CrunchAtlas
Guide
A vulnerability scan isn't a full OT security assessment.
A scan finds exposed services and known weaknesses in scope. An OT assessment adds the architecture, access paths, operating context, and response questions a scan alone can't answer, across water, power, and other critical environments.
If you only read one thing.
Before using a scan report to judge the environment, confirm four things.
Where did it run?
From the public internet, inside IT, inside OT, or from more than one location?
What was in scope?
Which facilities, substations, remote sites, systems, vendor links, and segments were included?
What access did it have?
Authenticated, unauthenticated, passive, or limited to what responded from its position?
What could it safely test?
OT testing may be constrained by availability, performance, reliability, and safety.
01 · What the scan shows
Start with the scan itself.
A clean result speaks only to the approved scope, scan position, access, and checks performed.
NIST recommends planning security testing around OT performance, reliability, and safety constraints, because some active techniques can affect fragile, or time-sensitive systems. 1
02 · What it doesn't answer
A scan answers part of the question.
These five questions need different evidence. 1 4
- External exposure
- A scan may identify reachable systems, services, and detectable weaknesses from its position.
- Access paths
- Architecture and configuration review show how remote access, vendor links, and IT/OT boundaries connect.
- Network behavior
- Passive monitoring shows observed communication on the segments where traffic is collected.
- Incident evidence
- Logs, network data, and host evidence determine what can be investigated after something looks wrong.
- Operational risk
- Asset role, reachability, controls, and consequence matter. A vulnerability severity score alone isn't risk.
03 · Questions to ask
Ask six questions before you call the scan done.
You may already have the answers. Make them explicit.
- Which systems, sites, and network segments were actually in scope?
- Was the scan external, internal, authenticated, or passive?
- Which remote access, vendor, and cellular paths sat outside the scan?
- Can we see communication on the OT segments that matter?
- Who investigates suspicious activity, and what evidence would they have?
- How will we verify the fix after remediation?
If one answer is unclear, give it an owner before the next assessment or incident.
Know what the scan proved, and what still needs an answer.
Talk with our team about what AtlasCyber finds in your network.
04 · Where CrunchAtlas fits
Where CrunchAtlas fits.
AtlasCyber monitors the network and ClemAI investigates what it finds. The scan finds conditions. CrunchAtlas investigates what the available evidence says and validates approved IT fixes.
Network Detection and Response
Investigate suspicious activity on supported IT and OT segments from passive network evidence, without actively probing operational systems.
Alert Investigation
Work security signals into a case with affected systems, evidence, a verdict, confidence, and next steps.
Host and Network Forensics
Reconstruct what happened and establish the scope the evidence supports.
PurpleHaze validation
Operator-initiated validation inside approved IT scope, then a retest of approved fixes. OT stays out of active testing.
05 · FAQ
Scans and OT assessments, answered.
Is a vulnerability scan the same as an OT security assessment?
They cover different ground. A vulnerability scan checks for detectable systems, exposures, vulnerabilities, and configuration conditions within its approved scope. An OT security assessment also reviews architecture, remote access, segmentation, operating constraints, monitoring, incident readiness, and remediation priorities.
Does an external vulnerability scan show internal OT network activity?
An external scan can only test what's reachable from its scan position. Internal network behavior requires internal telemetry, assessment work, or testing within an approved scope.
Do we still need an assessment if a controller isn't directly exposed to the internet?
Possibly. The remaining question is whether remote access, engineering workstations, gateways, cellular links, vendor connections, or other upstream systems can still reach the control environment.
Can active vulnerability scanning affect OT systems?
It can. NIST recommends planning security testing around OT performance, reliability, and safety constraints, because some active techniques can affect fragile, or time-sensitive systems.
How does CrunchAtlas work with vulnerability scans?
AtlasCyber monitors the network and ClemAI investigates what it finds, with forensics and reporting, and PurpleHaze runs operator-initiated validation within approved IT scope. OT stays out of active PurpleHaze testing.
06 · Sources
Sources.
The scan and OT assessment distinctions on this page are grounded in NIST, CISA, and FIRST guidance. CrunchAtlas product descriptions are separate from agency guidance.
- NIST, SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA, Secure Connectivity Principles for Operational Technology
- CISA, Foundations for OT Cybersecurity: Asset Inventory Guidance
- FIRST, CVSS v4.0 User Guide
This page is educational. Scope, test method, system architecture, operating constraints, and provider responsibilities vary by environment and engagement. Visibility and conclusions depend on the approved scope and available evidence.
Keep reading.
Know what the scan proved.
Talk with our team about what AtlasCyber finds in your network.
Talk to our teamSign up for our newsletter