You can’t patch OT like office IT. CISA now publishes ICS advisories almost weekly — dozens of vendors, hundreds of CVEs — but shop-floor systems can’t reboot on Patch Tuesday. Triage by exposure and exploitability, not CVSS: is it reachable, is it exploited in the wild, can you compensate without patching? That decision — apply now, defer, or compensate — is OT patch triage.
Why can’t you patch OT like office IT?
Office IT assumes two things OT doesn’t have: a reboot window and an easy rollback. A laptop reboots overnight; a CNC line, an HMI, or a SCADA server may run for months without a scheduled stop, and taking it down costs real money per hour. That gap is why OT patch triage exists as its own discipline. Several constraints stack on top of that:
- No maintenance windows. Continuous production means there is rarely a safe moment to reboot a controller.
- Vendor-locked systems. Machine builders control the firmware and OS image; patching outside their process can void support or warranty.
- Legacy, unsupported operating systems. Plenty of HMIs and historians still run an OS that stopped getting vendor patches years ago.
- Safety-critical processes. A bad update on a safety system is not a help-desk ticket; it is a hazard.
- High downtime cost. An unplanned stop to install a patch can cost more than the vulnerability it closes.
That’s why an unpatched OT edge is dangerous in a different way than an unpatched office PC: one ransomware infection crossing from IT into OT can halt production, not just encrypt a file share — groups like Qilin specialize in exactly that IT-to-OT crossing. The goal isn’t to patch everything fast — it’s to decide what actually has to move.
How many ICS advisories is CISA actually issuing?
Enough that “just patch the advisories” is not a plan. CISA publishes Industrial Control Systems (ICS) advisories almost every week, often several on the same day. On August 18, 2026, CISA released two (Siemens Simcenter Nastran and “CISA Malcolm”); on August 20, 2026, it released another for Johnson Controls Simplex Incident Manager (ICSA-26-232-01).
Across recent weeks the vendors span Johnson Controls, Siemens, Rockwell Automation, Schneider Electric, Hitachi Energy, AVEVA, ANDRITZ, and Haiwell — and ICS vulnerability disclosures are at record highs in 2026. The flaws cluster into a few classes: remote code execution, privilege escalation, hardcoded credentials, and denial of service. The affected surfaces are the ones sitting closest to your network: building-automation UIs, engineering workstations, SCADA servers, and HMI/gateway interfaces.
Not every advisory is your problem — you only care about the vendors and models actually on your floor — but even a filtered feed is more than any small manufacturer can test and schedule by hand. A single week can carry a Rockwell controller flaw, a Schneider gateway bug, and a building-automation UI issue, each with its own vendor process. So the real job is triage: deciding which of the ones that apply to you has to move first.
OT patch triage: which patches actually matter?
Prioritize by exposure × exploitability, not by raw CVSS score. A 9.8 CVSS on a PLC that sits on an isolated segment with no route in is less urgent than a 7.5 on a device you can reach from the internet that attackers are already using. Ask four questions, in this order:
| Triage question (in order) | What it measures | Top-priority signal | What to do |
|---|---|---|---|
| 1. Is the device reachable beyond its OT segment — internet-facing, or crossing into office IT? | Exposure | Reachable from outside the segment | Isolate it now; put the patch at the top of the queue. |
| 2. Is the CVE on CISA’s Known Exploited Vulnerabilities (KEV) catalog or being exploited in the wild? | Exploitability | Listed on KEV or active exploitation reported | Treat as urgent even if the CVSS score looks moderate. |
| 3. Is the device safety- or production-critical? | Impact if it fails | A line-down or safety event if compromised | Plan an OEM-coordinated window; don’t wait for a generic patch cycle. |
| 4. Can you compensate without patching right now? | Time you can safely buy | No compensating control available | Apply a control if one exists; if not, escalate the maintenance window. |
The first two questions do most of the work. If a device is reachable and the flaw is being exploited in the wild, it goes to the top regardless of score. Exposure is its own discipline — we cover finding internet-reachable PLCs separately; this post is about deciding which patch moves once you know what’s exposed.
What do you do when you can’t patch?
Most of the time, the honest answer in OT patch triage is “not this week.” That’s fine — as long as you put a compensating control in place to hold the risk until a real window opens. The ones that work:
- Segment or isolate the device. Move it off any path that reaches the internet or office IT. Segmentation is the highest-leverage control here — it’s why we treat IT/OT network segmentation as foundational, not optional.
