SCADA
SCADA penetration testing
SCADA servers, historians and operator HMIs, tested for who can see and change what the operators see.
- Authentication and roles
- Exposed services and patch level
- Historian and database access
- Paths into the control network
Controllers
PLC and RTU security testing
Whether controllers accept unauthenticated reads, writes or logic downloads. Active tests run on lab units or in agreed windows.
- Modbus/TCP and DNP3
- S7comm and EtherNet/IP
- Logic download and change control
- Firmware and project files
Workstations
HMI and engineering workstation testing
The machines that program and operate the plant, where one weak password can mean control of the process.
- Shared and default accounts
- Engineering software and projects
- Removable media controls
- Hardening and patching
Segmentation
IT/OT segmentation testing
Whether the corporate network can reach the plant, tested against your IEC 62443 zones and conduits.
- Firewall and DMZ rules
- Shared servers and file paths
- Directory trust
- Named flows only
Remote access
OT remote access and vendor testing
The VPNs, jump hosts and vendor tools that reach OT systems from outside the site.
- VPN and jump host setup
- Vendor accounts
- Multi-factor authentication
- Session approval and recording
IIoT
IIoT security testing
Industrial IoT gateways, sensors and the cloud services they report to.
- Gateway firmware and services
- Device-to-cloud authentication
- Default credentials
- Wireless links
Assessment
OT security assessment
A review of your OT architecture and controls against IEC 62443 and NIST SP 800-82, using passive traffic analysis on live networks.
- Asset and flow inventory
- Zone and conduit review
- Remote access review
- Prioritized fix plan
Water and energy
Utility and critical infrastructure testing
Water, power and building systems, tested with the same safety rules as any plant.
- Passive capture first
- Agreed test windows
- Lab-only writes
- IEC 62443 mapping
What is SCADA penetration testing?
SCADA penetration testing is a controlled test of the supervisory systems that monitor and control an industrial process, such as SCADA servers, HMIs and historians, and the networks and protocols that connect them to PLCs. It shows whether an attacker could view or change the process, using passive methods on live systems and active steps only in agreed windows.
What is the difference between an OT security assessment and an ICS penetration test?
An OT security assessment reviews architecture, segmentation, remote access and controls against a standard such as IEC 62443, often using passive traffic analysis. An ICS penetration test goes further and tries to prove an attack path, for example from the office network to a controller, with evidence for each step. Many teams start with an assessment and follow with a targeted test.
Do you test PLCs directly?
Yes, with care. We test controllers for unauthenticated access and logic changes on a lab unit or spare, or on live equipment only inside an agreed window with stop conditions. We do not write to a controller running the live process unless your operations team has approved it.
