ICS vulnerability management that matches every OT advisory to the firmware you run, so the real exposures are named the same day, each with a dated plan
Which advisories affect our substations? Answered today.
See one case, screen by screen ↓Every week national CERTs and equipment makers publish advisories on RTUs, protection relays, PLCs, gateways, HMIs, switches and engineering software. For each one the OT security analyst opens the national advisory, the vendor's PSIRT page or a PDF, finds the affected and fixed versions, and searches the asset register by product name. A name match raises every device in the family, so the queue fills with assets that already run a fixed release, and engineers stop trusting the alerts.
Meanwhile the bulletins that never reach the national feed are missed: in 2025 only 22 % of vendor-published ICS vulnerabilities had a CISA advisory. Severity alone also misleads — a CVSS 9.3 flaw on a drive reached only over a serial link is less urgent than a 9.8 on an RTU any host on the SCADA WAN can reach. And when the auditor asks for the assessment and a dated action plan with its status, as NERC CIP-010-4 R3.4 requires, it has to be pieced together from email and spreadsheets. One NERC CIP settlement covered 127 violations and a $10M penalty.
Estimated split for a typical week of about 26 advisories and bulletins, using the team's own 20–40 minutes per careful read and inventory lookup, by hand and with the solution (the after column is the analyst's and the lead's review time).
Six agents read every advisory, match it to installed firmware and draft the plan; the vulnerability lead signs.
Lumina Utilities runs 4,286 OT assets in 37 product families — 64 substations, 3 power plants, 2 water plants, 41 pumping stations and 2 control centres. On Tuesday, October 13, 2026, its RTU maker publishes a critical flaw with no national advisory. Here is what happens next, screen by screen, in the working solution.
Corvane Automation publishes PSA-2026-019 as a PDF on its PSIRT page: an authentication bypass in the DNP3 file-transfer function of the CA-RTU7 remote terminal unit, CVE-2026-41732, CVSS 9.8. The source watcher pulls 12 sources — the national CSAF feed, 9 vendor security pages and 2 CERT feeds — and links repeats of CVEs it has already read. It flags this one as vendor-only.
Pull log: “1 new · PSA-2026-019 from Corvane PSIRT (PDF) · no national advisory”
Leena owns the exposure list. Her home screen is a matrix of severity against exposure, where every dot is one asset Lumina owns: 8 open exposures on 129 assets. Critical × High holds 6 Norrland NR-Gate 220 gateways at pumping stations, day 5 of 7. On the left the feed already carries each verdict — HX-900 not installed, no PX-12, a VEX statement clearing the BW-1200 PLCs. Only the Corvane bulletin is not yet matched.
“I don't need 212 alarms. I need the 14 that are real, today.”
Leena presses Match to assets. The advisory reader reads the 6-page PDF: affected 3.0.0–3.2.6, fixed in 3.2.7. The source watcher checks the national feed and both CERT feeds again — still vendor-only. The firmware matcher finds 212 CA-RTU7s in the inventory and draws their firmware: 171 on 3.3.1, 24 on 3.2.7, 10 on 3.2.5 and 7 on 3.2.2.
“Firmware matcher — 14 in service inside the range · 9 on 3.2.5 · 5 on 3.2.2 · 3 more not in service (2 spares, 1 test bench)”
On the bulletin, each extracted fact is highlighted where the vendor wrote it: the product, the affected range, the fixed release, the prerequisite and the workarounds. The device is exposed only when TCP 20000 is reachable, file transfer is on — the factory default — and DNP3 Secure Authentication is not enforced. The two spares in the Kelmar depot and the unit on the Ravensworth test bench are set aside and flagged to be flashed before issue.
“212 — a product-name match would raise · 14 — in service on affected firmware”
The exposure scorer reads substation firewall rule FW-SUB-STD-12: it allows TCP 20000 from the whole SCADA WAN, 10.40.0.0/16, not just the two master stations, and Secure Authentication is off on all 14. Severity Critical, exposure High. The 14 dots fly from the bulletin into the top-right cell, which goes from 6 assets to 20, and EX-2026-0141 is raised.
“This year a product-name match would have raised 3,960 assets; firmware matching raised 611”
EX-2026-0141 lists the 14 RTUs at 11 substations — 7 at 132 kV, from Arden Cross to Kestrel Point, and 4 at 33 kV — with firmware, address and Secure Authentication state. Today any of 1,146 SCADA WAN addresses can reach TCP 20000 on all 14. The reason is in the rule revision: these 11 substations run FW-SUB-STD-12 rev 7; the other 53 run rev 9, masters only.
