OT Security Audits: The Complete Guide to Reviewing a Connected Estate

Contents

1. Ten years is a long time in a comms cabinet
2. What the threat looked like in 2016, and what it looks like now
3. Why we weren’t more careful
4. What an OT security audit is, and what it isn’t
5. Where connected devices are exposed, cellular or broadband
6. The eight layers of an audit: what to look for
7. How to run the audit, step by step
8. The site walk
9. Prioritising what you find
10. The OT security audit checklist
11. Know your hardware and SIM provider
12. What a 2026 installation should look like
13. Why spending now saves money later
14. Tools for the job
15. The best free resources
16. Who should do the audit
17. Frequently asked questions

Ten years is a long time in a comms cabinet

Picture a fairly typical remote site commissioned in 2016. A pumping station, a car park, a telemetry outstation, a row of CCTV cameras on a building site that became permanent. The installer fits a 3G router, pops in a single-network SIM, and because the customer wants to log in from the office, puts it on a public IP. Either it’s a fixed IP SIM, or it’s a consumer SIM on an APN that happened to hand out a public address back then. A couple of port forwards go in so the camera recorder and the PLC can be reached from outside. The router’s web interface is left open on the WAN “for support”. The password is the default, or the company password every engineer has used since 2009. Job signed off.

Fast forward to today. The router is still there. It’s been powered on for ten years, which is a testament to the hardware. It’s never had a firmware update, because nobody has logged into it since the day it went in. The manufacturer stopped supporting that model years ago. The SIM is still on the same network and the same tariff, because nobody wanted to send a van to swap it. The installer has moved on, and the only record of the setup is a spreadsheet on somebody’s old laptop.

I’ve seen hundreds of these. I’ve probably installed a few of them myself. The recent supermarket freezer attacks are a reminder of what happens when installations like that are found by the wrong people. Which is why I think every organisation with connected kit in the field needs to do a proper OT security audit, and why the starting point is understanding how much has changed in ten years.

What the threat looked like in 2016, and what it looks like now

To be fair to the 2016 installer, the world looked different. In October 2016 the Mirai botnet hijacked hundreds of thousands of internet-connected cameras, recorders and home routers, and used them to knock major websites offline through an attack on DNS provider Dyn. The striking thing about Mirai was how simple it was. It worked through a short list of around 60 default usernames and passwords. It didn’t need clever exploits, because so many devices were sitting on the internet with the factory login unchanged.

Even then, most people’s mental model of the risk was “someone might use my camera in a botnet” or “someone might run up my data bill”. Annoying, but not dangerous. The idea that anybody would deliberately target a refrigeration controller, a pumping station or a car park barrier felt far-fetched. Security through obscurity was the default plan, and for a while it more or less worked.

Four things have really changed:

• Finding you is trivial. Search engines like Shodan continuously index internet-facing devices by make, model and firmware. An exposed device is typically found and probed within hours of going live.
• Vulnerabilities are published, with maps. Every disclosure tells attackers which versions to look for. Teltonika’s recent CVE-2026-82104 is a good example: fixed in current firmware, but only for people who actually update.
• Attackers now go after the physical outcome. The freezer attacks weren’t about data. They were about turning things off, heating things up and costing businesses tens of millions of euros in a night.
• Regulation has caught up. The EU Cyber Resilience Act and sector rules for critical infrastructure mean “we didn’t know it was there” is no longer a defence anyone wants to try.

Why we weren’t more careful

I don’t think the people who built the 2016 estate were negligent. They were working with the incentives they had. Kit was sold on price and the cheapest tender won. Contracts paid for installation, not for ten years of maintenance. SIMs were bought as a commodity, often from whoever was cheapest per megabyte. The customer wanted remote access and the quickest way to give it to them was a public IP and a port forward. And once a site worked, nobody had a reason to touch it.

Underneath all of that was the OT mindset. The kit was seen as plant, not as a computer, so it didn’t get the IT treatment of updates, monitoring and replacement cycles. I’ve written about that gap in OT vs IT: what’s the difference and why it matters. The short version is that nobody owned the security of these devices, so nobody did it.

