https://nexich.ai/blog/ Engineering notes on OT, ICS and SCADA security and AI red teaming. en https://nexich.ai/blog/ot-vs-it-penetration-testing.html https://nexich.ai/blog/ot-vs-it-penetration-testing.html 2026-09-15T09:00:00+00:00 Methodology OT penetration testing differs from IT testing because the asset behind the address is physical, patches often wait years for a shutdown, and the goal is proving reachability and controllability rather than firing an exploit. The Purdue model, not the subnet, decides where an OT engagement is even allowed to run. The asset at the end of the wire An IT penetration test ends at a server, a database or a domain controller, something that stores or processes information. An OT penetration test ends at a valve, a pump, a breaker or a furnace. The IP address under test is not the target. It is an interface to something with mass, pre...

]]> https://nexich.ai/blog/will-a-port-scan-crash-a-plc.html https://nexich.ai/blog/will-a-port-scan-crash-a-plc.html 2026-09-15T09:00:00+00:00 Safety A port scan can crash a legacy PLC, and CISA's ICSA-19-106-03 documents named controllers from five vendors doing exactly that under heavy network load; the difference between a routine assessment and an outage is the scan type used (connect, not SYN), the packet rate, and keeping version probes off fragile or unidentified devices. Sometimes, yes. A plant engineer who asks whether a port scan can crash a programmable logic controller is not being difficult, they are asking about a documented failure mode. CISA's advisory ICSA-19-106-03 names five vendors, ABB, Phoenix Contact, Schneider Electric, Siemens and WAGO, whose controllers can be pushed ...

]]> https://nexich.ai/blog/ics-protocol-ports.html https://nexich.ai/blog/ics-protocol-ports.html 2026-09-15T09:00:00+00:00 Protocols The ports guide's CODESYS, SLMP and OPC UA-secure entries are corrected against verified sources: CODESYS defaults to port 1217 (2455 could not be confirmed as a CODESYS default and was dropped), SLMP has no protocol-mandated default port and now says so instead of citing an unconfirmed 5007, and OPC UA's secure port 4843 is now cited to its actual IANA registration rather than an unrelated PubSub spec section. A Modbus TCP scan lights up port 502. On its own that tells you one fact: something on that address is listening and willing to talk. It does not tell you whether the answer is a PLC, a gateway standing in front of a PLC, a simulator left running on a test bench, or an HMI with a driver nobody remembers installing. A p...

]]> https://nexich.ai/blog/modbus-tcp-security.html https://nexich.ai/blog/modbus-tcp-security.html 2026-09-15T09:00:00+00:00 Protocols Modbus TCP has no authentication because it is the same 1979 Modicon serial protocol, carried unchanged over TCP since 1999: the frame has no field for a credential. Any host that can route to its default port can send the same read and write function codes a legitimate master would, which is why the real fix is network controls around it, not the protocol itself. Modbus TCP listens on port 502 , and nothing on that port asks who is calling. No login prompt, no password field, no session token, no signature. A device that speaks Modbus will process a read or a write from any client that completes a TCP handshake, because the protocol was never built to check. That is not a bug t...

]]> https://nexich.ai/blog/engineering-workstation-security.html https://nexich.ai/blog/engineering-workstation-security.html 2026-09-15T09:00:00+00:00 Segmentation An engineering workstation holds the project archive, the controller passwords and the vendor toolchain for every controller it has ever programmed, so compromising it is not one incident, it is every controller downstream of it. Stuxnet and TRITON both proved the same host is where an attacker goes to actually reach the process. Walk into a control room and the operator stations are the ones that get the attention: badge readers, camera coverage, a shift log for who touched what. Walk into the engineering office next door, where the machine running Siemens TIA Portal or Rockwell Studio 5000 sits, and it is usually just a Windows PC on the plan...

]]> https://nexich.ai/blog/cip-device-type-safety-controller.html https://nexich.ai/blog/cip-device-type-safety-controller.html 2026-08-28T09:00:00+00:00 Protocol research We set out to read a CIP device type and name safety equipment from it. ODVA's own conformance record says that cannot work, and the finding changed what we shipped. Every EtherNet/IP device carries an Identity object, and attribute 2 of that object is the Device Type: a number that says which ODVA profile the device implements. It is the one field in an identity reply that is not vendor specific. The vendor ID needs ODVA's vendor list to mean anything. The product code is a privat...

]]> https://nexich.ai/blog/never-send-gate-omission-is-not-protection.html https://nexich.ai/blog/never-send-gate-omission-is-not-protection.html 2026-08-27T09:00:00+00:00 Safety engineering Before widening our industrial port coverage we measured what we already sent. Twenty bytes into an iFIX failover channel, and a single null byte into GuardLogix safety I/O. We were about to add 173 industrial ports to the scanner. The catalogue work behind it was done, every port cited to a vendor page, and the door it opened had already been built. The obvious next step was to ship it. Instead we measured what the scanner already transmitted, and found two channels it should never have t...

