OT vulnerability disclosure dilemma: balancing safety against transparency in legacy industrial systems

This piece addresses a structural problem in operational technology security that remains underexplored in mainstream cybersecurity discourse. The fundamental challenge centres on the incompatibility between information security norms (rapid disclosure, public patch cycles) and OT operational realities where systems cannot simply be taken offline for updates or where patches introduce greater risk than the vulnerability itself.

Legacy OT environments typically run decades-old hardware and software with no vendor support, patching capabilities, or even documented vulnerabilities. A manufacturing plant, power grid operator, or water treatment facility cannot deploy patches on the same cadence as consumer software. The systems are often designed with safety as the primary concern, meaning that a vulnerability disclosure could enable attackers to cause physical harm, environmental damage, or loss of life before organisations can meaningfully respond.

This creates genuine dilemmas for security researchers and disclosure coordinators. Standard responsible disclosure assumes the vendor can patch and users can deploy updates within a reasonable timeframe. In OT, neither assumption holds. A researcher discovering a critical vulnerability in a PLC or SCADA system might find the original manufacturer no longer exists, the software is embedded in proprietary hardware, or applying any update risks disrupting safety-critical operations. Publishing such findings could enable targeted attacks against infrastructure that has no remediation path.

Defenders facing OT environments must recognise this asymmetry and move beyond expecting timely patches. Segmentation, air-gapping, anomaly detection, and compensating controls become essential because the vulnerability fix cycle simply does not function as it does in IT. Organisations should inventory legacy OT systems, identify which lack modern security practices, and implement environmental controls rather than relying on software updates. Security researchers and disclosure platforms must develop OT-specific policies that acknowledge when full disclosure creates unacceptable physical risk.

The broader implication is that OT security cannot be solved by importing IT security practices wholesale. The field requires distinct vulnerability management frameworks, longer disclosure timelines, and acceptance that some vulnerabilities may never be formally patched. This reality reflects the maturation gap between OT and IT security communities and argues for dedicated OT vulnerability coordination mechanisms separate from traditional CVE processes.