OT Asset Inventory: Why Excel Is a Security Risk

The Reality of Plant Inventories #

Ask a maintenance manager: "How many PLCs do you have on the network?"

Typical answer: "I think about 50. I have the spreadsheet right here, last updated in 2023..."

Reality: you have 85. Those 35 extras are PLCs on new machines a vendor installed, Raspberry Pis an intern set up, and unmanaged switches hidden in control panels. This is called "Shadow OT".

Active vs Passive Scanning: Be Careful Not to Take the Network Down #

In the IT world you use tools like Nmap or Nessus to flood the network with pings and probes ("Who are you? Which ports do you have open?").

In OT, this is dangerous. An old PLC (e.g., an older Allen-Bradley PLC-5 or Siemens S7-300) has a very weak network stack. If it receives too many requests per second it can get overwhelmed and stop controlling the machine. Result: plant down.

The Solution: Passive Scanning (Deep Packet Inspection) #

The safe way to discover assets is to "listen without talking." You use a switch with a SPAN (mirroring) port to copy all network traffic to a passive OT monitoring probe.

The probe analyzes the packets:

• It sees a Modbus TCP packet from IP 192.168.1.50.
• It reads the MAC header: "This is a Rockwell Automation device."
• It parses the payload: "It is responding to read commands with firmware v20.1."

Done! You discovered a PLC, its brand, model and firmware, without sending it a single bit.

Benefits of an Automated Inventory #

Conclusion #

Excel is not a cybersecurity tool. If your inventory is not automatic and real time, you have no visibility. And without visibility, there is no security.