There’s one more reason, and it’s the uncomfortable one. Nothing bad happened. Ten years of a site quietly working builds confidence that it’s fine. But “it hasn’t been attacked” and “it can’t be attacked” are very different statements, and most estates have only ever proved the first.

What an OT security audit is, and what it isn’t

An OT security audit is a structured review of every connected device you’re responsible for in the field, to answer four questions:

1. What have we got? Every device, where it is, what it does, and how it connects.
2. How exposed is it? Who and what can reach it, from where, and with what credentials.
3. Is it still supported? Firmware status, vendor support dates, dependence on networks that are going away.
4. Would we know if something went wrong? Monitoring, alerting, logging and the ability to recover.

It isn’t a penetration test, although a pen test can be a useful follow-up for your most critical sites. It isn’t a certification exercise, although it will make Cyber Essentials or an IEC 62443 programme much easier. And it definitely isn’t a one-off. The point is to end up with an asset register you trust and a process that keeps it true.

Done well, an audit pays for itself in ways that have nothing to do with attackers. You’ll find SIMs you’re paying for that aren’t in anything, sites on the wrong tariff, routers that reboot every night because of a signal problem, and devices you thought had been decommissioned years ago.

Where connected devices are exposed, cellular or broadband

None of this is unique to cellular. A building management system on the office broadband, a camera recorder on a business fibre line and a telemetry router on a 4G SIM can all be exposed in the same ways. These are the routes I see most often:

The common thread is that most of these weren’t decisions. They were defaults, shortcuts and leftovers. That’s exactly why they need finding deliberately.

The eight layers of an audit: what to look for

I find it easiest to work through an estate in layers, from the box on the wall out to the contracts behind it. Each layer has its own questions and its own common findings.

1. Devices and inventory

You can’t secure what you don’t know about. Every router, gateway, modem, controller, camera recorder, sensor hub and BMS controller that talks to anything belongs on the register, with its location, function, owner and criticality. CISA’s 2025 joint guidance on OT asset inventory, produced with international partners including the UK, is a good model: start with the most critical assets, record what they talk to, and expand until the list is complete.

Common findings: devices nobody knew about, devices that were supposed to have been removed, and SIMs active in kit that no longer exists.

2. Firmware and support status

For every device: the current firmware version, the latest available version, and the vendor’s end of support date. Check whether the model has been announced end of life. The RUTX series is a good example of a popular router range that’s now on its countdown, with security fixes ending in 2029 and critical fixes in 2032.

Common findings: firmware several years old, devices that can’t take current firmware, and models whose support ended long ago.

3. Internet exposure

What can the outside world see? Look up every public IP you own on Shodan or Censys, and check whether any management pages, remote desktop services, industrial protocols or camera interfaces respond. If your estate is large, set up continuous monitoring rather than a one-off look. I’ve shown how to build an exposure monitoring platform for £5 a month.

Common findings: router admin pages, camera recorder logins and occasionally a PLC or HMI, all sat on the public internet.

4. Connectivity and SIMs

For each site: which network, which SIM provider, single or multi-network, public or private IP, which APN, and what radio technology it depends on. UK 3G has now gone and 2G is due to be phased out by 2033, so any device that still relies on either is on borrowed time. Check whether your SIM provider offers private APNs, IMEI locking and usage alerts, and whether you’re using them.

Common findings: public IP SIMs where none is needed, 2G or 3G-dependent kit, single-network SIMs in poor-coverage sites, and no alerts on unusual data use.

5. Access and identity

List every way into every device: local admin accounts, VPNs, port forwards, cloud portals, vendor remote support, management platforms. For each, who has the credentials? Are they unique per device? Is there multi-factor authentication on the platforms that control the fleet? When did you last remove a leaver?

Common findings: one password across the whole estate, accounts belonging to people who left years ago, and contractors with permanent access they no longer need.

6. Network design and segmentation

Is OT separated from office IT and guest Wi-Fi? Can a compromised camera reach the PLC? Are firewall rules documented and as narrow as they can be? The cellular router security hardening guide covers the router side, and for sites with industrial protocols it’s worth reading about OT deep packet inspection on cellular routers.

Common findings: flat networks, “allow any” rules added during commissioning and never removed, and UPnP left on.

