5.02Critical infrastructure
OT Penetration Testing & Red Team
Tiered testing of industrial environments – from vulnerability assessment to adversary emulation mapped to MITRE ATT&CK for ICS – with rules of engagement written for live processes and a replica lab for anything that cannot be tested in production.
OT is tested in tiers, and the tier is agreed before anything touches a network: vulnerability assessment of Level 3 and DMZ systems, penetration testing of conduits and engineering access, and red-team emulation of a named adversary. Safety-instrumented systems and Level 0–1 devices are out of scope in production. Where a controller must be tested, we test a spare unit or a replica in our lab.
The rules of engagement follow the ACI EUROPE guideline for OT penetration testing at airports: passive analysis before anything invasive, white-box or hybrid, no fully automated tools against control networks, testing in agreed windows with the operator present and a stop condition for any alarm. We retest fixes within 90 days.
We bring our own toolset: passive capture and asset discovery, protocol-aware test harnesses for Modbus/TCP, DNP3, IEC 60870-5-104, IEC 61850, OPC UA, PROFINET, S7comm, EtherNet/IP and BACnet, a hardware bench for JTAG, UART and SPI access and firmware extraction, software-defined radio for wireless and GNSS-dependent equipment, and an isolated replica lab. Every technique is mapped to MITRE ATT&CK for ICS so your blue team can test detection step by step.
- ATT&CK for ICS
- every technique mapped for detection engineering
- Level 0–1
- never tested in production – spares or the replica lab
- NATO CCDCOE
- two specialists qualified in Critical Information Infrastructure Protection
Where we work in the Purdue model
The tier is agreed level by level before anything touches a network. The closer to the physical process, the less is ever tested live.
- Actively tested
- Passive capture and configuration review
- Spares, replica lab or bench only
- Out of scope
Enterprise zone · IT
- 5
Enterprise network
Corporate IT, identity, email, cloud and internet access
Actively tested
Red-team starting point: phishing, exposed services, stolen vendor credentials.
- 4
Site business systems
ERP, scheduling, logistics and site IT
Actively tested
Pivot paths from site IT and business systems towards the industrial DMZ.
Industrial DMZ
- 3.5
Industrial DMZ
Jump hosts, remote-access gateways, patch servers, historian replicas
Actively tested
Firewalls, jump hosts and vendor remote access attacked as the way into OT.
Industrial zone · OT
- 3
Site operations
Historians, MES, OT domain controllers, engineering workstations
Actively tested
Engineering workstations, historians and the OT domain at the agreed tier, in agreed windows.
- 2
Supervisory control
SCADA servers, HMIs, alarm and operator stations
Spares, replica lab or bench only
SCADA and HMI testing on spares or in the replica lab; live stations only observed.
- 1
Basic control
PLCs, RTUs and IEDs; safety systems sit in a zone of their own
Spares, replica lab or bench only
Protocol, firmware and configuration testing of controllers on spares or in the replica lab.
- 0
Physical process
Sensors, actuators, drives and valves
Out of scope
Never touched; any process alarm stops the whole test.
How it works
- 01
Rules of engagement
Tier, zones, windows, stop conditions and the list of systems that are never touched, signed by the operator.
- 02
Reconnaissance
Passive capture and review of the paths from the office network and the internet into OT.
- 03
Conduit testing
Firewalls, jump hosts, remote access and engineering workstations, at the agreed tier.
- 04
Controller & HMI testing
Protocol, firmware and configuration testing on spares or in the replica lab.
- 05
Emulation & detection
Adversary emulation against agreed objectives while the SOC measures what it sees.
- 06
Reporting & retest
Findings with process impact and ATT&CK for ICS mapping; fixes verified within 90 days.
Packages
- Conduit Test
- Penetration test of the IT/OT boundary, remote access and engineering access for one site.
- Site PentestPopular
- Full tiered test of one site, including controller and HMI testing on spares or in the replica lab.
- OT Red Team
- Multi-week adversary emulation against agreed objectives with detection validation.
Supported by our own threat-intelligence platform
Two of our platform products extend the test into the months after it.
Frequently asked questions
What clients in your sector say
From organisations in the same sector.
Manufacturing“Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience.”
Oskars Podziņš
Head of Information Security · Printful
Manufacturing“They found holes me and my IT team were astonished to hear about. They worked from the heart and in high quality.”
Andzejs Stenclavs
Kinetics
Manufacturing“OffSeq ran a black-box audit that showed us exactly where we stood – no sugarcoating, just an honest picture from a real attacker’s perspective.”
Ivo Petrovskis
Network & Security Administrator · Livonia Print
All services
OT & ICS Security Assessment
Know how an attacker would reach your control systems, and what NIS2 and IEC 62443 expect you to prove.
Industrial Product & Embedded Security
Test the controller, gateway or device before the certifier, the regulator or an attacker does.
Maritime & Port Cybersecurity
Port and vessel testing that satisfies the port inspector, the class society and the ISM auditor.
Scope a test
[email protected]+371 2256 5353
Direct access to a senior specialist · Reply within 24 hours · NDA available on request