OT Pentesting

Test your industrial environment the way a real attacker would, without ever putting production or safety at risk.

Why IT pentesting breaks in OT environments

In IT, a penetration test proves impact by exploiting, escalating, and pushing a system until something gives. In an operational technology (OT) environment, that same playbook can stop a production line or trigger a safety incident. Controllers, SCADA systems, and field devices were engineered for availability and physical safety, not for resisting an aggressive security test.

Testing OT the way you test an IT network or web application is not just risky, it can be dangerous. OT needs a different approach: one that shows how far an attacker could get while keeping production running and people safe.

What is Ot pentesting?

OT pentesting assesses the security of the systems that run your physical processes: SCADA, HMIs, PLCs, historians, engineering workstations, and the network that ties them together. The central question is not only whether a single device is vulnerable, but whether an attacker who lands in your corporate IT or cloud environment could move all the way through to your production floor. We answer that question with evidence, and we do it without disrupting operations.

Our methodology

We run OT engagements as a Cyber Resilience Test (CRT), built around five attack domains that mirror how a real adversary operates:

1. Initial Access

Gaining a foothold through phishing, exposed services, or stolen identities at the enterprise layer.

2. Discovery

Enumerating the environment and mapping high-value assets and routes toward the OT network.

3. Privilege Escalation

The pivot. Abusing jump hosts, broker credentials, and IT/OT trust relationships to cross the boundary.

4. Command & Control

Establishing persistence on engineering workstations and historians.

4. Objectives

Reaching SCADA and HMI systems and assessing, passively, whether controllers could be influenced.

We map these five domains onto the Purdue model, the reference architecture for industrial networks. The realistic question we answer for you: can an attacker move from your office and cloud environment, through the IT/OT DMZ, all the way to the production line?

CRT phases and the Purdue model at a glance

Testing style adapts to the Purdue level

Not every layer is tested the same way. The deeper we go toward the physical process, the more we trade active exploitation for careful observation and documentation.

Aggressiveness decreases as we approach the systems that move physical equipment; safety always comes first. The table below shows how our testing posture changes at each level.

Purdue zone	CRT phase	Techniques applied	Safety boundary
Level 5 Enterprise	01 Initial Access	OSINT, credential stuffing, phishing simulation, exposed-service assessment, identity-provider review.	Full OWASP-style exploitation permitted under standard rules of engagement.
Level 4 Business / IT	02 Discovery	Internal pentest, AD enumeration (BloodHound), high-value asset mapping, lateral movement toward jump hosts.	Full exploitation permitted on IT assets under standard rules of engagement.
Level 3.5 DMZ	03 Privilege Escalation	Jump-host configuration review, broker and data-historian replication audit, IT/OT AD trust analysis, remote-access path validation.	Authenticated configuration review only. No exploitation that could disrupt the broker or jump host and cut visibility for operations.
Level 3 Site Operations	OT, scoped separately	Segmentation review, firewall ruleset analysis, credential hygiene audit, engineering-workstation assessment.	Authenticated enumeration only. No exploitation of historian or patch servers in production windows.
Level 2 SCADA / HMI	OT, scoped separately	Authentication review, configuration audit, protocol inspection, identification of insecure defaults and legacy remote-access paths.	No brute force. No service crashes. Read-only commands. Change control required for any active test.
Level 1 PLCs / Controllers	OT, scoped separately	Passive Modbus, DNP3 and S7 traffic analysis, firmware version and CVE mapping, logic-upload feasibility review.	No scanning of live controllers. Active testing in lab replicas only.
Level 0 Field devices	Out of active scope	Documentation review, inventory validation, physical-access risk assessment.	Never actively tested in production.

All five CRT phases are actively validated in the IT environment. Testing inside the OT zones is scoped separately, layer by layer, with dedicated test plans and change control.

How an OT engagement works

Kick)off

Before we start, we share prerequisites such as accounts and access. In the kick-off we validate them, fine-tune the methodology, and lock the testing window, with particular attention to OT change control and safety boundaries.

Execution

We stay in close contact with your team throughout. Daily start and stop notifications let you tie any operational event to our activity, and critical findings are flagged immediately rather than held for the report.

Reporting

You receive an executive summary plus a detailed write-up of every finding, each with its linked risk, concrete remediation steps, and a technical risk score for prioritisation.

Debriefing

We walk through the results with both technical and management stakeholders, and can align with your internal teams and SOC partner on the improvement roadmap.

What you receive

Technical Report: Full documentation of findings, attack paths, and evidence across the five CRT domains, each with a risk rating, proof of concept, and remediation guidance.
Executive Summary: A concise, board-ready view of your overall posture, key exposure areas, and strategic recommendations, free of technical jargon.
Prioritised Remediation Plan & Debrief: A ranked roadmap ordered by risk reduction per euro, split into quick wins and strategic investments, closed out with a stakeholder readout.

The advantages of OT pentesting

Protect production and safety.

Find the paths an attacker could use before they cause downtime or a safety event, and close them on your terms.

Validate the IT/OT boundary

Get evidence-based assurance that your DMZ, jump hosts, and network segmentation actually hold against a determined attacker.

Support your compliance

Demonstrate due diligence for frameworks such as NIS2, IEC 62443, and CyberFundamentals with documented, independent testing.

When to perform an OT pentest?

Before connecting IT and OT

Convergence projects, remote-access rollouts, and new integrations open fresh routes into the production network. Test before you connect.

After a major change

New equipment, network changes, or upgraded control systems can quietly introduce exposure. Periodic testing keeps that in check.

When a third party has access

Integrators, maintenance vendors, and remote-support tools extend your attack surface. Validate that their access cannot be turned against you.

To prove your security level

Regulators, insurers, and customers increasingly ask for evidence. An independent OT test provides it.

We keep your environment secure

At Refracted, we believe everyone deserves to be safe in a digital world, including the people who keep your physical operations running. We bring one of Belgium’s largest offensive security teams to your OT environment and test it with the care that production and safety demand.

Request your OT Pentest

An OT pentest shows you exactly how far an attacker could get toward your production floor, and what to fix first, without ever putting operations at risk. Start with a scoping call and we will return a clear scope, timeline, and fixed-price quote.

Give your security a boost

Schedule a call with our digital security experts. We check your security so you can protect your company.
Because you deserve to feel confident and safe in a digital world.