OT pen test findings that plant teams can actually use 

The author argues that many OT penetration test reports produce accurate findings but offer impractical remediations and raw CVSS scores that fail to reflect OT operational context; this undermines credibility and leads asset owners to ignore actionable recommendations. The paper recommends reporting each finding with context-aware risk assessment and a range of fixes — quick wins, mid-term mitigations, strategic/long-term replacements, and compensating controls — and provides examples (Modbus, SNMP, unsupported OS, screen locks, EDR, SSH v1) to show how to make recommendations realistic and useful.