Our Blog

In mid-October, Mitsubishi Electric disclosed serious flaws across its ICONICS software family. Fixes are available for current products. For three older ones, MC Works64, GENESIS32 and BizViz, the vendor said it will release no patches at all. Its advice is to migrate to newer platforms and restrict network access in the meantime. That is a familiar story for anyone doing OT vulnerability management. A large share of industrial advisories leave you with a workaround instead of a fix.

The Dragos 2026 OT/ICS Cybersecurity Year in Review puts numbers on it. Dragos found that 26% of ICS advisories offered no vendor patch or mitigation. It also found that 25% of ICS-CERT and NVD vulnerabilities carried incorrect CVSS scores. So the standard IT scan-and-patch playbook does not hold up well on the plant floor. This post lays out a practical plan for the systems you cannot patch.

Why OT Vulnerability Management Needs Its Own Playbook

In IT, a critical CVE usually means a patch window within days. In OT, the same alert can sit for months. Plants run on validated configurations. A patch may need vendor-approved testing and a planned outage before it goes in. Some systems run software that is no longer sold or supported.

Even when a fix exists, it can carry side effects. CISA’s October 27 advisory for EPICS Base, an open-source control system framework, is a good example. The fixed release closes four flaws, including one scored 9.8. But the maintainers warned that older Channel Access clients may not interoperate with it. Teams were told to test legacy clients before rolling it out.

The threat picture makes waiting risky. Dragos counted 119 ransomware groups targeting industrial organizations in 2025, up from 80 the year before. Manufacturing made up more than two-thirds of ransomware victims. Average ransomware dwell time in OT environments was 42 days.

Step 1: Know What You Actually Have

You cannot manage risk on assets you have not found. Build an inventory that goes past hostnames and IP addresses. For each OT asset, record the software version and firmware level. Note the vendor support status too. Flag anything the vendor has declared end of life.

Visibility is still a weak spot for many plants. In a 2026 Fortinet survey of more than 700 OT professionals, about 23% said they could see only half of their OT environment. Passive network monitoring is a good first step here because it does not touch fragile devices.

Step 2: Prioritize by Exposure, Not Score Alone

CVSS was designed for IT systems. It says little about whether a bug can actually reach your process. Dragos classed only 2% of ICS-relevant vulnerabilities as needing action right away. That leaves room to schedule most fixes around planned maintenance.

Ask a few plain questions for each finding:

– Is the device reachable from the internet or the business network?
– Is there a public exploit, or is it on CISA’s Known Exploited Vulnerabilities list?
– What happens to safety and production if this asset fails?
– Is a vendor fix planned, or is the product end of life?

An unpatched historian on an isolated network is a different problem from an unpatched HMI with a remote access path. Rank them that way.

Step 3: Build Compensating Controls That Hold

When no patch is coming, the goal is to make the flaw hard to reach. Segmentation does most of the heavy lifting. Put unsupported systems in their own zone, following the zone and conduit model in ISA/IEC 62443. Allow only the specific traffic the process needs.

Lock down remote access next. Route vendor and engineer sessions through a single monitored jump host. Require multifactor authentication and time-limited approval for each session. Remove direct inbound paths to OT assets.

Then apply the vendor’s specific workarounds. Mitsubishi, for example, published file-level steps for the unpatched ICONICS products. These steps are easy to skip because they are not a clean install. Track them like a patch, with an owner and a verification date.

Finally, add detection around the gap. If an asset cannot be fixed, alerting on unusual traffic to it is the next best thing. Dragos noted that organizations with full OT visibility contained ransomware incidents in about five days on average.

Step 4: Put Migration on the Capital Plan

Compensating controls buy time. They are not a permanent answer. Every unpatchable system should have a documented replacement path with a target date and an owner.

Treat legacy HMI and SCADA software the same way you treat aging drives or PLCs. Bring it into the capital planning cycle early. Migrations often take a year or more once you count engineering work and outage scheduling.

Step 5: Assign Clear Ownership

Unpatched OT risk often falls between IT and operations. Fortinet found that 60% of organizations now place ultimate OT security responsibility with the CISO. That helps, but the plant still needs a named person who can approve an outage or a network change. Write down who owns each decision, including who signs off on residual risk.

The People Side of the Problem

All of this depends on people who understand both control systems and security. That mix is hard to find. Many teams have strong controls engineers and a capable IT security group, but few people who can bridge them. OT security engineers who can design segmentation without breaking the process are in high demand.

Conclusion

No-patch advisories are not rare events in industrial environments. They are part of normal operations. The plants that handle them well know their assets and rank risk by real exposure. They also treat workarounds and migrations with the same discipline as patches. Start with the inventory and work forward from there.

If you need engineers who can do this work, Converge Resources helps companies find OT security and controls talent. You can learn more at www.ConvergeResources.com.