Contents
Introduction
Operational technology (OT) automates the hazardous, complex or repetitive tasks that are hard to manage by hand. Industrial control systems (ICS), supervisory control and data acquisition (SCADA), and distributed control systems (DCS) work together to keep real-time control over physical assets in sectors such as manufacturing, energy, transport and utilities.
Those systems were built to run in isolation, and many are now well past their original design life, which leaves them exposed as they connect to wider networks. Every new link to IT systems, the cloud or a remote-access tool adds another route an attacker could take.
Penetration testing is a proactive way to find and fix those weaknesses before an attacker reaches them, and doing it well protects uptime while extending the working life of ageing OT equipment. This article looks at how penetration testing as a service (PTaaS) applies to OT, how an engagement works in practice, and how it compares with a traditional one-off test.
Cybersecurity vocabulary for all sectors, let alone OT, can be very confusing. Our A-Z cybersecurity glossary is here to help you with any terms you’re unfamiliar with.
OT security versus IT security
The short version is that IT protects data, while OT protects uptime and safety. IT systems tolerate the occasional glitch and get patched regularly on a 3 to 5 year cycle. OT equipment can stay in service for 15 to 20 years, often cannot be patched on demand, and has to keep running because downtime has real-world consequences.
| IT security focus | OT security focus |
|---|---|
| Protecting data | Protecting uptime and safety |
| Tolerates temporary glitches | Downtime can have real-world consequences |
| Tooling is mostly automated | Tooling must be manual or passive |
| Frequent patching | Patching often is not feasible |
That difference is why OT testing cannot borrow IT’s aggressive methods wholesale. For PTaaS, the point to carry forward is that testing has to stay safe and passive by default.
What is penetration testing as a service (PTaaS)?
Penetration testing in OT is a controlled exercise where ethical hackers simulate a cyberattack on your operational systems to find vulnerabilities, without causing damage or downtime. PTaaS delivers that testing through a cloud platform that combines automated tooling with expert manual testing, so assessments run continuously rather than as a single annual event. It suits teams that want to test more often, for example after each significant code or configuration change.
For the broader discipline behind it, and how OT testing differs from standard IT work, see our guide to OT penetration testing.
What PTaaS gives you
- Continuous testing and faster fixes: a traditional test can take weeks to schedule and report. PTaaS surfaces findings sooner, so your team can act on them quickly.
- Near real-time visibility: vulnerabilities appear as they are found, and remediation can start straight away.
- Control over scope and timing: you can launch tests on demand, set what is in scope, retest specific fixes, and escalate findings as they arise.
- A subscription model: paying monthly spreads the cost and lowers the price per test compared with repeated standalone engagements.
Threats change constantly, and a single annual test leaves long blind spots between assessments. More frequent testing gives you a better chance of catching a problem before an attacker does.
How a PTaaS engagement works
PTaaS in OT follows a repeatable set of stages, each built around protecting the live process. The summaries below focus on how each stage works inside a continuous PTaaS model, rather than repeating the OT safety fundamentals.
1. Discovery and scoping
You and the security team agree what is in scope (SCADA systems, PLCs, IoT gateways), what must not be touched, the safest testing windows, and who needs to be kept informed. Scoping is the most important stage of any OT engagement, because it sets the boundaries that keep testing safe.
2. Passive network mapping
The testers observe the network without interacting with it, identifying connected devices, firmware versions and how everything communicates, using passive tools such as Wireshark and GRASSMARLIN. This listen-only approach is central to safe OT testing, because it maps the environment without risking a fragile controller.
3. Vulnerability identification
With the layout mapped, the platform runs automated scans against in-scope targets for known issues, for example the OWASP Top 10 on any web interfaces, while experienced testers add manual work to find the logic flaws that scanners miss. Aggressive automated scanning is kept well away from fragile live controllers, where it is most likely to trigger an outage.
4. Safe exploitation
Any exploitation happens in a test or mirrored environment, never on the live plant floor, to show what an attacker could achieve, such as altering a sensor reading or reaching an HMI, without the real-world risk. On live SCADA and ICS equipment this needs particular care, which we cover in testing live OT systems safely.
