From When to Act to How to Act: Key Takeaways from the OT Cyber Alerts Report III

By Ignacio Quiralte Pérez, Inprosec.

In operational technology (OT), the systems that control industrial machinery and processes, knowing which vulnerability to address first is not enough. A patch often exists, but installing it requires testing, vendor approval or waiting for a maintenance window: the planned shutdown during which equipment can be worked on. And part of the industrial infrastructure runs on equipment no longer supported by the vendor, which will never receive patches.

The OT Cyber Alerts Report III (Informe de Ciberalertas OT – III) from the Industrial Cybersecurity Observatory, published by the Xunta de Galicia through the Galician Agency for Technological Modernization (Amtega), focuses on that gap: how to reduce risk while the definitive fix cannot yet be applied.

What this third report adds.

The first report laid the groundwork: it defined vulnerabilities in industrial environments, analyzed how long attackers take to exploit them and quantified the return on investment of mitigating them early. The second addressed how to prioritize based on real risk, using three tools:

• The Known Exploited Vulnerabilities (KEV) catalog of the US Cybersecurity and Infrastructure Security Agency (CISA). It lists the vulnerabilities already being exploited in real attacks.
• The Exploit Prediction Scoring System (EPSS). It estimates the probability that a vulnerability will be exploited in the next 30 days.
• The Now/Next/Never model, which sets when to act:
  • Now: fix immediately if it is safe to do so or, if not, mitigate right away.
  • Next: reduce exposure and prepare a maintenance window.
  • Never: do not intervene, but document the reason, monitor and review the decision periodically.

If the Now/Next/Never model decides when to act, this third report explains how to act when an immediate fix is not possible. It also draws a line: postponing a patch is not the same as simply accepting the risk. The decision must be documented and accompanied by three things: a proportionate alternative measure (what the report calls a “compensating control”), a review date and a clear path to remediation.

Three pillars for containing risk.

Defensible architectures.

The report draws on the international standard ISA/IEC 62443-3-2, from the International Society of Automation (ISA) and the International Electrotechnical Commission (IEC). It proposes moving away from “flat” industrial networks, in which any device can communicate with any other. Instead, it suggests dividing them into zones, which are groups of assets with similar security requirements. Zones connect only through conduits, the only communication channels allowed between them. This limits lateral movement, that is, an intruder jumping from one device to another.

Segmenting the network with virtual local area networks (VLANs), logical divisions of a single physical network, is not enough. Each conduit needs verifiable rules that define who communicates with whom, over which protocol and port, in which direction and for what purpose. The Zero Trust model does not consider any access trustworthy simply because it originates inside the network. It can reinforce this approach, but it does not replace it.

Virtual patching.

It consists of blocking, at network level, the attack that would exploit the vulnerability, before it reaches the device and without modifying it. This is done with deep packet inspection (DPI) rules, which analyze the content of communications. These rules are deployed on industrial firewalls and intrusion prevention systems (IPS) capable of interpreting industrial communication protocols such as Modbus TCP, EtherNet/IP, S7comm, OPC UA or DNP3.

Before enabling a rule, three steps are needed:

• measure latency, the delay it adds to communications;
• rule out false positives, that is, legitimate traffic blocked by mistake;
• where possible, start in detection mode, in which the rule alerts but does not block.

Virtual patching complements the official patch; it does not replace it: once the patch is installed, the rule is withdrawn in a controlled manner.

Compensating controls. These are alternative measures that reduce risk while a fix is not possible. The report highlights three:

• Isolating the device through network configuration (logical isolation).
• Restricting or disabling legacy protocols that transmit information unencrypted, such as Telnet, FTP, HTTP or SNMP versions 1 and 2.
• Hardening remote access with three elements:
  • Multi-factor authentication (MFA);
  • An encrypted virtual private network (VPN);
  • A jump server, a controlled intermediate host through which all connections must pass. It sits in the industrial demilitarized zone (DMZ), an isolated network zone between the corporate network and the plant network.

Remote access deserves particular attention. According to the report, connections from vendors, maintenance staff and integrators (the companies that install and configure the systems) are among the most frequent intrusion vectors.

Managing the exception, not forgetting it.

Every vulnerability that is not fixed within the usual timeframe is an exception. To manage it, the report proposes a minimum seven-step procedure:

1. Confirm that the device is affected.
2. Assess exposure and consequences.
3. Select the treatment.
4. Validate the measure: test it under controlled conditions before applying it.
5. Apply it with traceability: record who is responsible, the change, how to roll it back and when to review it.
6. Verify that it blocks the attack path and leaves evidence.
7. Close the exception.

A control only counts as valid if it reduces or blocks the targeted attack without blocking legitimate communications or affecting production unacceptably. It must also meet four conditions:

• generate evidence that it works;
• have a tested rollback, that is, a plan to undo the change if something goes wrong;
• have an owner;
• have a review date.

Each exception must be recorded with, among other details:

• its status: remediated, mitigated or accepted;
• the residual risk, the risk that remains after the measures are applied;
• the condition for retiring it.

The difference between statuses matters. A mitigated vulnerability is still present; only the likelihood of exploitation or the severity of its consequences has been reduced.

What the third-quarter advisories show.

The report’s advisory catalog brings together 84 security advisories published between July and September 2026. Each advisory may cover several vulnerabilities, each identified by its public CVE (Common Vulnerabilities and Exposures) code. Only advisories with at least one high or critical severity vulnerability that are also relevant to industry are included.

The report distinguishes two groups:

• OT and industrial control system (ICS) products;
• information technology (IT) or cross-cutting technologies that can affect operations, such as Citrix NetScaler or WatchGuard and HPE (Hewlett Packard Enterprise) wireless access points.

A product appearing in the catalog does not mean that a specific installation is exposed. Priority combines five factors:

• the technical severity of the flaw;
• whether an attacker can actually reach the device;
• how easy it is to exploit;
• the criticality of the asset;
• the consequences for the process.

Two of the cases analyzed illustrate this:

• Citrix NetScaler ADC and Gateway, appliances that manage application traffic and remote access for many companies. Two of their vulnerabilities are already being exploited in real attacks and are listed in the KEV catalog, so the priority is Now. The report also advises treating the case as a potential incident: checking for signs of compromise before updating and preserving evidence if an attack is suspected.
• Phoenix Contact, Carlo Gavazzi and Pepperl+Fuchs. The same critical vulnerabilities affect input/output (I/O) modules from all three manufacturers. These are the devices that connect control systems to sensors and actuators. The priority is Now if the device is reachable from untrusted networks and Next if its exposure is tightly restricted. The case also shows how a single flaw spreads to products from several manufacturers through the supply chain.

The report’s conclusions point to recurring weaknesses:

• exposed interfaces, that is, device panels or services reachable from places they should not be;
• flaws in credential management;
• vulnerabilities inherited from third-party components.

Hence its emphasis on three lines of action:

• Gaining visibility over assets and their dependencies with a software bill of materials (SBOM), the inventory of software components in each product.
• Reducing implicit trust, that is, no longer assuming an access is safe just because it comes from inside the network.
• For remote maintenance, relying on privileged access management (PAM) solutions, which control and log access with administrator privileges.

Conclusion

The report sums it up in one sentence: “In OT, not patching immediately should not mean not acting.” The definitive fix remains the goal; until it arrives, every temporary measure must be justified, tested and have a removal date.

At Inprosec, we continue to work with Amtega to help Galicia’s industrial sector better manage its OT vulnerabilities.

Full report on the Ciberseguridade Galicia portal: https://ciberseguridadegalicia.gal/es/recursos/documentacion/informe-ciberalertas-3