Exploitable weaknesses in SCADA, ICS, and industrial networks, found by hand by an engineer who knows what not to touch.
Industrial control systems that once operated in isolation are now connected to enterprise networks, cloud platforms, and remote access tools. That convergence has created attack paths that didn’t exist a decade ago, and most organizations haven’t tested for them.
Standard network penetration tests can crash PLCs, trigger safety shutdowns, or disrupt production. It takes more than tools. It takes an engineer who understands industrial protocols, puts availability first, and knows the difference between a vulnerability you can exploit and one that will take a plant offline.
Raxis OT penetration testing is built around one non-negotiable principle: your operations keep running. Every test is scoped, coordinated, and executed with your team. A thorough test, and the plant keeps running.
Supervisory Control and Data Acquisition systems are the command layer of your industrial environment, and a high-value target for attackers. Raxis evaluates SCADA servers, historian databases, HMI interfaces, and the communication pathways between them for vulnerabilities that could allow unauthorized monitoring, data manipulation, or operational disruption.
Programmable Logic Controllers, Remote Terminal Units, and other field devices are the workhorses of industrial automation. Raxis tests these controllers for default credentials, insecure firmware, unprotected programming interfaces, and protocol-level vulnerabilities that could allow an attacker to alter set points, inject false data, or shut down processes.
Flat networks get breached. Raxis assesses your OT network architecture against defense-in-depth principles, evaluating segmentation between IT and OT zones, DMZ configurations, firewall rule sets, and communication paths between Purdue Model levels. We identify where an attacker crossing from the enterprise network could reach critical control systems, and where your segmentation actually holds.
Modbus, DNP3, OPC UA, EtherNet/IP, PROFINET, BACnet, industrial protocols were designed for reliability, not security. Many transmit data in plaintext with no authentication. Raxis analyzes protocol traffic for exploitable weaknesses, including command injection, replay attacks, man-in-the-middle opportunities, and unauthorized read/write access to control system data.
Remote access to OT environments has exploded, for vendors, engineers, and operators. Raxis evaluates jump hosts, VPN configurations, remote desktop deployments, and third-party access pathways for weaknesses that could give an attacker a direct tunnel into your industrial network. We test whether your remote access controls would survive a determined adversary.
The boundary between IT and OT is where most real-world attacks cross over. Raxis specifically targets the systems, services, and data flows that bridge these environments, Active Directory dependencies, shared file servers, historian connections, and cloud integrations, to determine whether an attacker with enterprise network access can pivot into your industrial control systems.
Power generation, transmission, and distribution networks run on SCADA and ICS infrastructure governed by NERC CIP requirements. Raxis tests these environments to identify vulnerabilities that could impact grid reliability, safety systems, or regulatory compliance.
Rail signaling systems, traffic management, port operations, and pipeline controls all depend on industrial automation. TSA Security Directives are driving mandatory security assessments across surface transportation. Raxis tests these environments to meet compliance and protect operations.
Treatment plants and distribution networks rely on remote sensors, automated chemical dosing, and SCADA-controlled processes. A compromised controller doesn’t just leak data, it can affect public health. Raxis helps water utilities secure the systems that matter most.
Network operations centers, power management systems, and infrastructure monitoring platforms often run on OT-adjacent technology. Raxis identifies where operational technology overlaps with communications infrastructure to close gaps before they’re exploited.
Production lines, robotics, quality control systems, and building automation all rely on industrial controllers and networks. Downtime is revenue loss. Raxis tests manufacturing OT environments to protect uptime, intellectual property, and safety systems.
01
OT testing starts with trust. Raxis works closely with your operations, engineering, and security teams to define scope, identify critical assets, establish testing windows, and set ground rules that protect system availability. No surprises. No cowboy testing.
02
Before touching any live system, our engineers review network diagrams, asset inventories, firewall configurations, and remote access architectures. We identify high-risk pathways and potential pivot points on paper first, reducing risk and maximizing the value of active testing.
03
Raxis monitors OT network traffic to map communications, identify devices, and detect anomalies without sending a single packet that could disrupt operations. This non-intrusive phase reveals protocol usage, trust relationships, and unencrypted data flows across your industrial network.
04
With full coordination and your team standing by, Raxis performs controlled active testing against in-scope systems. We test authentication mechanisms, probe controller interfaces, attempt privilege escalation, and validate segmentation boundaries, always with availability as the top priority.
05
When we find a way in, we show you how far it goes. Raxis demonstrates realistic attack chains, from initial network access through lateral movement to reaching critical control systems. Our signature storyboard walkthroughs map the full path an attacker would take, complete with proof-of-concept evidence.
06
Real skill leaves evidence. Findings land in the Raxis One portal with risk ratings, proof-of-concept documentation, and remediation steps written for OT, where patching isn’t always an option and compensating controls matter. We debrief with your team so every finding is clear and actionable.
