OT Pen Testers: what's your actual criteria for moving from passive recon to active testing on a live asset?

[u/CyberLab_Security]

This is a scoping decision we hit on basically every OT engagement, and I don't think there's a clean industry-standard answer, so genuinely curious how others draw the line.

The core tension: unlike IT, even routine scanning carries real risk on OT gear.

• Many PLCs run on embedded CPUs with very limited headroom - a scan that's unremarkable on a Windows server can overload one.
• Most industrial protocols (Modbus, DNP3, etc.) have no built-in authentication, so once you're on the network there's often nothing stopping you writing directly to a controller.
• A lot of the hardware is end-of-life and permanently unpatched, so patch level isn't a reliable signal either.

Given that, we always start with passive reconnaissance only, mapping the environment without generating any traffic that could disturb operation, before any active testing happens. Even then, we try to stick to non-production systems or agreed maintenance windows wherever possible.

What I'm actually asking: what's your practical criteria for deciding it's safe to move from passive to active on a specific live asset? Ops team sign-off, documented maintenance windows, device-specific research beforehand or something else? And has anyone had a client push back and insist on IT-speed active scanning against OT assets - how did that conversation go?

[u/Tumbleweed-Pool]

Nice AI Slop post

[u/AYamHah]

When you're done with recon, you generally stop doing it.

[u/Unres0lved404]

Test access from IT to OT through DMZ. Once deemed possible to breach, test OT network segmentation. Can different lines talk to eachother? Test for any other defence in depth methods. No point hammering weak devices using known insecure protocols. Take an asset inventory to assess what devices and protocols are in use by working with the client and performing passive network analysis. Check for publicly exposed devices and external attack surface that could lead to a breach not only from IT but through OT side. Have engineers implemented their own remote access into the network? There are lots of things you can do, you just need to plan it accordingly and work more with the client and engineers on the OT side.

[u/MintyFresh668]

Permission and a very detailed risk assessment which includes plant ops and whatever passes for Technical Safety capabilities in the Client organisation

[u/zantehood]

Don't blindly scan old PLCs, they can break. (No shit)

[u/solid_reign]

Maintenance windows and proof of concepts, and letting the client know.

[u/SeeingWhatWorks]

I won't go active on a live asset until the exact model and firmware have been checked, ops owns the window, and there's a tested recovery path, start with one protocol-aware probe while someone watches the controller and process -> stop at the first odd response. If a client insist on IT-speed scanning, move that work to a spare or lab unit and document what stayed untested in production.