OT asset discovery ensures that organisations have a clear view of what’s actually running in their operational environments.
As operational technology (OT) systems become increasingly connected — integrating legacy equipment with modern control networks, IoT devices, and cloud interfaces — OT asset discovery is the essential first step in understanding and securing your operational systems, ensuring you know exactly what you’re protecting, where your risks lie, and how to prioritise improvements.
For many organisations, asset discovery is the logical starting point when it comes to implementing OT cyber security in manufacturing.
What is OT asset discovery?
OT asset discovery is the process of identifying, cataloguing, and understanding every device, system, and connection within an operational technology (OT) environment. It provides a comprehensive view of the assets that comprise your industrial network — from programmable logic controllers (PLCs) and human-machine interfaces (HMIs) to sensors, engineering workstations, and network switches.
The goal is to produce an accurate, up-to-date view of your entire OT landscape: what devices exist, how they connect, what software or firmware versions they run, and how critical they are to your operations.
Importantly, asset discovery is not just a list of equipment. It’s an informed map of how your operational systems interact, where dependencies exist, and where potential weaknesses could lead to disruption or security risk.
There are two main approaches to OT asset discovery:
- Passive discovery – observing network traffic to identify devices and their communication patterns without sending any active probes. This approach is safe for live operational environments and commonly used in industrial settings.
- Active discovery – actively querying devices to retrieve configuration and version data. This provides greater detail but can carry some risk of disruption if not handled carefully.
In most OT environments, a non-intrusive, passive-first approach is preferred to ensure production continuity.
Why OT asset discovery matters
Without a clear picture of your assets, you can’t effectively protect them. OT environments often evolve over decades — with equipment added, upgraded or reconfigured by different teams or vendors — and documentation rarely keeps pace. This creates blind spots that attackers can exploit and that make risk management difficult.
An OT asset discovery exercise addresses this by giving organisations complete visibility into their operational landscape. That visibility brings several key advantages:
- Informed protection: You can’t defend what you can’t see. Asset discovery reveals every device connected to your network — including those you may have forgotten about or never documented.
- Reduced risk: Unknown or unmanaged devices often represent the greatest vulnerabilities. Identifying them allows you to patch, isolate or replace them before they cause problems.
- Compliance and accountability: Directives such as NIS2 and other ICS security frameworks require organisations to demonstrate control and awareness of their assets.
- Faster response: Knowing what’s on your network allows for quicker containment and recovery in the event of an incident.
- Smarter investment: Understanding your environment helps prioritise cybersecurity budgets based on actual risk, not assumptions.
A surprising number of organisations discover devices they didn’t know were connected — often legacy systems running outdated firmware, or vendor-maintained machines using insecure remote connections. These are the blind spots that asset discovery brings to light.
How OT asset discovery is carried out
Every organisation’s environment is unique, but the overall process typically follows a consistent structure designed to maximise accuracy and minimise disruption.
1. Scoping the environment
The first step is to define what’s in scope. This means understanding your network boundaries, identifying which systems and sites to include, and clarifying the level of detail required. A well-defined scope ensures that discovery efforts focus on areas of operational importance.
2. Data collection
Engineers gather information using a combination of non-intrusive network monitoring, review of existing documentation, and, where necessary, site walkdowns or interviews with engineers.
Passive monitoring tools can identify devices by observing traffic patterns, while physical inspections help capture legacy or isolated systems that may not communicate over the main network.
To support this process, Harpoon works with leading OT visibility and threat detection platforms like Armis and Radiflow. These tools are purpose-built for industrial environments, allowing engineers to map assets, communication flows and vulnerabilities without disrupting live operations.
By combining these capabilities with on-site validation and expert analysis, Harpoon ensures asset discovery delivers both accuracy and context — not just a list of devices, but a complete understanding of how those devices interact and where potential risks lie.
3. Analysis
Collected data is correlated and analysed to build a complete picture of the environment. Devices are matched with known configurations, duplicates removed, and missing information filled in. The analysis may also highlight potential vulnerabilities such as unsupported firmware, insecure protocols, or open network paths between critical systems.
4. Validation
Findings are reviewed with operational teams to ensure accuracy. This step is important because operational reality doesn’t always match what’s on paper — validation ensures the asset inventory reflects what’s truly in place.
5. Reporting and recommendations
Finally, results are compiled into a clear, usable format. The report typically includes:
- An asset inventory – listing all identified devices with key details (type, firmware, connectivity, status).
- A network topology map – visualising how devices communicate and interconnect.
- A risk overview – highlighting outdated or vulnerable devices, insecure links, or configuration issues.
The report provides both a snapshot of your current environment and a set of recommendations for improving visibility and security.
What you receive from an asset discovery assessment
The deliverable from an asset discovery project is a clear, structured understanding of your operational environment. Most organisations receive three main outputs:
- Comprehensive OT asset inventory: a central record of all OT devices, with details on make, model, firmware, communication paths, and location.
- Network visibility map: a visual representation of the relationships between devices and systems — often the first time that stakeholders have seen their OT network illustrated this way.
- Risk insights: identification of potential vulnerabilities, unsupported systems, or unknown devices that require attention.
These outputs form the baseline for ongoing OT security management. Once this foundation is established, organisations can move confidently into structured risk assessment, network segmentation, and incident response planning.
How long it takes and what’s involved for you
The duration of an OT asset discovery project depends on the size and complexity of your environment, but for most small and medium-sized industrial organisations, the process typically takes two to four weeks from start to finish.
From the client’s side, the involvement is light. The process is designed to be non-disruptive and carried out alongside normal operations. You may need to coordinate limited access to sites or network information, but the bulk of the work is handled by the discovery team.
By the end of the engagement, you’ll have a clear, evidence-based picture of your OT landscape — delivered in a format that both technical and non-technical stakeholders can understand.
Where OT asset discovery fits in the wider security journey
OT asset discovery is the first step in building a strong, defensible cybersecurity position. It lays the groundwork for everything that follows.
A typical OT security improvement path looks like this:
- Asset discovery – establish visibility and identify all devices.
- Risk assessment – evaluate vulnerabilities and prioritise actions.
- Security implementation – apply network segmentation, access controls, and monitoring.
- Ongoing visibility and management – maintain asset awareness and adapt to changes.
Starting with asset discovery ensures that every subsequent action is based on verified data, not assumptions. Without this foundation, organisations risk investing in security measures that only cover part of the problem.
At Harpoon, Asset Discovery and Risk Assessment are incorporated into our DIAGNOSE services, which include OT risk assessments, compliance assessments, and an overall security health check.
Taking the first step towards operational technology security
In today’s connected industrial landscape, visibility is the cornerstone of security. OT asset discovery provides that visibility — revealing what’s in your environment, how it operates, and where your risks lie.
It’s a process that replaces uncertainty with clarity, helping organisations make informed, confident decisions about how to protect their operations.
For organisations at the start of their OT cybersecurity journey, Harpoon’s OT Risk Assessment provides a structured way to carry out asset discovery, validate the results, and translate them into a clear risk management plan.
