RE: https://infosec.exchange/@Secure_ICS_OT/117164260487837497 This is one of the problems in OT. The moment you peek under, it is outdated. Vendor cool-aid will only get you the pictured - overwhelming alerts and vulns. CVSS is useless, 20 exotic curl header leak CVE's are "critical" , default creds not surfaced. People fundamentally don't understand pentesting to think that a runaway packet will shut down the whole factory. IT doesn't inherently understand OT risk, but OT is not funded or have enough competent heads and hands to work through understanding their own risk.