Security1 publisher3 min readPublished
Talos wants exploit filtering upstream of OT that certification has frozen
AI-assisted code analysis keeps finding old bugs in software that certified and unsupported OT cannot update. Talos answers with deep packet inspection on the path in and VLAN segmentation built on how little OT talks.
The Watch · Security desk
What happened
- Talos says AI-assisted code analysis is uncovering decades of technical debt, producing a patching cadence that many organizations will struggle to keep up with.
- Its second is micro-segmentation with VLANs and access control lists, so only a handful of authorized devices can open a connection to the vulnerable system.
- Talos treats the air gap as theory, saying that without absolute operational discipline staff and contractors breach it with shortcuts.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- cost The spend moves off patch labour and onto network hardware and inspection licences, paid by plant and facilities budgets that were never sized for a security control on every OT segment.
- constraint Both controls assume traffic passes the inspection point. A contractor laptop or a VPN-plus-wireless bridge that becomes semi-permanent puts the device back in the open with no signature between it and the exploit.
- exposure Internal access is the reachability that counts here: an attacker already inside can enumerate devices that were never internet-facing, so perimeter position offers the operator nothing.
- contradiction The guidance stands on WannaCry and a 2023 end-of-life intrusion, so the budget case has no measured discovery rate behind it.
Segmentation is cheap on OT because OT barely talks. Talos says these systems frequently only ever connect to a small number of others [5], so the allowlist of authorized peers on a VLAN, enforced with ACLs, is a short list to write and a short list to maintain [4]. The inventory comes first. The network fingerprint of a legacy system is distinctive enough to identify it and build that inventory, according to Talos [6].
The second control sits on the path in. A next-generation firewall placed directly upstream, running a current intrusion prevention system, inspects incoming traffic and drops exploit attempts before they reach the device [3]. Nothing on the device changes, so the protection holds only as long as the signature set stays current.
The urgency in the post rests on two older cases. WannaCry hit the UK's NHS in 2017, and Talos says a significant minority of systems running end-of-life Windows XP contributed to the damage [7]. In 2023, exploitation of end-of-life software was used to reach governmental systems [8]. Neither of those involved AI-assisted discovery. The post claims the discovery rate is accelerating, but it never counts the vulnerabilities or measures the patching interval [16].
Two points in the post are worth more than the product advice. Systems believed to run bespoke platforms almost certainly include common libraries and protocols where vulnerabilities get found [13]. And a device that is not internet-facing is still findable: Talos says threat actors who gain access to internal networks can identify these systems and will treat them as a target [12].
Then there is isolation. Talos calls the air gap achievable in theory and difficult in practice, and says that without absolute operational discipline, air gaps are frequently breached by staff or contractors taking shortcuts [9]. Temporary bridges for data transfer, and short-term fixes involving a VPN and wireless connectivity, have a habit of becoming semi-permanent features [10]. Even data diodes, which physically restrict data to one-way flow, get circumvented when compliance is inconvenient [11].
Talos still puts the vendor patch first where one can be applied [14]. Where it cannot, the post's own summary of the alternative is blunt: "Hoping for the best is not a viable anti-exploitation strategy" [15]. The reason the patch cannot be applied is the same in most plants: the system is certified to run one defined software load that cannot easily be altered, or it runs on a platform nobody supports any more [2]. Talos frames the discovery side as technical debt now being paid down by AI-assisted code analysis, with each patch removing a newly identified coding mistake, at a cadence organizations may struggle to implement [1].
What to watch
- A dated OT-affecting vulnerability found by AI-assisted analysis where the vendor certification blocks a patch would test the premise directly.
- Whether IPS signature feeds cover OT protocols quickly enough for upstream inspection to count as virtual patching in practice.
- Whether hospital and plant operators fund the inventory step, since segmentation and upstream filtering both depend on knowing which legacy devices exist.