How to check whether your plant has internet-exposed controllers

To check for exposed controllers, list your public IP ranges, search them in the same kinds of scanning services attackers use, compare the results with your inventory, and review perimeter firewall rules for any inbound path to industrial ports. Then close, restrict or protect whatever you find.

Why attackers see you first

CISA's Siemens S7 alert says the actors used internet scanning services such as Censys and ZoomEye to find exposed or poorly segmented controllers. The May 2025 joint alert says OT devices often lack strong authentication, can be found quickly with internet search tools, and that the attack tools are available to anyone with a browser. Asking what a scanner sees of you is a fair first test.

Step 1: gather your address space

Collect public IP ranges and domains from your network team, internet provider, cloud accounts and any cellular modem contracts. Include sites and plants that IT may not manage directly.

Step 2: search with permission

Use public scanning services only against ranges you own or are authorised to assess. Search by your address ranges and organisation name. Note anything that looks industrial: engineering ports, web interfaces for HMIs, remote desktop, VPN gateways.

Do not probe devices you do not own, and do not log in to anything you find, even with a default password.

Step 3: compare with your inventory

Every hit should map to a known asset with an owner. Hits without an owner are the priority. This is also a check on the inventory itself, which CISA's guidance says to maintain with periodic checks for internet accessible devices.

Step 4: review firewall rules

Look for inbound rules and port forwards to internal addresses, especially to industrial ports. For example, the Siemens alert advises blocking TCP port 102 at perimeter firewalls, and the Unitronics advisory describes access through the default TCP port 20256. Ask who requested each rule and whether it is still needed.

Step 5: act on findings

1. Remove the exposure where there is no business need. CISA lists this first among its primary mitigations.
2. Where access is needed, put it behind a VPN or gateway with phishing resistant multifactor authentication.
3. Replace default passwords.
4. Add logging and alerting for logins to those paths.
5. Record the decision and review date.

Repeat it

Exposure returns when a contractor adds a quick remote link. Run the check on a schedule, for example monthly for large sites, and after any network change. Add it to the commissioning checklist for new equipment.

What this will not show

Scanning shows what is reachable from the internet, not what is reachable from your own IT network or from a vendor tunnel. Combine it with an internal review of IT to OT paths.

Quick check

Sources

• CISA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A
• CISA, Primary Mitigations to Reduce Cyber Threats to Operational Technology
• CISA, IRGC-Affiliated Cyber Actors Exploit PLCs, AA23-335A

Last reviewed: 19 October 2026.