Capability
OT Security testing
OT (operational technology) attacks don’t start on the plant floor. They walk in through IT. Our OT security testing follows that exact path, from IT perimeter breach to OT pivot, so you find the gap before a real attacker does.
CovertSwarm named in the Gartner® Hype Cycle™ for Security Operations, 2026
THE THREAT.
THE IT/OT boundary is where most attacks succeed.
OT security testing is an authorised engagement in which the Swarm maps the attack paths between your IT environment and operational systems, testing whether SCADA, DCS, PLC, and Industrial Control System (ICS) environments can be reached and compromised from a realistic attacker position.
Most attacks on operational technology don’t start in your facility. They start in your IT environment and walk straight through.
Built without attackers in mind.
SCADA systems, PLCs, and distributed control systems were never designed for a connected world. Many run on legacy software, unsupported operating systems, and protocols that assumed isolation, until they’re not.
Gaps compound quietly.
Annual compliance audits don’t catch a misconfiguration from last week’s maintenance window, a new vendor remote access connection, or an engineer’s workstation that hasn’t been patched in three years.
The air gap myth.
The air gap is rarely real. Engineers and vendors use USB drives, laptops, and remote connections to maintain systems. Each one introduces a pathway. The assumed boundary is often a paper wall.
WE ATTACK THE SYSTEMS YOU TRUST.
Real attackers don’t pick one technique and stop. They find a foothold and pull on everything connected to it. The Swarm works the same way.
Passive network reconnaissance
We map your OT environment before touching anything. Exposed interfaces, architecture, protocol usage, and device behaviour – all visible by observation alone before a single packet is sent.
IT/OT boundary and segmentation testing
We test whether your OT network is truly isolated or whether the assumed boundary is a paper wall. Firewall configurations, VLAN segmentation, and remote access pathways are all in scope.
IT-to-OT pivot simulation
Starting from assumed compromise within your IT environment, we simulate the full lateral movement journey toward your operational systems.
PLC and engineering workstation access
Device access, logic integrity, and the workstations used to program them. A compromised workstation with vendor software isn’t just a security incident, it’s potential control over your operation.
Default and hardcoded credential exploitation
The credentials shipped with your PLCs and controllers are often never changed. Default and hardcoded credentials in industrial devices are among the most consistently exploitable weaknesses the Swarm encounters.
Protocol and configuration review
We assess the industrial protocol configurations across your environment including Modbus, DNP3, and EtherNet/IP, for authentication controls, encryption gaps, and default credentials.
We know that real attack surfaces don’t come in neat categories. If yours doesn’t fit above, tell us what you’re working with.
What aN OPERATIONAL TECHNOLOGY Finding Looks Like
Example: OT security engagement finding
Critical
Finding
Starting from an assumed IT network compromise, CovertSwarm identified crossover points into a fully segregated OT environment. Segmentation was present but inconsistently enforced. The majority of OT management interfaces discovered were unauthenticated.
Impact
We gained full control of both IT and OT networks. Legacy engineer workstations contained stored credentials, operational process notes, and infrastructure references that accelerated movement deeper into the environment.
Remediation
Enforce segmentation between IT and OT networks. Remove unnecessary crossover points between environments. Address legacy endpoints storing sensitive operational context. Tighten credential storage and management. Improve visibility over internal movement and access.
Board impact
A quiet, deliberate attack on critical operational infrastructure with consequences extending well beyond the digital domain. The risk was not a single vulnerability but a combination of factors that together created a clear path to operational systems.
Technical impact
Full IT and OT network compromise via unauthenticated OT management interfaces and insufficiently enforced network segmentation. Operational intelligence gathered from unprotected engineer workstations accelerated access deeper into the environment.
Want the full picture?
The full range of offensive security the Swarm runs: every discipline, how they connect, and what each one tests.
No form fill required.
How it works
Your subscription starts with your Attack Strategy. What matters most, and what adversaries would target first.
