For more than twenty years, the OWASP Top 10 has served as the reference list of critical security risks for web applications. It is cited in procurement contracts, used in developer training and applied in audit checklists around the world. Until recently, industrial environments had no equivalent reference.
The OWASP Operational Technology (OT) Top 10 is the first Top 10 written specifically for the systems that operate refineries, electrical substations, water treatment plants and production lines. This guide explains each of the ten risks in ranked order, illustrates each risk with a documented incident, and describes how the risks combine during an intrusion.
What Is the OWASP OT Top 10?
OWASP, the Open Worldwide Application Security Project, is a non-profit foundation that publishes free and vendor-neutral security guidance written by practitioners. A Top 10 in the OWASP sense is an awareness list. Its purpose is to direct attention to the security problems that are observed most frequently and that cause the greatest damage.
The OT Top 10 applies the same approach to operational technology, which is the term for programmable systems and devices that monitor or control physical processes. Examples include programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, human machine interfaces (HMIs), computer numerical control (CNC) machines and the servers that host control functions. The list was developed from practitioner experience and validated against findings from penetration tests and incident response engagements in operating industrial facilities.
The OT list differs fundamentally from the web application list. A vulnerability in a web application is normally corrected by changing the application code. Most OT risks, by contrast, are addressed by changing the network architecture, the operating procedures or the supplier contract, because the industrial device itself often cannot be modified and may remain in service for twenty years or more.
How the List Is Ranked
The ten risks are ordered according to how critical each weakness is in industrial environments, based on what practitioners observe in the field. Risk 1 is the most critical and the most widespread, and risk 10 is ranked tenth.
- Risks 1 to 4 are the most critical: These weaknesses are so fundamental that, while any one of them remains, the rest of a security programme cannot operate effectively.
- Risks 5 to 9 are of high importance: These are serious weaknesses of broadly similar weight, and each is common across industrial sites.
- Risk 10 completes the list: It is not a vulnerability in its own right, but its absence makes every other weakness easier to exploit.
The Ten Risks
1. Unknown Assets and Unmanaged External Access
Unknown assets are devices, services and network connections that are present in a facility but absent from its records. Typical examples are a network switch that was never documented, an unrecorded service running on a server, or a cellular modem installed during commissioning and never removed. The most serious form of this risk is unmanaged external access, which refers to remote access tools, virtual private network (VPN) accounts and vendor maintenance connections that no one in the organisation currently owns or reviews.
The 2021 ransomware incident at Colonial Pipeline began with a compromised password for a legacy VPN account that was no longer in active use and was not protected by multi-factor authentication. The ransomware affected business systems, and the company halted pipeline operations as a precautionary measure.
Defensive implication: An organisation cannot protect, patch or monitor assets that it has not recorded, and an access path that has been forgotten by the organisation may still be discovered by an attacker.
2. Devices with Known Vulnerabilities
A device that contains a publicly known vulnerability, particularly one for which exploit code is publicly available, can be taken over regardless of most other defences applied to it. In information technology (IT) environments, the standard response is to apply the vendor's security patch. In OT environments, patching is frequently not possible in the short term, because every change must first be validated for safety, outage windows are fixed and infrequent, and some products are no longer supported by their manufacturers.
The joint advisory on the threat actor Volt Typhoon, published as CISA AA24-038A, describes initial access gained through vulnerabilities in internet-facing network appliances, followed by movement toward OT networks. The protective options available for equipment that cannot be patched are described in our article on securing legacy OT systems without patching.
Defensive implication: The objective is not to patch every device immediately. The objective is to ensure that no reachable and exploitable vulnerability remains without either a patch or a compensating control.
3. Inadequate Supplier and Supply Chain Management
A supply chain compromise occurs when an attacker exploits the trust between a facility and its vendors, system integrators and service providers, instead of attacking the facility directly. A small number of specialist vendors have deep access to many control networks through their engineering software, software updates and remote support services. As a result, a single compromised supplier can affect many facilities at the same time.
The NotPetya malware of June 2017 spread through the compromised update mechanism of a widely used Ukrainian accounting application and disrupted manufacturing and logistics companies around the world. The CrowdStrike content update of July 2024 was not an attack, yet a single faulty update caused widespread outages. This demonstrates that dependency on suppliers is a risk even in the absence of an adversary. Product security certification and the EU Cyber Resilience Act are raising the security requirements placed on manufacturers, but the operating facility continues to bear the consequences of a supplier failure.
