- Will penetration testing disrupt our operations?No. Our methodology is passive-first, active testing is approved per device class in writing, and anything invasive is performed offline. Every engagement runs under agreed rules of engagement with a named operations lead who can halt testing at any moment.
- Do you test live PLCs and controllers?Only with explicit written approval, using targeted and protocol-aware techniques — never broad automated scanning. Where deeper controller testing is required, we replicate the device offline or work with vendor-supplied units.
- Do you test safety instrumented systems?Not in production. SIS assessment is conducted offline or in a lab replica.
- How is this different from our IT penetration test?IT testing prioritises confidentiality and assumes systems tolerate active probing. OT testing prioritises safety and availability, assumes legacy devices that fail under standard scanning, and measures success by process impact rather than vulnerability count.
- How long does an OT assessment take?A readiness assessment typically runs 1–2 weeks. A single-site OT penetration test runs 2–4 weeks. A full OT red team runs 6–12 weeks depending on scope and objectives.
- Can you work around our maintenance windows?Yes. Active phases are scheduled entirely around your production and maintenance calendar.
- Do you hold the clearances required for critical national infrastructure?Clearance and vetting requirements vary by jurisdiction and client. Raise your requirements during scoping and we will confirm what we can meet.
Get AI-Powered + Human Validated Pen Testing!