Mitigate by Oct 20 · remediate by Jan 11, 2027 · name match vs firmware match: 212 → 14
A detection rule for DNP3 file functions 25–30 from any host but the masters, today. Restrict TCP 20000 at 11 substation firewalls to 10.40.1.10 (Ravensworth) and 10.48.1.10 (Fenwick) — Priya Raman, change CHG-26-3318, approval Grace Mwangi, Oct 15. Disable file transfer, object group 70, by remote setting change with no outage — Tomás Ferreira, Oct 16. Firmware 3.2.7 after 3 days on the test bench, in planned maintenance windows — 14 work orders, Dec 4.
“Agents proposed it; nothing on site changes until the change and work orders are approved.”
Leena reviews the rating, the reasons and the four actions and signs with her password; the meaning of her signature is recorded with it. The detection rule goes live at 08:06. Change CHG-26-3318 goes to Grace Mwangi at Ravensworth Grid Control Centre, who approves every change that touches a live substation, and work orders WO-88412 to WO-88425 go to Tomás Ferreira for the outage windows. The signed plan, with its dates and status, is the action plan for the vulnerability assessment record.
“I confirm the rating Critical × High and approve this action plan.” — signed Oct 13, 08:05
The brief writer drafts the weekly exposure brief for Daniel Okoro, the CISO: what is new, what is most exposed, what is being done and by when, and what is late. Every line links to its exposure record. It is drafted on Fridays at 15:30 and sent at 16:00, only after Leena approves.
“One new critical exposure, at 11 substations — mitigation starts today”
The same bulletin, seen by the five people who act on it — what their week looked like, and what it looks like now.
Six agents read every advisory, match it to installed firmware and draft the plan; the vulnerability lead signs.
Pulls the national CSAF feed, 9 vendor security pages and 2 CERT feeds every 30 minutes, removes duplicates of the same CVE across sources and flags bulletins with no national advisory.
Reads each advisory in CSAF, HTML or PDF and extracts the products, affected and fixed versions, CVEs, scores, prerequisites such as ports, services and settings, and the vendor's workarounds — each with its passage.
Matches each product and version range to the exact firmware installed on each asset, using the asset register, passive monitoring, SBOM and VEX files, and separates in-service assets from spares and test equipment.
Places each match on the matrix: severity from the vendor score and known exploitation; exposure from reachability in the firewall rule base, zones and conduits, whether the vulnerable service is enabled, compensating controls and site criticality.
Drafts the dated action plan from vendor workarounds and Lumina's playbooks, in order — detection, network restriction, setting change, firmware — with owners, change requests and work orders in maintenance windows.
Writes the weekly exposure brief for the CISO and operations in plain words, from the matrix and the action plans.
Confirms every rating, signs every plan. The agents propose; a named person decides.
Ask in plain words — or tell it what to change. Every answer points to the bulletin, the inventory or the firewall rule behind it.
Which substations does the Corvane bulletin affect?
14 CA-RTU7s at 11 substations, all on firmware inside 3.0.0–3.2.6: Arden Cross (2), Bellmoor, Calder Ridge (2), Elsworth Grid, Glenhaven, Hollin Bay (2) and Kestrel Point at 132 kV; Dunmere, Farrow Lane, Iverby and Juniper Flats at 33 kV. All 14 accept DNP3 from the whole SCADA WAN under rule FW-SUB-STD-12, so they sit in Critical × High.
Why aren't the other 198 Corvane RTUs exposed?
Because of the version, not the name. 171 run 3.3.1 and 24 run 3.2.7, both outside the affected range; 3.2.7 is the fixed release. Firmware comes from the asset register, confirmed by passive monitoring in the last 24 hours. Three more on 3.2.x are not in service — 2 spares in the Kelmar depot and 1 on the test bench — and are flagged to be flashed before issue.
What can we do before the firmware outage?
Three steps need no outage: today, a detection rule for DNP3 file functions 25–30 from any host but the masters; Oct 15, restrict TCP 20000 at the 11 substation firewalls to the two masters (change CHG-26-3318, Grace Mwangi approves); Oct 16, disable DNP3 file transfer in the RTU settings. Firmware 3.2.7 then goes into planned maintenance windows by Dec 4.
