What is the role of asset discovery in OT vulnerability management?

• A. Replace with user surveys
• B. Unnecessary if you have a network map
• C. Only for IT systems
• D. Essential to identify all devices to ensure coverage and accurate risk scoring

Answer: (D)

Asset discovery is about building a complete, up-to-date inventory of every device in the OT environment. In vulnerability management, knowing each asset—PLC, HMI, RTU, engineering workstation, sensor—and its specific firmware version, location, and exposure allows you to see where weaknesses truly exist and how they could be exploited. With a full inventory, risk scoring reflects actual exposure across the network, so you can prioritize patches and mitigations for devices that matter most. Even with a network map, discovery remains essential because devices change, get added, or are misconfigured, and maps can be incomplete or outdated in OT settings. This process isn’t limited to IT systems; OT devices require discovery to prevent blind spots. So identifying all devices to ensure coverage and accurate risk scoring is the essential role of asset discovery.