7. Monitoring, logging and recovery

Would you know if a setpoint changed at 4am, a router rebooted into a different config, or a device started sending data somewhere new? Are logs kept anywhere off the device? Could you restore a site from a known-good configuration? Auditing device network traffic gives you a baseline of normal, and OT backup and recovery covers the restore side.

Common findings: no alerting beyond “site offline”, no config backups, and logs that are lost every time the device reboots.

8. Suppliers, contracts and documentation

Who supports each part of each site? Does the maintenance contract cover firmware updates and security advisories, or just “keeping it working”? Is there as-built documentation for every site, and is it current? Does anyone get the manufacturer’s security notifications?

Common findings: contracts that never mention security, no single owner, and documentation that stopped at handover.

How to run the audit, step by step

An OT security audit doesn’t need to start with an expensive consultancy. It needs to start with an honest list. Here’s the process I’d follow:

1. Agree scope and owner. Decide which sites, which device types and who is accountable for the result. Without a named owner the audit becomes a report nobody acts on.
2. Build the inventory from records. Pull together your SIM provider’s records, broadband contracts, installer handover documents, purchase records and any management platform you already use. The SIM portal is often the best map you have, because every active SIM is a connected device somewhere.
3. Look from the outside. Check every public IP and hostname for exposed services before you visit anything. This tells you where the urgent problems are.
4. Collect device detail remotely where you can. Firmware versions, configuration exports, user lists and firewall rules, through the management platform or a secure remote session.
5. Walk the sites that matter. Visit critical sites and a sample of the rest. Confirm what’s really there, and check physical security.
6. Check support status. Match every model and firmware version against the vendor’s end of life notices and security advisories.
7. Score and prioritise. Use the method below to sort findings into fix now, fix soon and plan.
8. Fix the urgent things immediately. Close internet exposure and change shared passwords straight away. Don’t wait for the report.
9. Write it up and plan the rest. Produce a register, a findings list and a costed remediation plan.
10. Make it repeatable. Re-run the exposure checks monthly, the full audit yearly, and add every new install to the register on the day it goes live.

The site walk

Remote checks will tell you most of what you need, but there’s no substitute for opening the cabinet. On a site visit I’d look for:

• Is the kit in the cabinet what the records say is there?
• Any devices nobody mentioned: an extra router, a consumer broadband box, a 4G dongle in a USB port.
• Passwords written on labels, stickers or the inside of the door.
• Cabinet locks, tamper switches and whether anyone gets an alert if it’s opened.
• Exposed console, serial or USB ports, and whether they’re needed.
• SIM tray security. A SIM that can be removed in seconds is a SIM that can be used elsewhere.
• Antenna and cable condition, and signal quality. A router that keeps dropping and rebooting is a resilience problem as well as a security one.
• Power and UPS. If the kit goes down every time the power blips, the monitoring goes down with it.
• Network cabling. Is anything plugged into the same switch that shouldn’t be?

Prioritising what you find

Most estates produce a long list of findings, and trying to fix everything at once usually means fixing nothing. I’d score each site on two things: how exposed it is, and what happens if it’s compromised. Then work through it like this:

A known exploited vulnerability is one that attackers are actually using, not just one that exists. CISA’s Known Exploited Vulnerabilities catalogue is the best public list, and anything on it that affects your kit goes straight to the top.

The OT security audit checklist

Use this as a working checklist for each site or each device type. If you can’t tick an item, that’s a finding.

Inventory

• Every connected device is on a single asset register
• Each entry has location, function, owner and criticality
• Every active SIM and broadband line is matched to a device
• Unused SIMs and lines have been cancelled
• New installs are added to the register on the day they go live

Firmware and lifecycle

• Current firmware version recorded for every device
• Firmware is the latest stable release, or there’s a documented reason it isn’t
• Vendor end of sale and end of support dates recorded
• No device is past its security support date without a plan
• Someone receives the manufacturer’s security advisories

Internet exposure

• No device admin interface is reachable from the internet
• No industrial protocol (Modbus, BACnet, DNP3 and so on) is reachable from the internet
• Every port forward is documented, justified and restricted to known source addresses
• UPnP is disabled
• Public IPs are checked regularly against Shodan or similar

