Shadow Devices in OT Networks: The Assets Nobody Knows They Have

What a Shadow Device Is and Why It Exists

In IT networks the concept of shadow IT is well known: software, cloud services, devices connected without approval from the systems department. In OT networks the phenomenon is analogous but harder to manage and potentially more serious in its consequences.

An OT shadow device is any device connected to the industrial control network that does not appear in the official inventory. It is not necessarily connected with malicious intent: in most cases it originates from operational needs, from time pressure, from a lack of clear procedures, or simply from habits formed before cybersecurity became a priority.

The most common types found during an audit of an Italian manufacturing OT network:

• Maintenance laptops left connected: a vendor technician arrives, connects a laptop to the OT network for configuration, finishes the work and leaves. The cable stays, or the switch port remains active. The laptop is no longer physically present, but if a device is configured for remote connection the session can remain open.
• 4G modems or consumer routers: installed by operators or vendors to have quick remote access without going through IT procedures. They are cheap, fast to configure, and nobody asked for permission.
• Raspberry Pi and single-board computers: common in environments where someone wanted to add logging capability, a local dashboard, a notification system. Installed by technically competent people, but outside any change management process.
• Unmanaged switches: added to multiply available ports without telling anyone. They are invisible to network management tools because they have no manageable IP address.
• Commercial IoT devices: thermometers, IP cameras, environmental sensors connected to the OT network because "it was the closest one" or because "it is separated from the internet anyway."

How They Enter the Network

The path of a shadow device from installation to oblivion is often predictable.

Installation happens under operational pressure: a fault to resolve quickly, a vendor requesting the ability to work independently, a temporary integration that then became permanent. Change management procedures exist, but they take time that production environments do not always have.

The device does what it is supposed to do. Nobody documents it because whoever installed it already knows what it does. Then that person changes departments, retires, or leaves the company. The device stays. Its original purpose may still be active, may have become obsolete, but touching it feels risky. "If I disconnect it and something stops working, I take the blame."

This inertia is the main reason shadow devices persist for years. It is not malicious negligence — it is the combination of missing documentation, fear of disrupting production, and nonexistent decommissioning procedures.

The Real Risk: Not Just Attack Surface

The immediate problem cited when discussing shadow devices is attack surface expansion: every uncontrolled device is a potential entry point. This is true, but it is only part of the risk.

The more insidious problem is the loss of inventory integrity. If I do not know what is on my network, I cannot:

• Apply coherent segmentation policies (I cannot isolate what I do not know exists)
• Assess vulnerabilities accurately (an uninventoried device is never checked for CVEs)
• Respond to an incident effectively (during a crisis, every unknown device is a suspect)
• Be compliant with NIS2 or IEC 62443, both of which require an updated asset inventory as a prerequisite

The 4G modem installed two years ago by a vendor for "temporary access" is probably still connected, with default credentials, on a SIM registered to that same vendor. This is not a theoretical risk — it is an open backdoor.

Why Traditional Methods Are Not Enough

The classic approach for building an OT network inventory involves manual enumeration during planned shutdowns, combined with active network scanning tools. Both have serious limitations in OT environments.

Manual enumeration is a point-in-time snapshot: it captures the situation at a precise moment but does not update automatically. Between one enumeration and the next, months or years may pass during which the network changes.

Active scanning, typically with tools like Nmap, sends packets to every address in the subnet and analyzes responses. In IT networks this is a routine operation. In OT networks it can cause serious problems: some PLCs and field devices react badly to unexpected traffic, up to and including unplanned stops or reboots. Scanning an OT network in production requires a prior risk analysis and is often discouraged during operational hours.

Unmanaged switches, furthermore, do not even respond to IP scans — they are transparent at the network layer. They are only visible by analyzing the traffic that passes through them.

Passive Traffic Monitoring: How Uncatalogued Devices Are Found

Passive network traffic monitoring is the approach that does not interfere with devices and does not require querying them directly. It involves positioning a sensor — typically connected to a SPAN port on a managed switch or to a physical tap on the cable — that captures all traffic and analyzes it.

From this analysis it is possible to build an automatic inventory: every device that communicates on the network leaves traces in packets — MAC addresses, IP addresses, hostnames if present, protocols used, communication patterns. A specialized OT monitoring system recognizes these patterns and progressively builds an inventory of observed assets.

Shadow devices emerge naturally:

• The 4G modem appears as a device that establishes connections to undocumented external IP addresses
• The Raspberry Pi shows up as a host communicating with PLCs in ways not anticipated by the baseline
• The unmanaged switch has no IP address of its own, but its presence is inferred from analysis of MAC addresses transiting the upstream switch port

The difference from active scanning is that passive monitoring sends nothing — it only listens. It cannot disturb existing devices, and it operates continuously, not only during planned shutdowns.

From Discovery to Management

Finding shadow devices is the first step. The second is deciding what to do with them without creating operational problems.

The pragmatic approach involves an initial classification of found devices:

Unknown devices with legitimate, documentable communications: these are probably existing assets that were never inventoried. They should be added to the inventory, classified by criticality, and included in ordinary management processes.

Devices with unjustified external communications: high priority. An unknown 4G modem or a device opening connections to undocumented IP addresses requires immediate investigation and, if no operational justification is found, disconnection.

Quiescent devices or devices with minimal traffic: these may be legacy devices no longer in use but still connected. They should be documented and, where possible, removed or isolated.

Discovering shadow devices is also an opportunity to revise procedures: update rules for connecting devices to the OT network, introduce authorization processes for vendor remote access, define offboarding procedures that include disconnecting any connected devices.

The point is not to punish whoever installed the 4G modem two years ago — it is to build conditions where next time an authorized path exists that is more convenient than the unauthorized one.

Continuous Visibility as a Prerequisite

An OT inventory is not a document — it is a continuous state. The network changes, devices are added and removed, vendors rotate. An annual manual enumeration, even if perfect at time zero, will already be partially obsolete after a few weeks in an active plant.

Continuous visibility, maintained through persistent traffic monitoring, is the only approach that keeps pace with real network changes. Every new device that appears is detected as soon as it starts communicating — not at the next scheduled shutdown.

For Italian manufacturing SMEs building their OT security posture, automatic and continuous asset inventory is not an advanced objective — it is the foundation on which everything else rests. You cannot protect what you do not know you have.

The MON5 Angle

The forgotten 4G modem and the unmanaged switch are found the way this article describes: by listening to traffic, not querying devices. MON5's DISCOVER phase does exactly this — passive or hybrid asset discovery that identifies every device communicating on the OT network and reconstructs its topology, without active scanning and without stopping production.

With the ANALYZE phase the inventory becomes continuous: every new device is detected as soon as it starts communicating and correlated with known vulnerabilities, so tomorrow's shadow device does not stay invisible for years. To find out what is actually on your network, request an OT assessment.