OT Asset Inventory: How to Build One Without Agents, SPANs or TAPs

Ask any OT security team where their program started, and most will say the same thing: the asset inventory. It is not glamorous work, but nothing else holds without it. Segmentation needs to know what lives in each zone. Vulnerability management needs firmware and software versions. Incident response needs to know which systems are critical and who owns them.

Yet many sites still rely on a spreadsheet built for a project years ago, a few engineering drawings and the memory of the people who commissioned the plant.

What a useful OT inventory contains

An inventory that supports security goes well beyond a list of IP addresses. For each asset, aim to record:

• Identity: hostname, IP and MAC addresses, asset tag.
• Hardware: vendor, model, serial number, modules and cards.
• Software: operating system or firmware version, installed applications, services and running processes.
• Configuration: security-relevant settings, accounts, open ports, enabled protocols.
• Network position: segment, VLAN, Purdue level and the devices it connects to.
• Ownership and role: site, line or process, responsible team, business function.
• Criticality: what happens to production or safety if it fails or is compromised.
• Lifecycle: in service, end of support, scheduled for replacement or decommissioned.

Our earlier article, asking the right questions about asset inventory, explains why each of these matters.

Four ways to build an OT inventory

Passive network monitoring

Sensors receive a copy of network traffic from SPAN ports or network TAPs and identify devices from what they say. Passive monitoring never sends a packet to an industrial device, which makes it safe, and it reveals communication patterns.

Its limits are practical. It only sees devices that talk across a monitored link while the sensor is listening, so quiet or isolated devices are missed. It needs SPAN ports or TAPs at many points in the network, plus sensors and the cabling to them, at every site. And traffic alone rarely reveals full configuration, installed software or patch levels.

Active scanning

Sending probes to discover devices and query them directly. Generic IT scanners are a real risk in OT: some industrial devices crash or behave unpredictably when scanned aggressively. Active techniques built for OT, which use the native protocols devices already speak and keep load low, are much safer, but still need care and scheduling.

Agents

Software installed on each endpoint that reports back. Agents give deep detail on Windows and Linux machines, but many OT assets cannot run them: controllers, network devices and certified systems where vendors do not allow new software.

Agentless native collection

Querying assets with the interfaces and credentials they already support, and reading configurations directly from endpoints and network devices. It needs no software on the assets and no SPANs, TAPs or sensors on the network. It gathers what traffic cannot show: configuration, installed software, services, patches, users and hardware health. For systems with no network connection at all, collection can be done offline, for example with a USB collector.

Most mature programs combine methods. The question is which one does the heavy lifting, and what it costs to deploy and maintain at every site.

A practical plan

1. Gather what you already know. Engineering drawings, network diagrams, vendor documentation, previous project lists. They will be incomplete, but they show what to look for.
2. Agree on the fields and the owner. Decide what the inventory must contain and who keeps it current at each site.
3. Collect safely. Choose collection methods your engineers trust, start with a pilot zone and run during agreed windows.
4. Reconcile. Compare what you found with what you expected. Unknown devices, unexpected connections and unsupported operating systems are often the first findings.
5. Classify. Assign each asset a level, a zone, an owner and a criticality rating, and organize them by use and function.
6. Keep it current. Re-collect on a schedule and after every change, and track each asset from acquisition to decommissioning.

What a good inventory unlocks

With an accurate inventory, the next steps become concrete. Segmentation projects can start from the real network instead of the intended one, as described in the Purdue model explained. Vulnerability management can match software versions against known CVEs and prioritize by real risk. Hardening can compare every configuration against a benchmark. And compliance evidence for frameworks like IEC 62443 and NERC CIP comes from the same data.

How Novaigu helps

Mission Guard builds the inventory with agentless, native collection: no SPANs, TAPs, sensors or agents, and no changes to your network design. It records hardware, software, configuration, services and running processes for every endpoint and network device, maps each asset to its network segment and Purdue level, and tracks it from acquisition to decommissioning. Standalone systems are covered with a USB collector. In one of our case studies, newly connected assets were discovered as soon as they came online.