Skip to content
OT AssociatesPURE PLAY OT SECURITY
← The OT Field Guide
07

Patch by consequence, compensate where you cannot

Prioritise vulnerabilities by process impact, patch in approved windows, and compensate formally where patching is not feasible.

5 min readInteractive figureISA/IEC 62443-2-3NIST SP 800-82r3
Interactive figure
A critical vulnerability on HMI-07: what now?
  1. QUESTION 1
    Can an attacker actually reach the asset from where they are likely to be?
The decision appears here. In OT the answer depends on exposure, vendor approval and the operating calendar, not on the severity score alone.
Answer each question the way your site would. The CVSS score is 9.8; notice that the path never asks for it.

Walk a vulnerability through the OT patch decision.

Why raw scores mislead

A critical score on an isolated test bench may matter less than a medium one on a reachable safety-related controller. Prioritisation in OT starts with exposure and consequence: what the asset does, what can reach it and what happens to the process if it fails.

The OT patch path

Patches are applied only after the equipment vendor has approved them for your version, tested on representative systems, and scheduled into a planned window with a rollback plan.

Where a patch cannot be applied, on a legacy HMI or a controller that cannot restart until the next turnaround, the gap is handled as a formal, time-bound deviation with compensating controls such as isolation, allow-listing and closer monitoring. It expires on schedule and is reviewed, never quietly renewed.

Takeaways
  1. 01Prioritise by exposure and process consequence.
  2. 02Vendor approval, testing, window and rollback before any patch.
  3. 03Unpatchable means compensated and time-bound, not ignored.