Connectivity and SIMs

• Devices use a private APN or outbound VPN unless a public IP is genuinely needed
• Public IP sites follow a hardening standard
• SIMs are locked to their device (IMEI lock) where the provider supports it
• Alerts are set for unusual data usage
• No device depends on 2G or 3G without a migration plan
• Critical sites have network resilience (multi-network SIM, dual SIM or a second bearer)

Access and identity

• No default passwords anywhere
• Passwords are unique per device and stored in a password manager
• Named accounts rather than shared logins wherever possible
• Multi-factor authentication on every management platform and cloud portal
• Leavers and old contractors have been removed
• Third-party and vendor access is time-limited and logged

Network and configuration

• OT is separated from office IT and guest Wi-Fi
• Firewall rules are documented and as narrow as possible
• Unused services (Telnet, plain HTTP, old VPN types, default SNMP) are disabled
• Configurations are backed up off the device
• Configuration changes are recorded

Monitoring and recovery

• Alerts for device offline, reboot and configuration change
• Logs are sent somewhere off the device
• There’s a baseline of normal traffic for critical devices
• A site can be restored from a known-good configuration
• There’s a plan for what to do if a device is compromised

Physical

• Cabinets are locked, with tamper alerts on critical sites
• No credentials written on or near the kit
• Unused console, serial and USB ports are disabled or blocked
• Power and UPS are adequate for the site’s role

Suppliers and governance

• There’s a named owner for OT security
• Maintenance contracts cover firmware updates and security advisories
• Hardware suppliers publish end of life and security support policies
• The SIM provider can support private APN, locking and remote switching
• As-built documentation exists for every site and is current
• The audit is scheduled to repeat

Know your hardware and SIM provider

One of the biggest differences between a well-run estate and a messy one isn’t the technology. It’s the relationships behind it. If you bought your routers on price from whoever had stock and your SIMs from whoever was cheapest per gigabyte, you’ll have nobody to ask when something goes wrong, and nobody telling you when something is about to.

When you’re choosing or reviewing suppliers, these are the questions I’d ask.

Hardware supplier and manufacturer:

• Is there a published end of life and security support policy, with dates?
• How often is firmware released, and how are security advisories communicated?
• Is the model I’m buying current, or already announced end of life?
• Can the devices be managed centrally, or is it one login at a time?
• Will you tell me when an advisory affects kit you’ve sold me?

SIM provider:

• Can you give me a private APN, so devices aren’t on the public internet at all?
• If I need fixed or public IPs, how are they protected? (See securing a public IP cellular router and what a fixed IP SIM card is.)
• Do you offer SIM or IMEI locking, and alerts on unusual data use?
• Is the SIM single-network or multi-network, and what happens if coverage changes?
• If I want to leave, how hard is it? Can profiles be switched remotely, or does every site need a visit?

Installer or maintainer:

• Will you hand over full as-built documentation and credentials, stored securely?
• Does your contract include firmware updates and responding to advisories?
• How do you access our sites remotely, and can we see and revoke that access?

A good supplier will be glad you asked. One that can’t answer is telling you something useful too.

What a 2026 installation should look like

The good news is that most of the 2016 problems now have practical, affordable fixes. If I were installing the same site today, I’d want four things.

A current router with a published support life

Buy models early in their life, from manufacturers that publish end of life and security support dates. The support clock usually starts when production stops, not when you buy, so a model already announced end of life gives you far less supported time for the same money.

An SGP.32 eSIM

The SGP.32 standard lets an IoT device’s connectivity profile be downloaded, switched and replaced remotely, without anybody visiting the site. It’s managed through an eSIM IoT Manager (eIM) platform talking to an agent on the device. That fixes two of the biggest 2016 headaches in one go. You’re no longer locked to one provider for the life of the device, and you’re no longer stuck if a network changes its coverage, technology or pricing. Switching suppliers stops being a project involving vans and becomes an operation on a platform.

Two honest caveats. The device needs to support SGP.32, so it isn’t something you can retrofit to the 2016 router. And which operator profiles are available depends on the commercial arrangements of your provider. I’ve covered the buying side in you don’t buy SGP.32. There’s much more depth on the standard at sgp32.co.uk and on the eIM at esimiotmanager.com.

No inbound exposure

Private APN or an outbound VPN by default, router admin never on the WAN, and a public IP only where there’s a genuine reason, done properly. The options are laid out in port forwarding, public IP, private APN and overlay VPN explained.

