buildOne report1 publisher Port counts for 102, 502 and 44818 in a 22 September 2026 ZoomEye snapshot cannot be summed into one exposure figure, a dev.to analysis says. The totals are index entries for protocols with different vendor bases and risk profiles, so none of them is a count of vulnerable devices.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap−10
- Incentives
- Insufficient
- Confidence60
Palo Alto Networks found 49 percent of critical infrastructure operators who see every OT asset still list legacy equipment as a challenge. Most respondents say their security tools, seven on average at large operators, have raised complexity and cost.
Reality
- Evidence35
- Adoption18
- Hype gap+15
- Incentives
- Insufficient
- Confidence40
buildOne report1 publisher Two exploited Citrix NetScaler zero-days and a CVSS 9.8 Cisco SD-WAN Manager flaw top a weekly DACH OT risk bulletin. For many operators, both products enforce segmentation into OT, so an attacker who takes one over is standing in front of the control systems.
Reality
- Evidence45
- Adoption
- Insufficient
- Hype gap+10
- Incentives35
- Confidence45
buildOne report1 publisher Ridge Security disclosed CVE-2026-42542, an integer underflow that lets one unauthenticated packet to TCP/6030 crash TDengine's taosd process. Repeated packets keep it in a restart loop, and TDengine fixed it in version 3.4.1.6.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives40
- Confidence55
Honeywell asked 603 critical infrastructure leaders what they actually watch. The chillers, elevators and badge readers that keep the controllers alive mostly sit outside continuous view, and teams with thinner inventories reported longer outages.
Reality
- Evidence45
- Adoption20
- Hype gap+8
- Incentives72
- Confidence52
The Sept. 22 study of 2.5 million devices in 209 organizations found cameras alone in 51 of 2,266 camera segments, and Black Hills Information Security's John Strand says the true isolation rate is lower.
Perspective Coverage
3 publishers
- Builder
- Builder 18%
- Operator
- Operator 74%
- Investor
- Investor 8%
Reality
- Evidence64
- Adoption58
- Hype gap+8
- Incentives76
- Confidence70
buildOne report1 publisher Disabling alarms was one of the confirmed operations at two small Colorado water utilities. That puts detection at the front of the review for anyone running a small OT estate.
Reality
- Evidence38
- Adoption25
- Hype gap+8
- Incentives22
- Confidence45
Accenture's majority stake closed first, then Dragos completed both acquisitions on Monday. One supplier now holds network discovery, firmware inventory and OT threat detection. Neither price was disclosed.
Reality
- Evidence48
- Adoption25
- Hype gap+25
- Incentives70
- Confidence60
SC World's OT resilience explainer argues that a plant can restore the operating system and the SCADA application after ransomware and still be missing the PLC programs, HMI screens and alarm tables that control the process.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap+18
- Incentives
- Insufficient
- Confidence45
buildOne report1 publisher Two ZoomEye dorks run on 2026-09-16 returned 40,917 assets on port 502 and 161,769 on port 102. Both protocols leave authentication out of the base specification, so the count measures who can reach the port.
Reality
- Evidence45
- Adoption30
- Hype gap+12
- Incentives30
- Confidence40
Nozomi Networks is selling industrial operators the argument that their remediation backlog is a bookkeeping problem. Compass is the product it wants holding the asset record, the approvals and the audit evidence.
Reality
- Evidence24
- Adoption
- Insufficient
- Hype gap+38
- Incentives88
- Confidence32
AI-assisted code analysis keeps finding old bugs in software that certified and unsupported OT cannot update. Talos answers with deep packet inspection on the path in and VLAN segmentation built on how little OT talks.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+30
- Incentives75
- Confidence45
buildOne report1 publisher The 30 July advisory asks water utilities to validate what is reachable from outside. A query of ZoomEye's Modbus fingerprint on 15 September matched 47,028 assets on the public internet.
Reality
- Evidence58
- Adoption45
- Hype gap+12
- Incentives72
- Confidence62
The reinforcement-learning defender was trained on 40,000 half-minute traffic samples from a container replica of a segmented plant network, and its best-performing version works from a model of the attacker it is fighting.
Reality
- Evidence58
- Adoption10
- Hype gap+25
- Incentives28
- Confidence55
The new Foundations for OT Cybersecurity guidance treats an asset inventory plus a taxonomy as the precondition for everything else in a defensible architecture. It sets no deadline and names no auditor.
Reality
- Evidence72
- Adoption
- Insufficient
- Hype gap+10
- Incentives45
- Confidence70