators that may be undocumented and absent from routine exposure scans.
08Questions
Frequently asked questions
Is this a full OT security assessment?
This is a focused assessment of agreed remote-access paths and related exposure. It establishes documented findings and next steps within that scope. A complete OT security program can also require deeper architecture assessment, monitoring, incident exercises, product testing, and recovery validation.
Can you review equipment that is not publicly exposed?
Yes. Customer-provided diagrams, configuration exports, access records, and interviews can support a review of connections that are not visible from the internet. The report states the evidence available and any limits on validation.
Do you need administrator passwords?
The initial review is designed around supplied evidence rather than shared administrator credentials. If further validation needs authenticated access, we agree on a controlled method and scope first.
Will the review interrupt production?
The pilot does not require controller changes or planned production downtime. We agree on the review methods with your operations team before starting. Any later work that could affect operations needs a separate procedure and approval.
Can you work with our IT provider and equipment supplier?
Yes. Their knowledge helps establish how a connection works, who owns it, and which changes the equipment supports. The findings and readout give everyone a common set of priorities.
Does an exposed interface mean equipment has been compromised?
Public reachability, a security weakness, and compromise are different findings. We report the evidence for each condition separately. Suspected compromise requires incident investigation beyond the pilot review.
Does the price include fixing the findings?
The pilot price covers the review and listed deliverables. Your team or supplier can use the action plan to implement improvements. Any implementation support or follow-up verification is scoped separately.
09Start a conversation
Start with the equipment your operations depend on
Tell us which site you want to review and how suppliers currently provide remote support. We will confirm whether the pilot fits and what information is needed to begin.
Looking for another service? View product cybersecurity capabilities.