The Challenges of Operational Technology Penetration Testing
Year: 2026
Type: article
Abstract: Operational technology (OT) is foundational to critical sectors such as water, energy and manufacturing, yet securing it presents unique challenges. Conventional IT penetration testing methods cannot be directly applied to OT because of the risks of disrupting live production environments. As a result, there is little consensus on how penetration testing should be conducted in OT environments, and practice remains inconsistent and poorly understood. This article explores the state of OT penetration testing through a review of existing literature and qualitative interviews with both practitioners and procurers. The findings highlight three central challenges: the absence of standardised methodologies, the limited relevance of IT-style vulnerability reporting, and cultural tensions between cyber security specialists and operational engineers. From these insights, the article proposes a set of short-, medium- and long-term recommendations to improve practice and points to key areas for future research.
DOI: 10.1145/3802592
Author: Richard Derbyshire
Language: English
Subfield: Information Systems
Field: Computer Science
Domain: Physical Sciences
Open Access status: diamond
OpenAlex ID: W7138256376