Flat OT Networks: Why Most Factories Don't Know What's on Their Network

The flat network: how it came to be and why it is still so common

Ask the technical manager of an Italian manufacturing SME to describe their OT network. The most common answer is not a precise technical description: it is a story. The network started with the first PLCs installed twenty years ago, then it expanded when they added the second line, then the new HMIs arrived, then the integration with the ERP system, then the machine vendor's technicians installed something for remote maintenance and nobody quite understood what.

This is the typical OT network of Italian SMEs: not designed as a system, but grown by accumulation. Every intervention added something without removing anything, with no architectural review, often with no documentation. The result is a flat network where every device (PLCs, HMIs, SCADA servers, workstations, printers, barcode readers, IP cameras) shares the same network segment with no logical separation between them.

The flat network was not born of a security choice: it was born of a choice for operational simplicity. Less configuration, fewer connectivity problems, fewer tickets opened. In an environment where production continuity is the absolute priority and where IT resources are often shared or absent, the flat network is the path of least resistance.

The problem is that a flat network has no internal perimeter. Once an attacker, or a piece of malware, gains a point of access, it can potentially reach every device on the network without meeting any obstacles. And if you don't even know what's on the network, there is no way to know what an attacker could reach.

The inventory problem: unknown devices everywhere

In almost every SME, the OT asset inventory is non-existent or unreliable. There are often purchase lists from recent years, Excel spreadsheets kept up to date until a certain point, electrical diagrams documenting the components of a line. None of these tools matches what is actually on the network right now.

The reasons are structural. OT devices are installed by different vendors, at different times, often during unplanned downtime when the goal is to restore production as quickly as possible. Documentation is put off until later, and that later often never comes. Temporary devices, such as an external technician's laptop connected for a week of maintenance, stay on the network for months after the technician has left.

Then there are the devices that no one remembers installing: old HMIs decommissioned but not powered off, data concentrators from a supervisory system later abandoned, protocol gateways left active because "we don't know what will happen if we turn them off." In OT networks that have been running for ten or twenty years, this category can account for a significant share of the devices present.

The problem becomes critical when you consider that these unknown devices are also unmanaged devices: they receive no firmware updates, they are not monitored, they are not included in incident response plans. They are blind spots by definition, and often the points of least resistance for an attacker.

The dependence on institutional memory

In many manufacturing SMEs, knowledge of the OT network is concentrated in one or two people: the maintenance manager with twenty years of seniority, the specialist technician who has overseen every installation of the past ten years. This person knows where the PLCs are, knows the IP addresses by heart, knows which machines communicate with which systems.

The problem is not that this knowledge exists: it is that it exists only in that form. It is not documented, it is not transferable, and it cannot be verified. When that person goes on holiday, or falls ill, or leaves the company, knowledge of the OT network goes with them.

Even more relevant from a security standpoint: human memory is not a reliable inventory. It remembers the main devices, the most-used connections, the recently installed systems. It does not remember the small protocol gateway installed seven years ago by a vendor that no longer works with the company, or the old HMI that someone connected to the network "temporarily" four years ago and then never disconnected.

The inventory that lives only in the technician's head is a selective, partial inventory. For security, what is not remembered is not protected.

The concrete risks of a flat network without an inventory

A flat network without an inventory creates an attack surface that cannot be managed because it cannot be measured. The most direct risks:

Unhindered lateral movement: an attacker who gains access to a single device, for example through a workstation with internet access that is not properly separated, can potentially reach all the other devices on the flat network without encountering any firewall or segmentation. In an IT network this scenario is serious; in an OT network where PLCs control physical processes, the consequences can include damage to plant equipment, production stoppage or, in the worst cases, risks to people.

Invisible vulnerabilities: without knowing which devices are on the network, there is no way to know which vulnerabilities are exposed. A PLC with a critical vulnerability known for two years is only a risk if someone knows it exists and that it is reachable on the network. If it does not appear in any inventory, it does not appear in any vulnerability management program.

Untracked remote access: SMEs often have dozens of active remote access connections for their machine vendors. Without an inventory, there is no way to know how many there are, who uses them, when they were created, or whether they are still needed. Some of these connections may be active on devices that the vendor stopped updating years ago.

Compliance is impossible without visibility: NIS2 and IEC 62443 both require asset management as a prerequisite for any other security control. You cannot demonstrate compliance for systems you don't know you have.

Where to start: passive asset discovery as the first step

The most frequent question is: where do you begin, in such a fragmented environment, without stopping production? The answer is passive network traffic monitoring.

Passive asset discovery works by listening to the traffic already present on the OT network, that is, the traffic devices generate normally in the course of their operations, and deriving from that traffic the information about the devices: IP and MAC addresses, device type, manufacturer, firmware version where available, protocols used, communication patterns.

The advantage of passive monitoring in an OT environment is crucial: it generates no additional traffic on the network, it sends no packets to the devices, it does not interfere in any way with ongoing processes. Legacy OT devices, in particular older PLCs, can respond unpredictably to active network scans; passive monitoring eliminates this risk entirely.

In a typical manufacturing SME environment, a few weeks of passive monitoring produce an inventory that no Excel spreadsheet could ever come close to: every device that has emitted even a single packet on the network is identified, classified, and added to the map. Including the ones no one remembered having.

This inventory is not the end of the security journey: it is its prerequisite. You cannot segment a network you do not know. You cannot remediate vulnerabilities on systems that appear in no inventory. You cannot plan an incident response without knowing which assets to protect. Asset visibility is the mandatory starting point, not an advanced option.

The next stage: from inventory to security posture

Once a reliable inventory is in place, it becomes possible to tackle the next steps in a structured way. The priority of interventions changes completely when you know what is on the network: devices with critical vulnerabilities become visible, anomalous communication paths emerge from the comparison with operational expectations, unmanaged devices can be assessed and either decommissioned or brought into routine management.

Network segmentation, the step that naturally follows asset visibility, becomes a feasible project rather than an operation carried out blind. Knowing where the critical systems are, which communications are necessary between them, and where the highest-risk devices sit, you can design a segmentation that improves security without breaking operational processes.

The starting point, however, always remains the same: understanding what is on the network. Not as an academic exercise, but as an operational prerequisite for any other security intervention you want to make effective.

The MON5 angle

The journey described in this article, from passive inventory to segmentation, is the methodology MON5 was designed around. The DISCOVER phase starts precisely from the flat network typical of SMEs: passive or hybrid asset discovery, reconstruction of the network topology, identification of every device that communicates, all without stopping production and without sending a single packet to the PLCs.

The inventory does not stay a snapshot: with the ANALYZE phase it becomes continuous, enriched with correlation against CVE vulnerabilities, and prepares the design of IEC 62443 zones and conduits. To turn the technician's institutional memory into a verifiable map, you start with an OT assessment.