Treat vendor-only bulletins with CVSS 9 or more as Critical
Done. New rule: “A vendor bulletin with CVSS 9.0 or more and no national advisory is rated Critical until a national advisory confirms or revises it.” It already matches today's Corvane bulletin. 12 of this year's 41 real exposures came from a vendor bulletin only. You can change the rule in Settings.
13 screens from the working solution, on its sample data. Pick one to see it large.
How exposure is judged, how fast each cell must move and who decides are settings, chosen by the OT security team.
| Setting | Default | Choose from |
|---|---|---|
| High exposure | Reachable from the SCADA WAN, a remote-access path or the corporate network | Medium: reachable only inside its own zone (station bus, plant cell) · Low: not routable — serial link, isolated, in stores or on the test bench |
| Clock for Critical × High | 7 days to mitigate · 90 to remediate | Every cell has its own days to mitigate and remediate, from 7 days to the next maintenance window or track — click a cell to change it |
| The vulnerable service must be enabled for High | On | On · Off — checked in the RTU and relay settings export |
| A proven compensating control lowers exposure by one level | On | On · Off |
| Count spares and test units as Low and flag them to be updated before issue | On | On · Off |
| Known exploited in the wild | One level more severe | On · Off — the vendor's severity is never lowered (locked) |
| Confirm a rating, sign a plan, approve the brief | Leena Varghese | Live-site changes: Grace Mwangi · firmware into an outage window: Tomás Ferreira (grid), Hamid Rahimi (water) · VEX: Omar Siddiqui, reviewed by Leena Varghese |
| Weekly brief | Drafted Fridays 15:30 · sent 16:00 after approval | To Daniel Okoro, with a copy to 4 |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate, from the team's own 20–40 minutes per advisory and about 26 advisories and bulletins a week · “typical” = published figures (Forescout, ICS cybersecurity in 2026: 508 CISA ICS advisories covering 2,155 CVEs in 2025, and 22 % of vendor-published ICS vulnerabilities with a CISA advisory, from ICS Advisory Project data). Regulatory context: NERC CIP-010-4 R3; one NERC CIP settlement in 2019 covered 127 violations and a $10M penalty (SecurityWeek). Lumina Utilities, every person, site, vendor, product, advisory and CVE number named on this page are fictional — characters and sample data in the working solution.
It is the work of reading every advisory about industrial control equipment, finding which of your own devices are affected, judging how exposed they are and planning the fix. ICS Vulnerability Management does this with six agents that read every national advisory and vendor bulletin, match it to the exact firmware installed and draft a dated mitigation plan; the vulnerability management lead confirms and signs.
The advisory reader extracts the affected and fixed versions from the CSAF, HTML or PDF, with the passage behind each. The firmware matcher compares them with the firmware on each asset from the asset register, passive monitoring, SBOM and VEX files, and separates in-service assets from spares and test units. For the sample Corvane bulletin a name match would have raised 212 RTUs; 14 were affected.
It reads the vendors' own security pages and the CERT feeds in your source list as well as the national feed, and flags a bulletin that has no national advisory. At Lumina, 12 of this year's 41 real exposures came only from a vendor bulletin.
Each exposure sits on a matrix of severity against exposure. Severity comes from the vendor's score and known exploitation; exposure from who can reach the vulnerable service through the firewall rules, whether that service is enabled and what controls stand in the way. Each cell has its own clock, from 7 days to mitigate for Critical × High.
CIP-010-4 R3.4 asks for the results of the assessment and an action plan with planned completion dates and the status of each item. In the solution, each exposure keeps its matched assets, the reasons for its rating, the dated actions with their status and the lead's signature, all on the activity trail.
Yes. The agents have read-only access and never change a device, a setting or a firewall rule. Only the vulnerability management lead confirms a rating or signs a plan, any change to a live site needs the control room's approval, and firmware goes into outage windows only when the asset owner accepts it.
Yes. What counts as High, Medium and Low exposure, the days to mitigate and remediate in every cell, the compensating-control and spares rules, who confirms and approves, and when the weekly brief is drafted and sent are all settings.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your source list, asset register, firewall rule base and mitigation playbooks — and it goes live once every quality gate has passed. We will walk you through it on your own advisories first.
Audit binders built continuously, not in a 30-day scramble.
1-min demoThird-Party Cyber Risk ManagementEvery supplier answer checked against its evidence before you sign.
1-min demoOT Patch ManagementEvery OT patch evaluated inside the 35-day window, with a dated plan if it must wait.
1-min demoWe'll run ICS Vulnerability Management on a sample of your own advisories and your asset register.