Proper fleet management

A remote management platform such as Teltonika’s RMS changes the economics completely. You can see every router, push firmware updates across the estate, back up and roll out configurations, and get alerts when something changes. Crucially, because the router connects out to the platform, you can reach it remotely without a public or fixed IP. It works on dynamic addresses and behind carrier-grade NAT, which matters more every year as networks stop handing out public IPs. I’ve gone through how it’s licensed in RMS credits explained.

One word of warning. A fleet management platform is a single place from which every device can be controlled, so treat it like the crown jewels: multi-factor authentication on every account, named users with only the permissions they need, and regular reviews of who has access. Used properly it’s the best security tool in the estate. Left with a shared login, it’s the biggest risk in it.

Why spending now saves money later

I understand the objection. The 2016 router still works, so why spend money replacing it? Because the costs of the old approach are real. They’re just hidden until they arrive all at once.

A simple test: take the cost of one site visit, multiply it by the number of sites you have, and ask how many times in the next ten years you might need to visit all of them. A provider change, a network switch-off, a critical firmware fix. Then compare that with the cost of doing it remotely.

And that’s before you get to the cost of an incident. One night of lost stock across French supermarkets is being counted in tens of millions of euros. Against that, a router upgrade and a management licence look cheap.

Tools for the job

You don’t need a big budget to run a solid first audit. Most of what you need is free or already in your hands.

The best free resources

There’s a lot of OT security material out there, much of it written to sell something. These are the ones I’d actually point people to.

Who should do the audit

For most organisations I’d start in-house, with whoever knows the estate best, working alongside IT. The first pass is mostly about gathering information you already own: SIM records, contracts, router lists and site knowledge. You don’t need a consultant to tell you there’s a public IP SIM in the pumping station.

Bring in outside help when:

• The estate is large, critical, or regulated, and you need an independent view.
• You need certification, or evidence for customers, insurers or regulators.
• You want penetration testing of critical sites, which should always be done by specialists who understand OT.
• Nobody in-house has the time, which is the honest reason most audits never happen.

Your hardware supplier, SIM provider and installer should all be part of the conversation. If they’re good, they’ll help you build the register and fix what you find. If they’re not, the audit will make that very clear.

Frequently asked questions

How often should we audit our connected estate?

A full audit once a year, external exposure checks at least monthly or continuously, and a review whenever a major advisory affects your kit. New installs should be added to the register on the day they go live.

We only have a handful of sites. Is this worth it?

Yes. A small estate takes a day or two to audit, and the most common findings, like an admin page on the internet or a default password, are just as dangerous on one site as on a thousand.

Does this apply to broadband-connected kit as well as cellular?

Absolutely. The exposure routes are the same. Broadband sites often have more risk, because consumer-grade routers with UPnP and port forwards are common on business premises.

Can we just put everything behind a private APN and forget about it?

A private APN removes direct internet exposure, which is a big step. But devices still need updating, credentials still need managing, and anything with access to the private network can still reach them. It reduces risk, it doesn’t remove the need for an audit.

Can our existing routers use SGP.32?

Only if the hardware and its eSIM support it. Most routers installed before the last couple of years won’t. Plan SGP.32 into replacement cycles rather than expecting to retrofit it.

Is a fleet management platform a security risk in itself?

It can be, because it’s a single point of control. Secured properly, with multi-factor authentication, named users and least-privilege permissions, it’s one of the most effective security tools you can have.

What should we fix first?

Anything reachable from the internet that shouldn’t be, any default or shared passwords, and any device affected by a vulnerability that’s being actively exploited. Those three account for most real-world compromises.

Where to start this week

• Get the list of every active SIM and every broadband line that serves connected kit.
• Check what can be seen from the internet, starting with anything on a public IP.
• Find every device that’s end of life or hasn’t had a firmware update in the last year.
• Close anything that’s open to the internet and doesn’t need to be.
• Change any default or shared passwords.
• Talk to your hardware and SIM suppliers about what they can do to help you manage the estate, not just sell you the next box.

Ten years ago we got away with installing things and walking away. The kit we fit now will still be running in 2036. It’s worth getting it right this time.