Defensive implication: Trust in a supplier should be established during procurement and verified again throughout the operational life of the system.
4. Loss of Availability
Availability means that a system performs its intended function whenever it is required. In OT, the concept extends beyond denial-of-service attacks, because integrity forms part of availability. A sensor network that remains online but reports false values has, in practical terms, ceased to perform its function. Stuxnet is the best-known example of this, as it combined physical sabotage of equipment with falsified process readings presented to operators.
Availability can also be lost through causes that are not malicious. Routine network scans have caused industrial components to fail, and an inadequately tested software update can stop a process as effectively as a deliberate attack. On 24 February 2022, the AcidRain wiper malware disabled a large number of satellite modems on the Viasat KA-SAT network, which also interrupted the remote monitoring of wind turbines in Europe.
Defensive implication: In OT environments, redundancy, tested recovery procedures and controlled change management are security measures as well as engineering practices.
5. Insufficient Access Control
Access control operates at three levels. At the organisational level, it is a documented definition of which personnel are authorised to operate which systems. At the technical level, it is the authentication and authorisation functions built into the systems themselves. At the physical level, it consists of locks, secured cabinets and site security personnel.
Access control in OT involves considerations that rarely arise in IT. An emergency stop must be operable immediately by any person present. Many legacy devices do not support authentication of any kind. Shared passwords used at a control desk also remove non-repudiation, which is the ability to establish which individual performed a particular action.
In March 2019, a former employee of a rural water district in the US state of Kansas used a remote login system from his previous role to shut down processes that affected the plant's cleaning and disinfection procedures. The incident occurred two months after his resignation, and he later pleaded guilty.
Defensive implication: Every remote access path into OT that lacks multi-factor authentication, and every account that remains active after its owner has left the organisation, represents a continuing opportunity for an attacker.
6. Missing Incident Detection and Reaction Capabilities
This risk describes the absence of security logging, monitoring and incident response capability. Typical indicators include login attempts and commands that are never recorded, logs that are stored only on the device that may itself be compromised, and penetration tests that run for several days without generating a single alert. Dragos has reported that 45% of its service engagements identified a lack of visibility across OT networks.
The TRITON attack on safety instrumented systems at a petrochemical facility in 2017 was discovered after the malware caused an unplanned safety shutdown, rather than through detection of the intrusion itself. By contrast, when Norsk Hydro was affected by LockerGoga ransomware in March 2019, a prepared incident response allowed many of its plants to continue in manual operation while systems were restored.
Defensive implication: An organisation should establish whether it would detect an attack in its OT environment before such an attack occurs.
7. Broken Zones and Conduits Design
In the IEC 62443 series of standards, a zone is a group of systems that share the same security requirements, and a conduit is a controlled communication path between zones. When this design is absent, or has been bypassed over time, the network becomes what practitioners describe as a "flat" network. In a flat network, a single compromised laptop or server can communicate directly with the controllers that operate the physical process. Common causes include direct connections between corporate and control networks, firewall rules that have become too permissive over the years, and remote access connections added after the original design was approved.
Defensive implication: In a network without effective segmentation, the compromise of a single device can extend to the entire facility.
8. Missing Awareness
Security awareness in OT extends well beyond annual training sessions. It is reflected in four areas of an organisation:
- Procurement: Tenders for new systems frequently contain no security requirements, and security is not tested during factory or site acceptance testing.
- Operations: Operators are not always prepared to consider that an unexplained equipment fault may be the result of a cyber attack.
- Organisational culture: IT and OT teams may regard each other's priorities as obstacles rather than as shared objectives.
- Third parties: Contractors and vendor technicians often hold privileged access to systems while having received less security training than the facility's own employees.
During the TRITON attack, the physical keyswitch on the targeted Triconex safety controller had been left in program mode, which permitted changes to the controller logic. In late 2023, CISA advisory AA23-335A described actors affiliated with Iran's Islamic Revolutionary Guard Corps (IRGC), operating under the name "CyberAv3ngers", compromising internet-exposed Unitronics PLCs that were still configured with the manufacturer's default password.
Defensive implication: A security feature that is available but not used provides no protection.
