OT Vulnerability Management: Prioritizing by Real Risk, Not Just CVSS

Run a vulnerability report on almost any industrial site and the result is the same: hundreds or thousands of known vulnerabilities, many rated high or critical. The patching constraints described in our OT patch management guide mean only a fraction can be fixed this year. The question is not how to fix everything. It is how to choose.

The problem with sorting by CVSS

The Common Vulnerability Scoring System (CVSS) gives every published vulnerability a base score from 0 to 10. It is useful, consistent and widely available, and it is often the only number on a report. But a base score describes the vulnerability in general. It does not know:

• whether attackers are actually exploiting it;
• whether the vulnerable system can be reached from where an attacker would be;
• how important that system is to your process and your safety;
• what controls already stand in the way.

A 9.8 on a controller deep inside a well-segmented zone, with no path from outside, may matter less this month than a 7.8 on an engineering workstation that vendors reach over remote access every week.

Better signals for prioritizing

Known exploitation

The US Cybersecurity and Infrastructure Security Agency (CISA) maintains the Known Exploited Vulnerabilities (KEV) catalog: vulnerabilities with evidence of exploitation in the wild. A vulnerability on that list deserves attention, whatever its score.

Likelihood of exploitation

The Exploit Prediction Scoring System (EPSS), published by FIRST, estimates the probability that a vulnerability will be exploited in the near future. It helps separate the vulnerabilities attackers are likely to use from the long tail they are not.

Industrial advisories

CISA publishes ICS advisories for industrial products, and control system vendors publish their own security notices. They often include product-specific mitigations that are easier to apply than a patch.

Reachability

Where does the vulnerable asset sit, and what can reach it? An asset in a zone with tightly controlled conduits, as described in the Purdue model explained, is harder to attack than one on a flat network or one exposed through remote access.

Asset criticality

What happens if this asset is compromised or fails? Engineering workstations, domain controllers and systems that bridge zones are high-value targets because they lead to everything else. Safety systems carry the highest consequences.

Compensating controls

Hardening, restricted services and application allowlisting can reduce the exploitability of a vulnerability that cannot be patched yet.

A practical workflow

1. Inventory software and firmware. Know exactly what is installed on every endpoint and network device. An asset inventory built with native, agentless collection gives you versions without probing fragile devices.
2. Match versions to vulnerabilities. Combine the inventory with vulnerability data and vendor advisories to list the CVEs that actually apply.
3. Add context. For each finding, record known exploitation, reachability, asset criticality and existing controls.
4. Decide per vulnerability. Patch at the next window, mitigate now and patch later, or accept and monitor, with the reasoning written down.
5. Track to closure. Follow every decision until the fix is applied or the mitigation verified, and report progress to engineers and leadership.
6. Repeat continuously. New vulnerabilities are published every day, and your environment changes too.

Views that help

Two views of the same data answer different questions. A software view groups findings by product and CVE, which tells you where a single update fixes many systems. An asset view groups them by system, which tells you which machines carry the most risk and should be hardened, isolated or replaced first. Both should let you drill into any CVE to see what it means for your systems.

How Novaigu helps

Mission Guard’s vulnerability management finds vulnerable software across your environment and the CVEs behind it, without probing systems directly. It shows vulnerabilities by criticality and by asset, explains each CVE, and its risk and threat mitigation module weighs hardware lifecycle, network architecture, configuration gaps and vulnerable software together, so remediation is prioritized by compliance, security lifecycle and maturity level. Mission Control aggregates the picture across every site.