Assessing a network you are not allowed to scan

Ask a plant security lead why they have never run an automated assessment against their process network and you will not hear a budget answer. You will hear that the devices which matter are the ones nobody will authorise them to scan — and they are right. Several documented PLC families fault on an ordinary port sweep. On a live process, that is not an outage. It is a safety event.

So the conventional scanner arrives, is refused permission to do the only thing it knows how to do, and produces a report about the jump host. Everyone involved concludes the tool does not understand their world, because it does not.

The finding is reachability, not a CVE

A vulnerability scanner is close to useless on an industrial estate, and the buyer knows it before the vendor does. Controllers run no packages you can enumerate. They are years behind on firmware by deliberate policy. Nobody can patch them without a shutdown window that costs more than the risk being mitigated. Telling a process engineer their PLC firmware is old tells them something they have known for six years and can do nothing about.

What they do not know is who can reach it.

Modbus, DNP3, S7comm and IEC 60870-5-104 have no authentication and no integrity checking by design. They were specified for physically isolated serial networks and carried onto Ethernet unchanged. There is no misconfiguration to find and no patch to apply: if a device speaks Modbus and you can reach it, you can write its registers. Writing a register is not a data change. It is a change to a valve.

The finding is never that the protocol is insecure. Everyone competent already knows. The finding is that it is reachable from here — which is a segmentation failure, specific to that network, fixable with a firewall rule.

That is also exactly what the zone and conduit model in IEC 62443 exists to prevent, which means it lands as a gap against a standard the site is already audited on rather than as a vendor opinion.

Mapping a control network without touching it

The constraint that makes this hard is the same one that makes it solvable. An agent running on a host inside the estate does not need to probe anything, because the host already holds the answers.

• Its listening sockets say what the machine is, whatever the asset register claims.
• Its established connections reveal which controllers it talks to, and on which protocols.
• Its ARP cache shows the devices sharing its layer-2 segment, populated by normal operation.

Reading those originates no traffic at all. It is safe in a passive zone, safe beside a safety instrumented system, and permitted in situations where nothing else is. It also produces the artifact most operators cannot generate on request: an evidence-backed map of what actually communicates with what, as opposed to what the commissioning diagram says. The gap between those two documents is where the findings live.

Normal operation is not a finding

A historian holding connections to twelve PLCs is not a vulnerability. It is a historian doing its job, and an assessment that reports it as critical has told a process engineer their plant is broken for working correctly. That report goes in the bin, along with the findings that were real.

So a control path is recorded as context. It becomes a finding when the same host is also reachable from a less-trusted network, because that combination is the pivot: business network to supervisory host to controller, with no boundary crossed that was not already open. Neither half is a weakness alone. The combination is the thing.

One more distinction matters more than any other. A safety instrumented system and a separator controller both answer on Modbus port 502, and nothing observable on the wire tells them apart. That is supplied from the customer's own asset register, not guessed — and a path to a safety system gets its own finding, its own language and a citation to IEC 61511, because it is the only consequence on the report measured in people rather than in downtime.

Sovereign and air-gapped: the deployment that sends nothing

The second half of the problem is that many of these estates cannot let assessment data leave at all. Offshore platforms have no usable link. Cable landing stations operate under licence conditions and national security review. Hospitals hold patient data under HIPAA or GDPR. Defence estates decide what may traverse a boundary through cross-domain policy, and a security tool that phones home does not get accredited.

For those sites the agent runs with no relay configured, and in that mode it opens no connection outside the customer's network. Not for licensing, not for telemetry, not for model inference.

• Licence verification is an Ed25519 signature check performed locally, with no network call of any kind.
• Reasoning runs against an OpenAI-compatible runtime inside the estate. The agent never holds a provider credential.
• Vulnerability intelligence arrives as signed bundles carried in on removable media and verified on load.
• Findings, the tamper-evident audit chain and the report are written to the customer's own disk.

This is not the cloud product with its network calls switched off. Offline is the design, and it is the reason the whole thing can be evaluated honestly: run the agent on a segment with no route out and watch it complete an assessment. That is the entire test, and it is the one we would want to run in a buyer's position.

Evidence that survives the meeting

An assessment is only worth what the customer can still produce six months later, when an auditor asks. Every tool invocation and every finding is written to a hash-linked audit chain on the assessed host, so the answer to "what did you run on my machine" is one the operator cannot have quietly amended afterwards.

The findings themselves are stored as a JSON document beside that chain, and the report is generated from the same document on the same host — no rendering service, no document pipeline, no third party holding a copy of the estate's weaknesses. The report leads with an executive summary written for the person who funds the remediation rather than the one who applies it, in the terms they actually think in: can this stop production, can this hurt someone, what is our regulatory exposure, and what do we do first.

Who this is for

The constraint repeats across sectors that otherwise have nothing in common. Oil, gas and process industry. Subsea cable and telecom. Healthcare and medical devices, where an imaging system mid-procedure is closer to a controller than to a server. Rail, maritime and transport. Defence and classified estates. Financial market infrastructure under DORA. Utilities under NIS2 and NERC CIP.

Different regulators, the same shape of problem: the estate holds systems that cannot be disturbed, and data about those systems is not permitted to leave.

Try it against the hard case

If you run one of these environments, the evaluation is straightforward and it does not require trusting a claim in a blog post. Put the agent on an isolated segment, give it no route out, and see what it finds and what it sends. Both answers are checkable in an afternoon.