performing-ot-vulnerability-assessment-with-claroty

Use passive vulnerability identification through network traffic analysis with platforms like Claroty xDome, correlating asset vendor, model, and firmware against CVE and ICS-CERT advisories. Avoid active scanning of live PLCs; use safe native protocol queries at limited rates during maintenance windows only.

Claroty correlates discovered assets with vulnerability databases and computes an OT risk score factoring CVSS base score, asset criticality, Purdue level, and compensating controls. A CVSS 7 vulnerability in CISA KEV at Purdue Level 1 can outrank a CVSS 9 on an isolated Level 4 host.

Passive discovery identifies assets by analyzing network traffic without sending packets, making it safe for production. Safe active querying uses native industrial protocols at controlled rates to collect firmware and configuration details, but should exclude safety instrumented systems and run in maintenance windows.

False positives occur when correlation matches vendor and model but ignores firmware version, flagging patched devices as vulnerable. Confirm the exact firmware via passive parsing or a safe native query rather than relying solely on CMDB records.

Do not use it for active vulnerability scanning of PLCs and safety systems, for IT-only vulnerability management where standard scanners suffice, or for penetration testing. Dormant standby controllers also cannot be assessed passively and require physical inventory verification.