Why the spreadsheet is always wrong
Industrial asset registers decay for structural reasons rather than through negligence. Equipment is replaced during an outage under time pressure and the paperwork follows later, or not at all. Integrators commission devices that were never in the original design. Vendors swap a module and the firmware version moves. Spare units go into service without being reassigned in any system.
The result is a register that is directionally useful and operationally unreliable, which is the worst combination, because it is trusted until it is tested. The devices missing from it are disproportionately the ones added in a hurry, and those are disproportionately the ones configured with defaults.
Passive fingerprinting: identifying a device that never answers
Active discovery, sending probes and reading responses, is the standard IT technique and is unsuitable here. Scans have knocked over production controllers, and in a safety context that is not a risk worth taking to populate a database.
Passive discovery instead identifies a device from the traffic it already generates. Signal fingerprints from several independent signals at once: TCP/IP stack behaviour, TLS client and server fingerprints in the form of JA3 and JA3S, the MAC address vendor prefix, protocol banners, and identity objects that industrial protocols expose in ordinary operation such as the CIP Identity object.
Combining several weak signals produces a confident identification without a single packet being sent to the device. Where more depth is genuinely needed, optional active OT polling exists, but it is opt-in, explicitly scoped, and never pointed at a safety controller.
- TCP/IP stack characteristics
- JA3 and JA3S TLS fingerprints
- MAC address vendor prefix
- Protocol banners and version strings
- Identity objects exposed by industrial protocols in normal operation
From identification to a device-of-record
Identification alone produces a list. What a security programme needs is a device-of-record: one authoritative entry per device that stays current on its own.
Each identified device carries live activity data, when it was last seen, which protocols it uses, which peers it communicates with, its current controller mode, and the most recent program and firmware hashes observed. Because this is derived continuously from traffic, the record ages with the estate rather than with the last audit.
Devices that appear on the network but are not yet in the managed inventory land in a discovered-but-unmanaged queue. That queue is one of the more useful artefacts the platform produces, because it is a running list of everything installed without going through a process.
The context an inventory cannot infer
Passive discovery establishes what a device is. It cannot establish what the device matters to, and that is the information prioritisation actually depends on.
Signal keeps a curated layer alongside the discovered record for exactly that: the business owner, the cost per hour when the asset is offline, the safety integrity level where the device performs a safety function, and the date of its last proof test. This is the data a maintenance system usually does not hold and an auditor invariably asks for.
It also feeds risk scoring directly. Two devices with identical vulnerabilities rank differently once one of them is known to stop a production line and the other is known to serve a meeting room display.
Where the inventory is consumed
The asset record is not a destination page, it is the join key for the rest of the platform. Vulnerability matching runs against the fingerprint. Risk scoring reads criticality from the curated layer. Network intelligence attributes conversations to identified devices. Integrity monitoring compares program and firmware hashes against the baseline held on the record. Compliance reporting evidences inventory completeness as a control in its own right, which several frameworks require explicitly.
This is why discovery comes first in the maturity sequence. Everything downstream degrades to guesswork without it.
Frequently asked questions
What is OT asset discovery?
The continuous identification of every device on an industrial network, including controllers, remote terminal units, HMIs, historians, engineering workstations and industrial IoT equipment, together with enough detail about each to support vulnerability matching and risk scoring.
Is passive asset discovery accurate enough?
Yes, because it combines several independent weak signals rather than relying on one. Stack behaviour, TLS fingerprints, MAC vendor prefix, protocol banners and identity objects exposed during normal operation together produce a confident identification without sending the device a packet.
Why not just scan the OT network?
Active scanning has caused outages on production control systems. Some controllers respond badly to unexpected traffic, and in a safety context the risk is not proportionate to the benefit of populating a database. Signal is passive by default; active polling is opt-in, scoped, and never aimed at a safety controller.
How long does it take to build a full inventory?
Devices appear as they communicate, so the common assets populate within hours of a sensor going live. Completeness depends on how often the quieter devices talk. Equipment that reports occasionally will take as long as its natural cycle, which is why discovery runs continuously rather than as a one-off exercise.
What is the difference between the discovered inventory and the CMDB layer?
The discovered inventory is what the network reveals: vendor, model, firmware, protocols, peers and activity. The curated layer holds what the network cannot reveal: business owner, cost per hour offline, safety integrity level and last proof test date. Prioritisation needs both.
How does asset discovery help with compliance?
Inventory completeness is an explicit control in several frameworks, including NERC CIP asset categorisation and the IEC 62443 system requirements. Because the inventory is derived continuously from observed traffic, it is evidence produced as a by-product of operations rather than assembled before an audit.
Part of the cluster
OT Cybersecurity
The pillar page for operational technology security.