]]> https://nexich.ai/blog/advisory-bands-you-cannot-apply.html https://nexich.ai/blog/advisory-bands-you-cannot-apply.html 2026-08-28T09:00:00+00:00 Coverage honesty We hold 116 vendor advisories for industrial software. Only 14 of them can currently decide anything about your equipment, and the reason is not laziness. Our industrial catalogue carries 84 SCADA, HMI, historian and gateway products, harvested from vendor documentation because the product runs air-gapped and cannot look anything up at run time. Among that material are 116 vendor advisories, 111 of which carry a fixed version that parses. An advisory only does something ...

]]> https://nexich.ai/blog/read-only-means-the-write-cannot-be-framed.html https://nexich.ai/blog/read-only-means-the-write-cannot-be-framed.html 2026-08-26T09:00:00+00:00 Design Every industrial scanner claims to be safe. The question worth asking is what happens when the safe path has a bug in it. Ask any tool that touches a plant network whether it is safe and it will say yes. The claim is usually true in the sense the vendor means it: the aggressive features are behind a flag, and the flag is off. The problem with that shape is that it survives exactly as long as the flag does. A refactor, a default that flips...

]]> https://nexich.ai/blog/can-level-4-reach-level-1.html https://nexich.ai/blog/can-level-4-reach-level-1.html 2026-08-25T09:00:00+00:00 Segmentation Every plant has a network diagram showing a clean Purdue hierarchy. Validating it is one TCP connection, and the answer is often not what the diagram says. Ask a plant for its network diagram and you will get a clean drawing: enterprise at the top, an industrial DMZ in the middle, site operations below it, then the cells, then the field. Levels 4 down to 0, with a boundary drawn between each one. The diagram is a design document. Whether the network still matches it is a ...

]]> https://nexich.ai/blog/what-the-ai-decides-and-what-it-must-not.html https://nexich.ai/blog/what-the-ai-decides-and-what-it-must-not.html 2026-08-24T09:00:00+00:00 AI red teaming The interesting question about an AI red team is not how clever the planner is. It is which decisions the planner is structurally prevented from making. An autonomous adversary has two halves that are easy to confuse. One decides what to try next. The other decides whether something worked. Only the first should be a model. Getting that split wrong is the single failure mode that makes AI security tools untrustworthy, and it does not show up as an obvious bug. It shows...

]]> https://nexich.ai/blog/air-gapped-the-binary-is-the-knowledge.html https://nexich.ai/blog/air-gapped-the-binary-is-the-knowledge.html 2026-08-23T09:00:00+00:00 Sovereignty On an isolated network a tool cannot look anything up. That one constraint decides the architecture, the research process and what you are allowed to claim. Most security tools assume a lookup. A version is matched against a database over the internet, a hash is checked against a service, a model is called over an API. Remove the network and most of the product's knowledge disappears with it. Industrial networks are where that assumption breaks most often, and where breaki...

]]> https://nexich.ai/blog/it-pentest-methodology-on-the-plant-floor.html https://nexich.ai/blog/it-pentest-methodology-on-the-plant-floor.html 2026-08-22T09:00:00+00:00 Methodology The techniques are not the problem. The reflexes are: scan harder, retry the login, enumerate everything, and treat a timeout as a challenge. An experienced network tester walking onto a plant network is more dangerous than an inexperienced one, because the habits that make them good on a corporate estate are exactly the habits that cause an incident on a control network. None of what follows is about technique. It is about reflex. 1. Scanning harder when no...

]]> https://nexich.ai/blog/iec-62443-vocabulary-before-the-pack.html https://nexich.ai/blog/iec-62443-vocabulary-before-the-pack.html 2026-08-21T09:00:00+00:00 Compliance An industrial audit produced findings and lit no compliance control at all. The framework pack was not the missing piece. Compliance mapping in a security tool looks like content work. Write the control set, map findings to controls, ship the pack. Customers ask for it by name, and it is the kind of feature that demos well. We measured our own before building an industrial one, and the result reordered the work. The measurement The compli...

]]> https://nexich.ai/blog/identify-by-what-the-service-said.html https://nexich.ai/blog/identify-by-what-the-service-said.html 2026-08-20T09:00:00+00:00 Asset identification Plants move software. A historian on a non-standard port is still a historian, and a web server on 502 is not a PLC. The quickest way to build an industrial asset inventory is to map ports to products. Port 502 is Modbus, 44818 is EtherNet/IP, 20000 is DNP3, 102 is Siemens. It works often enough to look right, and it is wrong in both directions. It is wrong outward because plants move software. Historians, HMI web tiers and gateways ...

]]>