Your Swarm then delivers realistic attacks against your whole organisation, and works within mutually agreed parameters without interruption to operations.
1
Passive-first, always
We map and observe your environment before any active testing begins. Passive reconnaissance identifies exposure without touching live systems.
2
Operational planning
Active testing is planned around your operational windows, using test environments where available and out-of-hours scheduling where possible.
3
Rules of engagement
Every engagement is explicitly authorised in writing. Scope, permitted techniques, and stop conditions are agreed with operational stakeholders before anything starts.
4
Controlled execution
Active techniques are executed methodically within agreed boundaries. Every action is logged. Work stops immediately if anything unexpected occurs.
Constant Cyber Attack™
We become the threat. You get the proof.
You don’t outpace attackers by waiting for your next test. You do it by facing an adversary that thinks, acts and strikes like they do.
CovertSwarm attacks your organisation the way the best attackers do: continuously, and using every tool available to reach their objective.
Digital. Social. Physical.
Your Swarm attacks across digital, physical and social vectors, chaining weaknesses to prove what a real attacker could achieve.
Constant pressure.
Your Swarm keeps attacking as your business evolves, adapting to changing systems, people and risks. Constant pressure, not a one-off test.
One simple subscription.
One subscription is all you need. Combine continuous offensive security, penetration testing, red teaming, bug bounty and more in one simple subscription.
Sharper, battle-tested SOC
Improve detection times
Fewer false positives
Prove ROI of security tooling
Stories from the Swarm
These stories are real, but the names are deeply redacted. We’ll tell you how we uncovered the threats no one else could see, and why constant cyber attack is the best way to outpace cyber threats.
Become a story well told. Contact us to discuss how Constant Cyber Attack will help you outpace cyber threats.
Frequently asked questions
Yes, when scoped and executed correctly. Our default posture is passive: we map, observe, and analyse your environment before any active testing begins. Where active testing is agreed, we plan around your operational windows, use test environments where available, and document hard stop conditions before any activity starts.
Scoping begins with a technical conversation to understand your environment: what systems are in scope, what the operational constraints are, what the realistic attacker starting position is, and what techniques are permitted. A formal Rules of Engagement document is agreed and signed before any activity begins. We also identify what is explicitly out of scope. Safety instrumented systems, for example, typically require separate written agreement before active testing. For organisations under IEC 62443, NCSC CAF, or NIS2 obligations, the scoping process also documents how the engagement produces audit-ready evidence for each relevant framework.
An annual compliance audit gives you a snapshot of your security posture on the day the auditor arrived. It does not find the vendor remote access connection that was added last month, the misconfiguration introduced during the last maintenance window, or the flat network segment that has existed quietly for three years. We test the way a real threat actor operates: continuously, persistently, and without waiting for your compliance calendar.
Not when the engagement is properly scoped. We begin every OT engagement with passive observation – no packets are sent to live systems during the reconnaissance phase. Where active testing is required, it is planned for maintenance windows or non-production environments. The scope of what is and is not in scope for active testing is agreed and documented before we begin.
In a point-in-time engagement, OT is tested once within a defined window. Inside Constant Cyber Attack, OT becomes a continuous vector: new vendor connections, configuration changes, and network modifications are tested as they happen, not once a year after they’ve been in place for months.
You receive findings in real time via the CovertSwarm Portal as they are discovered, not in a PDF three weeks after the engagement closes. The final deliverable includes an executive summary, technical detail per finding, board-level and technical outcome lines, specific remediation guidance for the teams responsible for implementing it, and access to the Swarm team for validation and retesting.
We test OT environments across energy and utilities, manufacturing, transport, and industrial facilities. For organisations under IEC 62443, NCSC CAF, or NIS2 obligations, engagement scope and deliverables are aligned to the relevant framework requirements.
Looking for something specific?
Talk to us. We’d love to hear from you.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security programme
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.