IT/OT boundary and segmentation
We test whether firewalls, DMZs and zones stop an attacker moving from corporate Active Directory into the plant network.
Advisory
OT, SCADA and ICS Penetration Testing
Passive-first testing of the IT/OT boundary, remote access and control system layers, planned around the safety of your plant and people.
OT and SCADA penetration testing for Australian critical infrastructure.
OT penetration testing shows how an attacker could reach and affect the systems that run your physical operations. We test SCADA, HMI and historian layers, engineering workstations, the boundary between corporate IT and operational technology, and the remote access paths vendors use. Our testing is passive-first, and active work on a control network needs written engineering approval, a tested maintenance window and a rollback plan. Vectra is a CREST-accredited penetration testing provider. Our testers are based in Australia, and the team includes people who hold the GICSP industrial control systems credential. We work with energy, water, telecommunications, transport and data-storage operators.
What an OT and ICS penetration test involves.
| Topic | OT and ICS penetration testing |
|---|---|
| Systems | SCADA, HMI and historian layers, engineering workstations, the IT/OT boundary and vendor remote access |
| Approach | Passive-first. Active testing only with written engineering approval, a tested maintenance window and a rollback plan |
| Frameworks | IEC 62443 zones and conduits, the AESCSF, the SOCI Act and the CIRMP Rules |
| Credentials | CREST-accredited provider, with the GICSP credential held in the testing team |
| Sectors | Energy, water, telecommunications, transport and data-storage operators |
| Scheduling | Planned around your maintenance windows and operational constraints |
| Retest | Retest of every High-severity finding and above |
| Quote | Scoped and quoted to your sites, zones and safety requirements |
What we test in an OT and SCADA penetration test.
Most attacks on industrial systems begin in corporate IT or through a supplier, so we test the paths into the control network as well as the systems inside it.
Remote access into OT
We examine vendor and integrator remote support channels, which can become persistent backdoors into the control layers.
HMI and engineering workstations
We assess the workstations and operator screens that can change how the process runs, including their patching and access controls.
Historians and data flows
Historians often bridge IT and OT, so we test whether they can be used as a stepping stone into control systems.
Industrial protocols, passive-first
We review industrial protocol traffic from mirrored network data, looking for unauthenticated commands and unexpected communication paths.
Safety controls and test windows
We confirm stop conditions, rollback steps and escalation contacts, so everyone knows how to halt the work and restore normal operation.
In OT, the test must never become the incident.
Control systems run plant, pumps and power. So our test plan starts with safety rather than exploits: what is off limits, who can stop the work and how we roll back.
Our safety-first OT penetration testing method.
The CREST-aligned steps we use everywhere, with safety and engineering sign-off built into each stage for industrial control systems.
-
Step 1: Scope with engineering
We agree zones, assets, test windows and stop conditions with both your security and engineering leads, and record who can halt testing at any time.
-
Step 2: Passive discovery
We map assets and communication flows from network traffic and documentation, without sending packets to controllers or field devices.
-
Step 3: Boundary testing
We test the IT/OT boundary from the corporate side, including firewalls, jump hosts, historians and shared identity, to see whether the plant network is reachable.
-
Step 4: Controlled active testing
Where approved, we run limited active tests inside an agreed maintenance window, with a rollback plan and a live bridge to your operators.
-
Step 5: Impact analysis
We describe what an attacker could do from each foothold in operational terms, such as changing setpoints, blinding operators or stopping a process.
-
Step 6: Reporting and retest
Findings are mapped to zones and conduits, with fixes your engineers can schedule around operations, followed by a retest.
Ways to scope an OT penetration test.
Passive OT assessment
A no-touch review for sites that cannot accept any active traffic on the control network.
- Traffic capture through SPAN or TAP
- Asset and protocol inventory
- Insecure communications and flat zones
IT-to-OT boundary test
A test that starts on the corporate network and tries to cross into operational systems, the route most attacks take.
- Firewall and DMZ rules
- Jump hosts and shared accounts
- Historian and replication paths
Remote access and vendor paths
A focused test of the remote support channels that original equipment makers and integrators use to reach your plant.
- Vendor VPNs and remote tools
- Account and session controls
- Routes into Purdue Level 2 and below
Test and reference environments
Where you have a test or reference system, active testing can go further there without risk to the live process.
- HMI and SCADA application testing
- Engineering software weaknesses
- Configuration checked against production
When you need an OT or SCADA penetration test.
Operational technology changes slowly, but the networks and suppliers around it change quickly. These are the moments when an independent OT security test is most valuable.
-
Preparing the annual SOCI report
Give your board independent evidence about operational controls before it approves the risk management program report.
-
After new remote access
A new vendor connection or remote support tool can open a direct path into the plant.
