An experienced network tester walking onto a plant network is more dangerous than an inexperienced one, because the habits that make them good on a corporate estate are exactly the habits that cause an incident on a control network.
None of what follows is about technique. It is about reflex.
1. Scanning harder when nothing answers
On a corporate network a silent host means a firewall, and the reasonable response is more probes, more ports, faster. On a control network a silent device often means a device that is busy doing something with a deadline, and the reasonable response is to slow down.
Controllers are embedded systems with small connection tables and no spare CPU. Several vendors publish storm-protection thresholds above which the device stops processing network traffic to protect its scan cycle, which is the correct behaviour and also an outage if the device is the one running a line.
The rate that matters is not the one your tool defaults to. It is the one the vendor documents for that family, and the honest position when you do not know it is to stay well under.
2. Retrying a failed login
Credential work on a domain is iterative: try, adjust, try again. On an industrial estate the accounts in play are often service accounts that run something, and a lockout policy does not distinguish between an attacker and an assessor.
Locking out the account a historian uses to write is not a finding. It is a data gap in the plant's production record, and the record is a commercial and sometimes legal artifact. The rule we work to is that one scheduler holds the dial for every credential attempt in the whole engagement, with per-pair intervals, per-host caps and a cooldown, so a spray cannot outrun a lockout policy no matter how many modules would like to try.
3. Enumerating everything because enumeration is free
It is not free. Several industrial services charge for a connection in a currency that has nothing to do with bandwidth.
A controller has a fixed number of session slots, often four to eight, shared with the engineering station and the HMI. Consuming one to read an identity is a real cost, and consuming several is an operational problem. Some licensing services count a connection against a licence seat, so an enumeration sweep can cost a site the ability to open a client. And a handful of ports are documented by their own vendors as crashable by an unexpected message, with released exploit code proving it.
The discipline is to prefer the read that costs nothing. Where a device broadcasts its own identity, listen instead of asking. Where a cheap identity read exists beside an expensive one, take the cheap one even if it returns less.
4. Treating a device as a host
An IT methodology sorts things into Windows, Linux and network gear, and applies a playbook per class. On a plant floor the same IP might be a controller running a safety function, a historian holding the production record, a gateway translating between two protocols, or an operator console with a live process on the screen.
The consequence is not just about safety, it is about the report. A finding written for a server administrator lands wrong with a controls engineer. What they need to know is what changed for the process, which controller, which line, what the operator would see. A finding that cannot answer that gets forwarded rather than fixed.
5. Treating the fragile thing as the interesting thing
The instinct that makes a good tester is to push on whatever looks weakest. On a plant floor the weakest thing on the network is frequently the safety instrumented system, and it is weak because it is designed for determinism rather than for adversaries.
Proving you can disturb it is not the deliverable. The deliverable is proving you can reach it, and then stopping. A crossing to a safety network is a critical finding on its own, before anything is done with it, and doing anything with it adds risk without adding information.
What survives the transfer
Most of the craft carries over intact. Credential reuse across trust boundaries is the same technique on a plant as anywhere else, and it is still the most productive one. Reading a configuration file for a connection string works the same way. The engineering workstation is a Windows box with the usual weaknesses and unusually high value.
What has to change is the default. On IT the default is to try and back off if something breaks. On OT the default is to read, to declare what you did not do, and to earn the right to be more active from evidence rather than from curiosity.
A useful test of any OT assessment, ours included: ask what the report says it deliberately did not do. If there is no such section, the tool was not making that decision.
Frequently asked questions
Why shouldn't you scan a plant floor network the same way as a corporate IT network?
On a corporate network a silent host usually means a firewall, so more probes make sense. On a control network a silent device is often busy with a real-time deadline, and pushing harder risks tripping a vendor's storm-protection threshold, which can stop the device processing traffic and take a line down.
Why is retrying a failed login dangerous during an OT penetration test?
Many industrial accounts are service accounts a historian or other system depends on to write data, and a lockout policy can't tell an assessor from an attacker. Locking one out creates a gap in the plant's production record. The fix is a single scheduler governing every credential attempt across the engagement, with per-pair intervals, per-host caps and a cooldown.
Why isn't enumeration free on an ICS network?
A controller only has a handful of session slots, often four to eight, shared with the engineering station and HMI, so an enumeration sweep can lock others out. Some licensing services count a connection against a seat, and some ports are documented as crashable by an unexpected message. Cheaper reads should be preferred wherever they exist.
Why can't OT assets be classified the same way as IT hosts?
An IT methodology sorts assets into Windows, Linux or network gear and applies a fixed playbook. On a plant floor the same IP could be a safety controller, a historian, a protocol gateway or an operator console with a live process on screen, and a finding that doesn't say what changed for the process gets forwarded rather than fixed.
Why shouldn't a penetration tester push on a plant's safety instrumented system?
Safety instrumented systems are often the weakest thing on a plant network because they're built for determinism, not adversaries. Proving disturbance isn't the deliverable. Reaching a safety network crossing is already a critical finding on its own, and doing more with it adds risk to the process without adding any new information.
How do you know if an OT security assessment made deliberate safety decisions?
Check whether its report has a section stating what it deliberately chose not to do. If a report only lists findings and never names a restraint it applied on purpose, there's no evidence the tool or tester was making a decision at all, rather than simply running everything it could.