Sites were mapped in days rather than weeks with nothing installed on the operational estate and no appliance procurement cycle required, producing an inventor…
OT networks block agent-based discovery, and passive monitoring tools produce inventories and vulnerability lists but offer no path to policy enforcement. Teams were falling back on manual Wireshark captures taking days per site, stalling segmentation projects because no one trusted the resulting map. The CMDB was reliably wrong, and proprietary protocols defeated generic tooling.
Outcome: Sites were mapped in days rather than weeks with nothing installed on the operational estate and no appliance procurement cycle required, producing an inventory reflecting what was actually on the wire rather than the asset register.
Lessons learned: Treat OT asset identity and traffic behaviour as two separate data problems and source each with the lightest tool that meets the requirement, rather than forcing one platform to do both poorly. Showing customers the policy before enforcement is what converts an OT segmentation conversation from a risk discussion into a schedulable change.
Contributed by: Duncan Hart, Regional Sales Manager, Colortokens
Trust state: claimed