Analysis of Publicly Accessible Operational Technology and Associated Risks

TL;DR

This paper provides a comprehensive overview of the global exposure of operational technology systems to the internet, highlighting vulnerabilities, protocols, and potential security risks in critical infrastructure.

Contribution

It offers an updated analysis of the OT threat landscape, including geographic distribution, exposed protocols, and innovative use of screenshot analysis to identify vulnerable interfaces.

Findings

Nearly 70,000 exposed OT devices worldwide

Many devices use outdated firmware with critical vulnerabilities

Automated screenshot analysis reveals exposed HMIs and SCADA interfaces

Abstract

Operational Technology (OT) is an integral component of critical national infrastructure, enabling automation and control in industries such as energy, manufacturing, and transportation. However, OT networks, systems, and devices have been designed and deployed prioritising functionality rather than security. This leads to inherent vulnerabilities in many deployed systems when operational misconfigurations expose them to the internet. This report provides an up-to-date overview of the OT threat landscape exposed to the public internet and studies the affected protocols, vendors, software, and the geographic distribution of systems. Our findings reveal nearly 70,000 exposed OT devices globally, with significant concentrations in North America and Europe. Analysis of prevalent protocols (e.g., ModbusTCP, EtherNet/IP, S7) shows that many devices expose detailed identifying information, including outdated firmware versions with known critical vulnerabilities that remain unpatched for years after disclosure. Furthermore, we demonstrate how automated analysis of screenshots can uncover exposed graphical interfaces of Human Machine Interfaces (HMIs) and Supervisory Control and Data Acquisition (SCADA) systems, highlighting diverse pathways for potential unauthorized access and underscoring the risks to industrial processes and critical infrastructure.