9. Components and Protocols with Insufficient Security Capabilities
In this context, a legacy system is a system whose security capabilities do not meet current practice. Every long-established facility contains some legacy systems, and this is to be expected. The avoidable risk arises when legacy components and protocols are selected for new projects. Industrial protocols such as Modbus provide neither authentication nor integrity protection, so a malicious command cannot be distinguished from a legitimate one. The FrostyGoop malware used Modbus TCP commands against a district heating provider in Lviv, Ukraine, in January 2024, as described in our analysis of FrostyGoop and Fuxnet.
Defensive implication: This risk is addressed most effectively at the point of procurement. Once equipment has been commissioned, the risk can only be contained, not removed.
10. Missing Hardening
Hardening is the process of reducing the functions and interfaces available to an attacker. It includes disabling unnecessary services, closing unused network ports, deactivating USB and hardware debug interfaces, and removing default accounts. Hardening also provides time. A hardened system can more safely await a planned outage after a new vulnerability has been disclosed. The initial compromise in the Stuxnet case relied on removable media, and NotPetya spread most extensively in environments where segmentation and hardening were weakest.
Hardening is rarely a single activity. Systems that were hardened at commissioning frequently revert to default settings after vendor maintenance, a system rebuild or the replacement of a component.
Defensive implication: Hardening is effective only if it remains in place after each maintenance activity.
How the Risks Compound
Industrial cyber incidents rarely involve a single risk. A typical intrusion links several of the ten risks in sequence.
- Entry: The attacker gains access through an unused VPN account that is not protected by multi-factor authentication (risks 1 and 5).
- Exploitation: The attacker exploits a known vulnerability in a network appliance or an unsupported HMI (risks 2 and 9).
- Movement: The attacker moves through an unsegmented network toward the control systems (risk 7).
- Persistence: The attacker remains undetected because the OT environment has no security logging or network monitoring (risk 6).
- Impact: The attacker disrupts the physical process (risk 4).
Each step depends on the success of the step before it. When any single step is prevented, the attack path is interrupted.
Common Findings
In Beacon Security's assessment work across the oil and gas, power, chemical and manufacturing sectors, the following conditions are observed repeatedly:
- Undocumented remote access: Vendor VPN accounts and cellular modems installed during commissioning often remain active for years afterwards.
- Limited internal segmentation: A firewall separates the IT and OT networks, but there is little or no separation within the OT network itself.
- Shared and default credentials: Common operator accounts are used on HMIs, and default passwords remain in place on network equipment.
- Unused logging capability: Controllers and network switches support security logging, but the feature has not been enabled.
These findings do not reflect a lack of competence. The facilities concerned were built over several decades with reliability and safety as the primary objectives, long before security became a design requirement. What the teams operating them most often lack is the time, the specialist OT security expertise and a structured plan to close these gaps without disrupting production.
How Beacon Security Can Help
Understanding the OWASP OT Top 10 is the first step. The greater challenge is determining which of the ten risks apply to a particular facility, which should be addressed first, and how to address them without interrupting production. Beacon Security specialises exclusively in OT and industrial control system security, and this is the work we perform for our clients.
How We Work With You
- Discover: We establish an accurate picture of your environment, including the assets, remote access paths and network connections that are missing from existing documentation. Our methods are passive and are designed for use in operating facilities.
- Prioritise: We assess your facility against all ten risks and prioritise them according to their potential impact on your process, rather than according to generic severity scores.
- Remediate: We work alongside your engineers, system integrators and vendors to close the identified gaps within your planned outage windows.
- Sustain: We verify that corrective measures are in place, deliver role-based training to your personnel, and support monitoring and incident response so that the improvements are maintained.
What You Receive
- A clear assessment of your position: A facility scorecard against the OWASP OT Top 10, written so that both engineering teams and management can act on it.
- A practical roadmap: Prioritised actions scheduled around your production and outage calendar.
- Documented evidence: Findings and progress records suitable for presentation to your board, insurers, auditors and regulators.
- Continued support: OT security specialists who remain engaged with your team throughout remediation, rather than delivering a report and withdrawing.
Our services cover every stage of this work: risk assessment, vulnerability assessment, OT penetration testing, cybersecurity design, product security, OT SOC deployment, tabletop exercises and awareness training.
Next Steps
If you would like to understand where your facility stands against these ten risks, please use the Book a Free 15-Minute 1:1 Call button on this page. The call is free of charge and without obligation, and we will discuss which of the ten risks are most likely to be relevant to a facility such as yours.
This is a general awareness guide to the OWASP Operational Technology Top 10 and is not a substitute for an assessment of a specific environment.