5. Reporting and recommendations
You get a report that explains each finding, rates its severity, and gives step-by-step remediation advice, usually with a live dashboard to track fixes over time. That dashboard is where PTaaS differs from a one-off test: progress stays visible continuously rather than landing in a single end-of-engagement PDF.
6. Follow-up and retesting
Once fixes are applied, the testers confirm they worked, since one change can break another, because PTaaS is continuous, and this loop repeats on a regular schedule rather than waiting a year for the next test.
Does PTaaS cover the full stack?
In principle, a mature PTaaS programme can extend across your whole digital estate, not just OT. Depending on the provider and your needs, that can include:
- Web application penetration testing and API testing
- Network penetration testing, internal and external
- Mobile application penetration testing
- Cloud platform testing across providers such as AWS and Google Cloud
- IoT, ICS and embedded system testing
- Wireless network testing
- Red team simulations, social engineering and phishing exercises
- Testing mapped to regulations and standards such as GDPR, PCI DSS and HIPAA
How PTaaS supports compliance
If you are working towards SOC 2 or ISO 27001, PTaaS gives you evidence that you test for security risks regularly, not only once a year, which fits the risk-based approach those frameworks expect. For PCI DSS, it helps you meet the requirements for quarterly scans, annual penetration tests, and checks after significant system changes.
The reporting matters here too. Clear dashboards let you show auditors exactly what was tested, what was found, who is fixing it, and when it was retested, all in one place. Even non-technical stakeholders get visibility that the systems are being looked after.
For OT specifically, the UK National Cyber Security Centre’s operational technology guidance is a useful reference point, and a PTaaS programme can be mapped to OT-focused standards such as IEC 62443 and NIST SP 800-82.
What to look for in an OT PTaaS package
A strong OT PTaaS package should include:
- Passive asset discovery
- Vulnerability detection tailored to ICS devices
- Safe testing in mirrored environments
- Real-time dashboards and tracking
- Regulatory mapping (for example NIS2, IEC 62443, NIST SP 800-82)
- Support and training for your OT staff
Ask whether the provider also offers threat intelligence updates, segmentation testing such as IT and OT firewall reviews, and response simulation exercises that test how your team would react to a live incident. Whoever you choose should understand your systems, work in a way that respects your uptime, and be able to talk to your engineers on their terms.
PTaaS as an ongoing programme
OT cybersecurity is about building long-term resilience into the systems that run essential services, rather than passing an annual audit and moving on. PTaaS supports that by turning testing into an ongoing process, giving you a continuous view of your vulnerabilities and a way to manage risk as it changes.
Paired with red and purple team exercises, it gives you both breadth and depth: regular technical testing across the estate, plus a realistic view of how an attacker would move and whether your team would notice. If you want to explore PTaaS for your OT environment, talk to Fortfii and we will help you scope a programme that fits your systems and your risk appetite.
PTaaS FAQs
What is PTaaS?
PTaaS, or penetration testing as a service, delivers penetration testing through a cloud platform that combines automated tooling with manual testing by experienced testers. Rather than a single test once a year, it runs continuously, so you can test on demand or after a change and track the fixes in one place.
How is PTaaS different from a traditional penetration test?
A traditional test is a one-off engagement with a fixed scope and a report at the end. PTaaS turns that into an ongoing service: testing recurs on a subscription basis, findings appear in near real time, and retesting is built in. The underlying OT penetration testing methodology is the same; what changes is the frequency and how you access the results.
Is PTaaS safe for OT systems?
Yes, when it is run with OT in mind. Safe OT testing relies on passive network mapping, testing in mirrored environments rather than on the live process, and careful manual work in place of aggressive automated scans. For how this is handled on live control systems, see our guide to testing live OT systems safely.
Does PTaaS help with compliance?
It does. PTaaS gives you documented, repeatable evidence of regular testing, which supports frameworks such as SOC 2, ISO 27001 and PCI DSS, and can be mapped to OT standards such as IEC 62443 and NIST SP 800-82. The dashboards make it straightforward to show auditors what was tested, found, fixed and retested.
How often does PTaaS test?
As often as you need. Because it runs on a continuous model, you can trigger tests on demand, after a code or configuration change, or on a set schedule, rather than waiting for an annual engagement. That steady cadence is the main advantage over one-off testing.