The Value of Penetration Testing ICS/OT Environments

**Executive summary:** This blog outlines when and how organizations should pursue penetration testing for ICS/OT environments, recommending that tests be performed only after foundational activities like architecture reviews and site assessments; it promotes an "assumed breach" approach to maximize value within limited testing time, emphasizes OT-specific safety and availability tradeoffs (including use of defanged exploits), and explains that tests aim to validate mitigations and reveal potential operational impacts such as loss of view, loss of control, loss of confidence, impaired process control, and inhibited response functions.