OSINT on Industrial Plants: What Attackers Find Before You Do

What Attackers See Before They Start

Before an attacker attempts the first exploit, they spend time gathering information. This phase, known as reconnaissance in security jargon, aims to understand what there is to attack, how it is configured, and where the most accessible weaknesses lie. The more information is collected without raising alarms, the more targeted and effective the subsequent attack can be.

A significant part of this reconnaissance happens entirely through public sources, without ever directly interacting with the target systems. This is OSINT: Open Source Intelligence, the art of gathering information from freely accessible sources. For industrial OT systems, the amount of publicly available information is often far greater than plant managers imagine.

Understanding what information is publicly accessible about your own industrial systems is not an academic exercise: it is one of the most immediate and low-cost security controls available. Seeing yourself through the eyes of a potential attacker allows you to identify and fix exposures that, until you look for them, you do not know you have.

Shodan and Censys: The Search Engines for Exposed Systems

Shodan and Censys are search engines that index devices connected to the internet and make them searchable by technical characteristics: open port, service banner, TLS certificates, operating system, software version. Unlike Google, which indexes web content, these tools index the devices themselves and the services they expose.

Shodan, the better known of the two, continuously scans the entire space of public IPv4 addresses. For each reachable IP address, it records the open ports, the banners of the services responding on those ports, and any technical information that can be extracted from the response. The resulting database is freely searchable (with some limitations for unregistered users) and allows searches by service type, software version, country, and hundreds of other parameters.

For OT systems, this means that anyone can search, for example, for all devices in Italy exposing port 502 (Modbus TCP), or all SCADA servers running a specific version of WinCC, or all devices with a banner containing the name of a specific industrial automation vendor. These searches require no advanced skills and produce results in seconds.

Censys works in a similar way, with greater emphasis on the analysis of TLS certificates and HTTPS services, and is often used alongside Shodan to obtain a more complete picture.

What You Find: The Most Commonly Exposed OT Systems

Shodan searches related to industrial systems return categories of results that recur with worrying frequency, even when the search is limited to Europe or Italy:

HMIs with web interfaces: many modern HMIs expose a web interface to allow remote access for operators. These interfaces are often reachable directly from the internet, sometimes protected by weak or default credentials, sometimes with no authentication at all. An attacker who finds an HMI accessible via the web can see the real-time status of an industrial plant, and in some cases interact with it.

Industrial VPNs running vulnerable versions: the VPN gateways used for remote access to plants are among the most searched-for systems on Shodan. Many of these gateways run firmware versions with known vulnerabilities, some critical, that have not been fixed because the update requires a maintenance window that was never arranged. The service banner often contains the firmware version, allowing anyone to map the device to the corresponding vulnerabilities without even attempting an exploit.

Exposed Modbus/TCP servers: Modbus TCP on port 502 is one of the most widespread industrial protocols. It is also a protocol with no native authentication: anyone who manages to connect to port 502 of a device can send Modbus commands. Modbus servers exposed directly on the internet, a configuration that should never exist, are an immediate risk.

Building Automation system control panels: BAS/BMS systems for managing industrial buildings (HVAC, access, energy) are often connected to the internet for remote monitoring. These systems control physical environments that can be critical to certain production processes, and they are often less closely watched than the main process control systems.

Vendor remote-assistance interfaces: many vendors of CNC machines, industrial robots, or process plants install permanent remote access for maintenance. This access, often based on VNC or direct RDP, sometimes on proprietary remote-assistance platforms, remains active long after the warranty has ended, and in some cases long after the vendor has stopped actively using it. If exposed on the internet, they are potential entry points.

Italian and European Exposure: Context Data

Security researchers who analyze Shodan and Censys periodically publish analyses on the exposure of OT systems. The available data indicates that Italy is no exception: Italian industrial systems appear in Shodan searches with a frequency consistent with the size of the national manufacturing sector.

Some organizations, including the Shadowserver Foundation and CISA in the United States, conduct regular scans of public IP space looking for exposed OT systems and notify the managers of the IP addresses when they find critical exposures. The fact that these notification services exist, and have a significant backlog of notifications to send, indicates that the problem of unintentional exposure of OT systems is widespread and systemic, not an isolated case.

The relevant principle for a manufacturing SME is not to compare yourself with aggregate statistics: it is to ask whether your own systems appear in these searches, and the answer is not a given. Many organizations discover they have systems exposed on the internet that they did not know they had, often because someone opened a firewall port to "fix a problem" without documenting it and without closing it afterwards.

How to Reduce Your Exposure: A Three-Step Approach

Reducing the OSINT exposure of OT systems does not require advanced technology investments. It requires a systematic process that begins with understanding what is actually exposed.

Step 1: search for your own exposure

The first step is to actively search for your own systems in the same sources attackers would use. This includes:

• Searching Shodan for the organization's public IP addresses (the IPs assigned to your internet connection, your data centers, your VPNs). Searching by IP range is available even without a premium subscription.
• Searching for the organization name, the domain names, the associated brands. Some systems expose banners that contain these identifiers.
• Searching by device type: specific PLC or HMI manufacturers used in the plant, combined with your geographic area.

This process should be repeated periodically, at least every quarter, because exposure can change: new devices are connected, new ports are opened, the exposure surface evolves.

Step 2: inventory of internet-facing assets

Often, the main discovery of the internal OSINT process is that the organization does not have a complete list of its own systems reachable from the internet. Building and maintaining this inventory is the second step.

The inventory of internet-facing assets must include not only the servers and applications that you intend to expose deliberately, but also all the devices that turn out to be reachable from the internet even though they should not have been. For each device in the inventory: exposed port, service, version, reason for exposure, date of last check, person responsible for management.

Step 3: removal of unnecessary exposure

For each system found exposed on the internet, the first question is: is this exposure necessary? In a surprising number of cases, the answer is no: the system is exposed because someone opened a port that they never closed, not because there is a current operational need.

For systems whose exposure is not necessary, the fix is simple: close the port at the firewall level. It does not require changes to applications or devices, only a change to the perimeter configuration.

For systems whose exposure is necessary (remote access for maintenance, data interfaces to partners, VPNs for remote staff) the control shifts to the security of the access: strong authentication, up-to-date software versions, restriction of access to authorized source IPs only where possible.

The General Principle: Seeing Yourself From the Outside

The main value of the OSINT approach applied to your own organization is not the single discovery of an exposed system: it is the shift in perspective. To stop asking "what have we protected?" and start asking "what can anyone who wants to look at us see?"

These are two very different exercises. The first starts from the inside and looks outward: what we have, what we have configured, what we believe we are protecting. The second starts from the outside and looks inward: what is visible, what is reachable, what offers entry points to those who should not have them.

The real exposure surface of an organization is always the intersection of these two perspectives. Ignoring the external one means working with an incomplete model of your own risk.

The MON5 Angle

Looking at yourself from the outside with Shodan is half the exercise: the other half is knowing what is really inside the network, because many exposures originate from devices that no one had inventoried. The DISCOVER phase of MON5 builds this inventory through passive asset discovery, without stopping production, while ANALYZE correlates each asset's vulnerabilities with the EPSS score and real exposure: the same logic an attacker uses to choose targets, applied to decide remediation priorities.

Crossing the external view with the internal one closes the risk model. The internal snapshot of your plant starts with an OT assessment.

Analysis and commentary by MON5 based on public-domain research and data from the OT/ICS sector.