Investigating the Vast World of ICS Coverage: Part 1

**Executive Summary:** Censys updated its scanning methodology to include standard-port ±1 scans for ICS protocols and, via an ATG case study (scanning ports 10000 and 10002 vs standard 10001), discovered ~1.3K ATG hosts (~20% of ~7K successful responses) on non-standard ports; adopting ±1 scanning increased measurable coverage for several ICS protocols (WDBRPC ~1.8×, DIGI ~2.8×, FINS ~1.9× and notable increases for BACNET, S7, IEC60870_05_104, OPC_UA, DNP3, ATG), and further targeted measurements are planned to refine protocol coverage and port targeting.