-
After IT/OT network changes
Firewall redesigns, new data links or a move to cloud analytics can weaken the boundary.
-
When connecting a new site
Bringing a substation, pump station or depot onto the central network extends your attack surface.
-
During AESCSF or IEC 62443 uplift
Testing shows whether the controls you have put in place stop a real attacker.
-
After an IT incident
Confirm the attacker could not have reached operational systems from the compromised corporate network.
How OT testing supports the SOCI Act, CIRMP, AESCSF and IEC 62443.
Our reports can be mapped to the frameworks critical infrastructure operators answer to. These are the ones OT testing most often supports.
- SOCI Act. The Act places cyber security and risk management duties on responsible entities across 11 critical infrastructure sectors. Systems of National Significance can face enhanced obligations, including vulnerability assessments. See the SOCI Act and our SOCI Act compliance service.
- CIRMP Rules. The risk management program must address cyber hazards using a permitted framework, and the board approves an annual report. Penetration testing is direct evidence that controls work. See CIRMP.
- AESCSF. Electricity, gas and liquid-fuels participants measure their maturity against the Australian Energy Sector Cyber Security Framework. OT testing checks that the controls you score are effective. See the AESCSF.
- IEC 62443. The international standard for industrial automation and control systems uses zones, conduits and Security Levels. We check IT-to-OT segmentation against that model. See IEC 62443.
For our wider work with energy, water, telecommunications, transport and data-storage operators, see critical infrastructure security.
What you receive after an OT penetration test.
OT findings have to work for two audiences: engineers who must schedule changes around operations, and executives who answer for public safety. Our penetration testing services page lists what every Vectra engagement includes.
-
Findings by zone and conduit
Each weakness placed on your zone model, showing which boundary failed and what it exposed.
-
Operationally safe fixes
Remediation ranked by risk and grouped by what can change now and what must wait for a maintenance window.
-
Executive narrative
A summary framed around safety and service outcomes, ready for the board and regulators.
-
Debrief and retest
A walkthrough with your security and engineering teams, a retest of every High-severity finding and above, and 90 days of portal access.
Related tests and critical infrastructure services.
Network penetration testing
External and internal testing of the corporate network that sits next to your OT.
Wireless penetration testing
On-site testing of Wi-Fi at plants, depots and remote sites.
Red team operations
IT-to-OT traversal testing inside a goal-led attack, under strict safety boundaries.
SOCI Act compliance
Gap assessments, risk management program reviews and SCADA security reviews.
Get a scoped OT penetration testing quote.
Tell us about your sites, zones and safety constraints. We scope each engagement with your engineers and quote to that scope.
OT and SCADA penetration testing FAQs.
Is OT penetration testing safe for a live plant?
It is when it is planned around safety. Our OT testing is passive-first. Active testing on a control network only happens with written engineering approval, a tested maintenance window and a rollback plan. We keep a live bridge to your operators during active work, and anyone on the agreed list can stop the test at once.
Do you test production OT systems?
We can, within strict limits. Many findings come from passive work and from testing the IT/OT boundary, which do not touch controllers at all. Where active testing of production is needed, it is agreed in writing with your engineers. If you have a test or reference environment, we check it matches production and do the deeper active testing there.
What is the difference between passive and active OT testing?
Passive testing observes the network without sending traffic to control devices. It uses mirrored traffic, documentation and configuration to find weaknesses. Active testing sends traffic to systems to confirm a weakness can be exploited. In OT, active work is limited, approved by engineering and run in a maintenance window, because some industrial devices react badly to unexpected traffic.
How does an OT pentest support the SOCI Act and CIRMP?
Responsible entities must manage cyber hazards in their critical infrastructure risk management program and report to their board each year. An OT penetration test gives independent evidence that controls around operational systems work. Findings mapped to the AESCSF, IEC 62443 or another framework your program relies on help you show progress in the annual report.
Do you align OT testing to IEC 62443?
Yes. We report findings against the IEC 62443 zone and conduit model, so you can see which boundaries failed and where segmentation needs work. We can run Essential Eight and IEC 62443 assessments in parallel, so IT and OT uplift sit on one plan rather than two.
How is OT testing different from an IT penetration test?
The goal is the same, finding weaknesses before an attacker does, but the priorities differ. In IT, confidentiality usually comes first. In OT, safety and availability come first, so the test plan starts with what must not be touched. Methods are slower and more passive, and findings are described by their effect on the physical process.
Start with a conversation.
Speak to us about your cyber governance and compliance requirements.
Message sent
Thanks. We have your message.
A member of our team will be in touch soon at . You can also reach us during business hours on 1800 816 044.
- Topic
- Company
Need us sooner? Call +61 8 8208 0800, or the 24/7 incident line on 1800 816 044 if something is happening now.