What's Your Cybersecurity Breaking Point?

By Zachary Woltjer, Data Cyber Analyst, Verve, A Rockwell Automation Company

When it comes to prioritizing vulnerabilities in operational technology (OT), many teams still lean on methods created for IT, where data protection often takes center stage. In OT, however, even a brief security lapse can halt a production line or jeopardize worker safety. Tools like the Common Vulnerability Scoring System (CVSS) offer a starting point, but they rarely capture the complexities of a bustling factory or a 24/7 power station.

OT cybersecurity is about more than just keeping operations running — it’s about identifying which systems, if compromised, could trigger widespread disruptions and prioritizing those vulnerabilities first. A single system trip in a critical production line can cause significant downtime or safety hazards, while a less crucial component might have a more limited impact. This leaves OT teams repeatedly asking the same question: Which issues need to be addressed immediately, and which ones can wait?

That dilemma springs from more than just a difference in priorities: it’s also about resources and uptime. OT systems can’t be paused for patches without risking major operational losses, and specialized staff are often spread thin. As a result, teams struggle to make headway on vulnerability backlogs.

Simply put, IT-based frameworks don’t fully address the unique demands of OT, leaving engineers, plant managers, and security professionals without a clear roadmap for meaningful progress.

Where Conventional Scoring Falls ShortThe Common Vulnerability Scoring System (CVSS) is deeply rooted in the CIA triad — Confidentiality, Integrity, and Availability, with confidentiality usually outranking other concerns. However, on a plant floor, a small hiccup that halts production can do far more damage than a stolen file ever would.

In addition, CVSS looks at each vulnerability in isolation, ignoring how multiple minor gaps can cascade into a major breakdown. It overlooks real‑world constraints too.

For example, you can’t always pause critical equipment to apply patches without racking up significant costs. As a result of these constraints, a so‑called “medium” issue in an office might be devastating on an assembly line if it interrupts a vital process — something not accounted for by CVSS.

In OT, you need a way to account for both how bad a failure could be and how likely it is to happen. By weighing those two elements — rather than relying on generic severity labels — teams can zero in on threats that truly endanger safety and steady operations.

A Two‑Part Lens on RiskAt the core of this approach is a fundamental principle: risk equals impact (how bad it could be) multiplied by likelihood (the chance it happens). From there, two major metrics take shape:

1. Calculated Impact Rating (CIR). CIR captures the operational, financial and safety fallout if a device goes down. Consider a large chemical plant, for instance: a brief outage on one production line might be annoying but not disastrous. But a serious failure in a key reactor control system can trigger major downtime or even place employees at risk.

When developing an impact score, security leads and plant managers usually begin by asking, “If this asset were taken offline or tampered with, how big would the disruption be?” They weigh everything from lost production hours and regulatory concerns to potential hardware damage, then assign a rating that guides how urgently each issue should be addressed.

By consistently assigning these ratings, organizations translate vague concerns about “what might go wrong” into data points that can be compared across an entire operation.

2. Likelihood Rating (EPSS). Next, a Likelihood Rating — based on Exploit Prediction Scoring System (EPSS) — estimates which vulnerabilities attackers are focusing on in the real world. While some flaws see few or no exploits, others appear in active campaigns.

EPSS draws from global threat intelligence and known malware strains, and exploit proof‑of‑concepts to predict the chance that a given vulnerability will be used in an attack within a specific time frame.

In OT, the network’s layout can also raise or lower likelihood. An internet‑facing HMI might remain a prime target, while a highly segmented PLC may be comparatively safer. Adjusting these raw scores for local context — such as firewalls, physical isolation or complex authentication — helps teams see whether a “critical” flaw in theory is truly accessible to outside threats.

Combining Impact and Likelihood

Once Impact and Likelihood are calculated, they’re merged in a risk matrix or formula (see table), such as: Risk Score = Impact Rating x Likelihood Rating.

Assets or vulnerabilities that land in the high‑impact, high‑likelihood quadrant receive immediate attention, often requiring a dedicated patch cycle or stronger segmentation measures. Meanwhile, items with moderate or low likelihood might be addressed during planned maintenance or when resources become available.

Although no model can eliminate risk entirely, having a clear mechanism to rank vulnerabilities helps OT teams plan patching schedules and allocate budget more effectively.

Case in Point: Food Manufacturing

During a risk assessment exercise, a global food manufacturer expressed frustration with the limitations of relying on general‑purpose vulnerability scans. On paper, they were faced with hundreds of “critical” vulnerabilities, yet their OT team determined that many of these so‑called critical flaws posed minimal real‑world risk.

In contrast, certain “medium” vulnerabilities had the potential to disrupt packaging lines that generated the company’s highest revenue.