Frontier AI models can turn a newly published CVE into a working exploit in hours. In most OT environments, the patch for that CVE waits for the next planned outage, which may be months away. Some controllers will never get a patch at all.
That puts one question ahead of any severity score: can an attacker actually reach the vulnerable asset, and what does it take to cut off the route?
Exploits are outpacing fixes
Exploiting vulnerabilities is now the most common way into networks. The 2026 Verizon Data Breach Investigations Report (DBIR) puts it behind 31% of breaches, a 55% rise in one year, and 38% in manufacturing. Third parties were involved in 61% of manufacturing breaches, and every vendor connection into a plant is a possible route in.
Remediation is slowing down. Organizations fully remediated just 26% of CISA KEV vulnerabilities in 2025, down from 38%, and the median fix took 43 days, up from 32. Those are IT patch cycles. OT maintenance windows run far longer.
Anthropic made the same point when it launched its Critical Infrastructure Defense Program in October 2026: it is easier than ever to find vulnerabilities, but verifying, prioritizing and fixing them is still hard. It also noted that some OT fixes can take decades to apply safely.
Why CVSS-based patching doesn't fit OT
Most vulnerability programs sort findings by CVSS, KEV status or threat intelligence and patch from the top of the list. That works when patches exist, and when a vulnerability with no known exploit can safely wait.
In OT, many controllers run operating systems their vendors no longer support, and some of those vendors have been acquired or shut down. Where patches exist, they are scheduled around production. And once attackers can generate exploits on demand, "no known exploit" says little about what to fix first.
OT networks are also less isolated than their diagrams suggest. Remote maintenance access, vendor links and IT connections opened for past projects often stay open. A typical intrusion starts in IT and then looks for a way into the plant network. Those connections are much easier to change than the controllers behind them.
How Astelia approaches it
Astelia works on top of the vulnerability scanners you already run, such as Tenable, Qualys or Rapid7. It maps the network through read-only integrations with your existing security and network tools. The map includes firewall rules, segmentation, and the remote-access routes between IT and OT zones. Astelia's agentic AI then works out what each vulnerability needs to be exploited, such as a specific port, protocol, service or privilege level, and checks whether the network allows it.
Each finding comes back as reachable or unreachable, with the evidence. In a typical environment ~99% of the backlog turns out to be unreachable. For the remaining ~1%, Astelia shows the attack path.
The fix is usually made on the network rather than the controller. That might be an IPS/IDS or WAF rule placed where it blocks the path for every asset behind it, a segmentation or configuration change that removes the route, or tighter controls on the jump hosts and vendor connections an attacker would use. Astelia can apply these mitigations automatically, with an audit trail and optional human approval, and without stopping production. Where a patch is the better fix, the team knows which vulnerabilities justify a maintenance window.
Where to start
AI has shortened the time between disclosure and exploit, and OT patch cycles won't shorten to match. Three steps help whatever tools you use:
- Find every point where IT connects to the plant network, including jump hosts, historians and remote-access gateways.
- List every vendor an d remote maintenance connection, who owns it, and whether it is still needed.
- Check which vulnerable OT assets sit behind those crossing points, and close those routes before you plan patches.
Reachability analysis does the third step across the whole environment, with evidence for every finding.
See which of your OT assets an attacker can reach. Book a demo
