In-house vs External OT Asset Discovery

OT asset discovery is the process of identifying and understanding the industrial devices, systems, and connections operating within an operational technology (OT) environment. This includes control systems, networked equipment, and supporting infrastructure that directly or indirectly influences physical processes.

One of the earliest decisions organisations face is whether OT asset discovery should be handled internally, delivered by an external specialist, or shared between the two. Each approach has strengths and limitations that are important to understand before work begins.

What in-house teams can realistically deliver

Internal OT, IT, or engineering teams usually have strong contextual knowledge of their environment. They often understand how systems are supposed to operate, which equipment is critical to production, and where legacy systems are located.

In many real environments, internal teams are well placed to:

• Identify known assets and major systems
• Interpret operational importance and production dependencies
• Validate findings against lived operational reality
• Maintain asset information once it exists

However, OT asset discovery is not only about recognising familiar equipment. It also involves detecting undocumented devices, understanding network-level behaviour, and identifying indirect exposures that are not visible through diagrams or inventories alone.

Practical limits of internal discovery

Internal teams typically face constraints that affect the depth and reliability of discovery work.

Common limitations include:

• Limited time to perform structured discovery alongside operational duties
• Incomplete visibility across segmented or historically grown networks
• Reliance on existing documentation that may be outdated or inaccurate
• Lack of specialist tooling designed for OT-safe discovery

In operational environments that have evolved over many years, it is common to find assets that are assumed to be decommissioned, isolated, or insignificant, but which are still active on the network.

Risks associated with DIY OT asset discovery

Attempting discovery without specialist methods or tooling can introduce risk, even when intentions are sound.

Typical risks include:

• Use of active scanning techniques that disrupt fragile devices
• Incomplete discovery that creates a false sense of visibility
• Misclassification of assets or protocols due to limited OT protocol awareness
• Overlooking indirect connections such as remote access paths or engineering laptops

In practice, partial discovery is often more problematic than no discovery at all, because decisions may be made on the assumption that visibility is complete when it is not.

Where external specialist support adds value

External OT specialists typically bring structured methodologies, purpose-built tooling, and experience across multiple environments.

Specialist-led discovery can help by:

• Safely identifying assets using passive or OT-aware techniques
• Revealing devices and communications not visible through documentation
• Providing consistent classification and context across sites or networks
• Delivering repeatable outputs that support security and operational planning

Across many industrial environments, it is often observed that the first independent discovery exercise identifies assets or connections that were not previously known, even in well-managed sites.

Hybrid delivery models

For many organisations, the most effective approach is not purely internal or external, but a hybrid model.

A hybrid approach typically involves:

• External specialists performing structured, low-risk discovery
• Internal teams validating findings and providing operational context
• Joint agreement on asset classification and criticality
• Internal ownership of the asset inventory once established

This model allows organisations to benefit from specialist capability while retaining control and understanding internally. It also supports knowledge transfer, making future visibility efforts more sustainable.

Choosing the right approach

The right delivery model depends on factors such as:

• Size and complexity of the OT environment
• Age and diversity of installed systems
• Availability of internal OT and network expertise
• Risk tolerance for disruption or blind spots

OT asset discovery is a foundational activity. Decisions made at this stage influence every subsequent security, resilience, and compliance effort. Clarity on capabilities and limits is therefore more important than speed or convenience.

All OT Asset Discovery Articles