OT EXPOSURE RESEARCH

What Attackers See Before You Do

Data-driven analysis of internet-exposed OT assets, protocols, and services across critical infrastructure sectors.
THE OUTSIDE-IN PERSPECTIVE

Exposure Data No One Else Publishes

Most OT security research looks inward — what is happening inside your network. We look outward. ShiftSix continuously maps internet-exposed OT assets, industrial protocols, and critical infrastructure services that are visible to threat actors right now. This research tracks what we find, how it is changing, and which adversaries are actively targeting it.

OT Exposure Index

Our flagship quarterly publication tracking internet-facing OT devices by protocol, sector, and geography — correlated against active threat campaigns and compliance frameworks.

Exposure Briefs

Sector-specific and protocol-specific deep dives into what we find exposed across critical infrastructure — water, energy, manufacturing, building automation, and more.

Advisories

When a new vulnerability drops, we publish the external exposure footprint — how many devices are internet-facing, which sectors are affected, and which threat actors are exploiting it.

OUR METHODOLOGY

How We Measure OT Exposure

Our research is based on continuous external scanning and analysis of internet-facing OT assets. We do not access, authenticate with, or disrupt any systems. Our methodology:

  • Protocol-level discovery — We identify services responding on OT-specific protocols (Modbus, DNP3, BACnet, EtherNet/IP, S7, OPC UA) across the IPv4 address space
  • Fingerprinting — We classify devices by vendor, firmware, and function without sending exploit payloads or modifying device state
  • Threat correlation — Every discovered exposure is cross-referenced against active threat campaigns, CISA KEV entries, and ICS-CERT advisories
  • Sector attribution — Exposures are mapped to critical infrastructure sectors using organizational data, ASN ownership, and geolocation
  • Responsible aggregation — We never name specific organizations. All findings are published in aggregate at the sector and protocol level

6

OT protocols monitored

8

Critical infrastructure sectors covered

Quarterly

Exposure Index publication cadence

Free

All research published ungated

See What Is Exposed Right Now

Get a complimentary external OT exposure assessment for your organization. No agents, no network access — just the attacker’s view of your infrastructure.

Skip to content