- Restrict and monitor access. Allowlist the few sources that need to talk to the device; route human access through a jump host you can log and watch.
- Disable unused services and ports. A vulnerable service you’ve turned off can’t be exploited.
- Virtual patching. An IPS or network rule that blocks the exploit pattern buys time without touching the device.
- Coordinate a real window with the OEM. When the patch finally goes in, it goes in with the machine builder, on a planned stop, with a rollback path agreed in advance.
A compensating control is not a permanent fix. It’s a way to move an urgent advisory off the “emergency” pile so the actual patch can happen safely.
How do you build a repeatable OT patch triage cadence?
OT patch triage only works if it runs on a rhythm instead of a panic. What we run for manufacturing clients:
- Inventory the OT assets. You can’t triage what you haven’t listed — every PLC, HMI, historian, gateway, and engineering workstation, with its vendor and firmware level.
- Map exposure. Know which of those assets can be reached from the internet or from office IT, and which are truly isolated.
- Watch the advisories. Subscribe to CISA ICS advisories and your specific vendors’ feeds, so a relevant CVE reaches you the week it drops.
- Risk-rank weekly. Run each new advisory through the four questions above; most get a compensating control and a scheduled window, not an emergency.
- Batch into planned windows. Group patches into maintenance stops you already have, coordinated with the OEM, and test a restore before and after.
The point of a cadence is that no single advisory becomes a fire drill. Record-high disclosure volumes are only unmanageable without one. Most advisories, run through this loop, end up as a line in a spreadsheet with a compensating control and a target window — not a middle-of-the-shift scramble. The two or three per quarter that are genuinely reachable and exploited are the ones that earn a real interruption, and a cadence is what lets you tell them apart.
What QOS MSP owns vs. your machine vendor
Here’s the honest division of labor, because OT is one place a managed IT provider can overpromise. QOS MSP has delivered IT since 2007 — nearly two decades — and for OT environments we own the network and decision side: we inventory your OT assets, map their exposure, risk-rank every advisory, apply network-side compensating controls (segmentation, access control, virtual patching, monitoring), and coordinate the patch window with your machine vendor.
What we don’t do — and won’t claim to — is patch device firmware or program the PLC or HMI itself. That stays with the OEM who built and warranties the equipment; touching it outside their process is how you void support or trip a safety system. Our job is to make sure the right patch is scheduled, the risk is contained until it is, and nothing on your network leaves an OT device reachable that shouldn’t be.
If you run a handful of PLCs already behind a firewall and your machine builder patches them on a service contract, you may not need a managed OT program yet — a periodic exposure review might be enough. When advisories, segmentation, and vendor coordination start outrunning your team, that’s the point to bring in help. That’s what our network security services and security administration are built for. Talk to us if you want a second set of eyes on what’s exposed on your shop floor.
Frequently asked questions
Should I patch OT systems by CVSS score?
No. CVSS ignores whether the device is actually reachable or being exploited. Prioritize by exposure and exploitability instead: an internet-reachable device with a flaw on CISA’s Known Exploited Vulnerabilities catalog outranks a higher-CVSS bug buried on an isolated segment.
How often does CISA release ICS advisories?
Almost every week, and often several on the same day. For example, CISA issued two ICS advisories on August 18, 2026, and another on August 20, 2026. ICS vulnerability disclosures reached record highs in 2026, so treating every advisory as an emergency does not scale.
What is a compensating control in OT patch management?
A safeguard that reduces risk when you cannot patch immediately: network segmentation, restricting and monitoring access through a jump host, disabling unused services and ports, or virtual patching with an IPS rule. It buys time until an OEM-coordinated maintenance window opens.
Can patching a machine myself void the warranty?
Often yes. Many OT systems are vendor-locked, and applying firmware or OS updates outside the OEM’s process can void support or warranty and, on safety systems, create a hazard. Coordinate patches with the machine builder rather than pushing them like office updates.
Does QOS MSP patch our PLCs and HMIs?
No. QOS MSP inventories OT assets, maps exposure, risk-ranks advisories, and applies network-side compensating controls such as segmentation and virtual patching, then coordinates the patch window with your machine vendor. Programming the PLC or flashing device firmware stays the OEM’s job.
What is the difference between IT and OT patching?
IT patching assumes reboots and maintenance windows; OT patching does not. Shop-floor systems run continuously, may use legacy unsupported operating systems, and carry safety and downtime risk, so patches are triaged by exposure and scheduled with the vendor rather than applied on Patch Tuesday.
