It means the same flaw can have a physical effect: a stopped line, a robot that behaves unpredictably, or a sensor that reports the wrong thing. Rank the dependency by what the machine can do if it fails, not by the score alone, and patch through a safe, tested process.
Why is a shop floor different from a server room?
NIST defines operational technology as programmable systems and devices that interact with the physical environment, and its guide, SP 800-82 Rev. 3, says OT security must account for performance, reliability and safety. A web server that restarts costs minutes. A conveyor controller that restarts mid shift may jam a line, and a mobile robot that loses its map may stop in an aisle.
That changes how you read a vulnerability notice. A flaw that needs local access to a device in a locked cabinet is a different animal from one reachable through the warehouse Wi-Fi.
How do you find out what a robot contains?
Ask the manufacturer for a bill of materials for each firmware release. CycloneDX describes hardware bills of materials as a way to inventory hardware components for IoT, industrial control systems and other embedded or connected devices, together with the firmware they run. A software list on its own tells you the libraries. The hardware list tells you the board.
Then match it against vulnerability data. When a notice appears for a library, you want to answer "which of our machines include it" in minutes, not weeks.
How should you rank what you find?
Use three questions in order.
Can it be reached? Network exposure, remote support links and shared Wi-Fi decide this.
What can the machine do if misused or if it fails? A scanner that reads barcodes is not a forklift.
How hard is the safe patch? Some updates need a maintenance window, a re-validation walk and a sign-off. Plan for those up front.
What to do
- List every robot, controller and gateway by model and firmware version, and where it sits on the network.
- Request bills of materials from each supplier, in SPDX or CycloneDX, and ask for a new one with each release.
- Check the lists against known vulnerabilities and tag each hit with reachability and physical impact.
- Isolate fleet networks from office networks, and restrict who can reach management interfaces.
- Write a patch procedure per machine type: test unit first, maintenance window, rollback plan, post-patch safety check.
- Add a contract clause for notification time when a listed component has a known vulnerability.
- Use ISA/IEC 62443 vocabulary, such as part 2-4 for service providers and part 4-1 for product suppliers, so responsibilities are clear.
Where does Safeguard fit?
Safeguard's CLI can scan an SBOM file supplied by a vendor, and its reachability analysis helps separate what your own code actually calls from what is merely present. Reachability applies to software you can analyze, not to a closed firmware image.
What does a worked ranking look like?
This is an illustration with hypothetical details, not a report of a real event. A scan of supplier bills of materials finds the same vulnerable library in two places: the barcode scanners on the packing line and the controller of a mobile robot fleet.
Both have the same score. The scanners are on a segmented network, can only read codes and can be swapped in minutes. The robot controller is reachable from the fleet management server, moves heavy loads and needs a maintenance window and a walk-through after any change.
Ranked by reach, impact and patch difficulty, the controller goes first for planning, because it has the larger consequence and needs the longer lead time. The scanners get patched in the normal cycle. You book the controller's window, ask the supplier for a tested update and prepare a rollback plan.
The same score led to two different actions, which is the point of ranking by physical impact.
Quick check
Is a high severity score always urgent on a robot?
No. Combine it with reachability and what the machine can do. A high score on an unreachable device may wait for a window.
Do we have the right to ask suppliers for an SBOM?
You can ask, and put it in the purchase terms. Many buyers now do.
Sources
- NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CycloneDX Hardware Bill of Materials capability
- ISA/IEC 62443 series of standards
Last reviewed: 18 October 2026.
