Critical Vulnerabilities Persist in Industrial Systems for Over Three Years

• •Critical vulnerabilities in OT environments are typically over three years old and unresolved.
• •Industrial systems often have concurrent critical vulnerabilities in both OT and IT networks.
• •The difficulty in patching OT systems contributes to prolonged exposure to known risks.

Holm Security's Security Research team reported that critical vulnerabilities in operational technology (OT) environments have been publicly known for over three years and remain unresolved. These vulnerabilities are often not isolated; environments with active industrial vulnerabilities frequently also have critical or ransomware-exploitable vulnerabilities on their IT networks. The difficulty of patching OT systems, which cannot be taken offline easily, contributes to this prolonged exposure. The report highlights that while detection of these vulnerabilities is possible, the operational realities of industrial environments hinder timely remediation. This situation underscores the need for improved visibility and integrated management of both IT and OT risks. The findings indicate a significant risk to industrial environments, which are sensitive to disruptions and often manage serious exposures across both IT and OT domains.