Mandatory cybersecurity standards for the bulk electric system in North America
International standard for industrial automation and control system security
Guide to operational technology security for industrial control systems
Cybersecurity requirements for pipeline and surface transportation operators
UK guidance for cyber security of industrial automation and control systems
Chemical Facility Anti-Terrorism Standards for high-risk chemical facilities
Pipeline SCADA security standard for the oil and gas industry
Our engineers understand industrial protocols, control system architectures, and the operational realities of testing environments where availability is non-negotiable. This isn’t an IT pentest team dabbling in OT.
Every test is coordinated with your operations team, scoped to protect critical processes, and executed with the caution that industrial environments demand. Raxis has never caused an unplanned outage during an OT engagement.
Most OT attacks originate in IT. Raxis tests the entire attack path, from enterprise network to control system, so you see the real risk, not just isolated OT findings.
We know you can’t always patch a PLC on a running production line. Raxis provides compensating control recommendations alongside traditional remediation steps, so your team has options that work in the real world.
Our stories are based on real events encountered by Raxis engineers. Some details have been altered or omitted to protect customer identities.
When a prominent medical entity engaged Raxis to assess the security of their internal network, they expected our team to call out the usual suspects: unpatched endpoints, response poisoning, maybe Kerberoasting a forgotten service account or two. What our team uncovered instead was a direct path from their production network to a control system managing one of the most tightly regulated pieces of equipment on their property, a linear accelerator.
The engagement started at the IT perimeter. The facility’s network was large and complex in the way large medical environments often are. Once inside the perimeter, Raxis identified a subnet that had a broader internal network space than the others. Using credential pairs harvested from an unprotected internal share, the Raxis team began mapping the environment. What our team found on the other side of that subnet stopped them in their tracks.
It wasn’t immediately apparent, but a few “help” commands typed into the terminal revealed that a control system associated with one of the hospital’s Linear Accelerators (LINACs) was reachable from the production network. No compensating controls. No jump host. No out-of-band access requirement or MFA. Just an open telnet connection to a system that, in the wrong hands, could manipulate the operational parameters of a machine designed to deliver ionizing radiation to a living patient. The Raxis team queried the device. It responded. When they checked the credentials, the system was configured exactly as it had left the factory floor.
Default username. Default password. Full access.
In a real attack scenario, this is the moment that potentially ends careers, triggers federal notifications, and makes news. A LINAC misconfigured to deliver the wrong dose, to the wrong field, or without the proper safety interlocks engaged isn’t a data breach; it’s a catastrophe waiting to happen. For this customer, it was an immediate escalation to their CISO and facilities leadership before continuing any further in that area of the environment.
This engagement was a stark reminder that OT risk doesn’t announce itself. It hides inside network diagrams that haven’t been updated, inside upgrade projects that didn’t include a security review, and inside the quiet assumption that critical systems are isolated because they’re supposed to be. Raxis OT penetration testing finds these assumptions before someone with bad intentions does.
SCADA systems, distributed control systems (DCS), programmable logic controllers (PLCs), remote terminal units (RTUs), human-machine interfaces (HMIs), historian servers, safety instrumented systems (SIS), building automation systems, and the network infrastructure connecting them. If it controls a physical process, we can assess it.
No. Raxis prioritizes availability above all else. Every test is scoped and coordinated with your operations team, and our engineers use non-intrusive techniques wherever possible. Active testing against live systems is performed only with explicit coordination and your team standing by.
Yes. Many OT assessments require physical proximity to field devices and industrial networks. Raxis engineers can test on-site at your facility, or we can deploy our Raxis Transporter device for remote testing with onsite-quality results.
OT environments use industrial protocols, embedded controllers, and legacy systems that standard penetration testing tools and techniques aren't designed for, and can damage. OT pentesting requires specialized knowledge of industrial architectures, safety constraints, and the ability to test without disrupting physical processes.
Timelines depend on environment size and scope. A focused architecture review or segmentation assessment may take 1–2 weeks. A comprehensive ICS penetration test covering network assessment, controller testing, and IT/OT boundary analysis typically runs 2–4 weeks. We'll provide a detailed timeline during scoping.
Yes. IT penetration tests don't cover industrial protocols, control system devices, or the unique architecture of OT environments. More importantly, they don't test the IT/OT boundary, which is the most common attack vector for industrial breaches. OT penetration testing fills a critical gap that IT testing alone cannot address.
OT testing targets industrial control systems, SCADA, PLCs, DCS, and the networks that run physical processes in facilities. IoT testing focuses on connected devices, their firmware, wireless communications, and cloud integrations. Both are specialized disciplines, and Raxis offers each as a dedicated service line.
