OT and IoT vulnerability management with real world data - How good are companies at it?

Operational Technology (OT) and Internet of Things (IoT) infrastructures are increasingly converging, creating a complex threat landscape where cyber adversaries can exploit vulnerabilities at both industrial and consumer levels.

In this talk, we present research based on the unique anonymized vulnerability data sent by various organizations across the globe representing multiple sectors such as critical infrastructure, energy, manufacturing, transportation and more. By examining high-level trends and drilling down into sector- and country-specific data, we offer a holistic view of how vulnerabilities evolve across different environments — and what organizations can do to improve their vulnerability management.

Our findings reveal that

To assess broader impacts, we analyzed CVEs by industry, normalizing the results against the number of affected Common Platform Enumerations (CPEs). Interestingly, while critical vulnerabilities appeared at roughly a 20% rate across most sectors, certain verticals, particularly those involved in critical infrastructure, scored significantly above the 90th percentile for critical or easily exploitable CVEs.

A parallel country-level analysis revealed notable geographical patterns, signifying that economic, regulatory, or policy factors influence vulnerability disclosures and patch adoption rates. Finally, our trend analysis over time sheds light on the pace at which organizations apply patches once they become available.

Beyond severity scores, we also tracked Known Exploited Vulnerabilities (KEVs) mapped to MITRE ATT&CK tactics, noting that once threat actors actively target a CVE, patch uptake sometimes accelerates—but not always. By leveraging unique customer IDs, our data further reveals how long organizations take to update to non-vulnerable software versions, underscoring the significant variation in average remediation times. These differences emphasize the limitations of relying solely on CVSS for prioritization, especially where exploits are publicly available or where patches remain elusive.

In sharing these findings, we aim to equip attendees with actionable intelligence on emerging OT/IoT vulnerability patterns, highlight region- and sector-specific risk profiles, and propose practical strategies to improve cyber resilience. Participants will leave with a clearer understanding of how global CVE data and complementary risk frameworks can facilitate decision-making, from prioritizing patching for high-severity threats to implementing targeted trainings for their personnel.