The emergence of frontier AI models such as Anthropic’s Claude Mythos and OpenAI’s GPT-5.6-Cyber, among others, has delivered advanced vulnerability discovery and rapid exploit development to the industry. Major vendors are already seeing an unprecedented volume of vulnerability disclosures, and enterprises are facing equally challenging pressures to prioritize and remediate security issues.
The introduction of frontier AI models and AI-powered cybersecurity has also signalled that traditional vulnerability management may be on its last legs and must cede to exposure management, where organizations obtain and maintain visibility into critical assets and make remediation and mitigation decisions based on the greatest risk to the business. Exposure management moves beyond just patching vulnerabilities, and requires an organization-wide understanding of the digital attack surface.
This blog will detail five challenges around OT exposure management, and suggest five solutions that can help reduce risk via exposure management. These include:
Understanding the unique nature and risks of OT
Reducing risks posed by legacy technologies and protocols
Learning how to prioritize exposure mitigation
Validating attack paths
The details that make up a OT security program
The Growing Need for OT Exposure Management
Exposure management is a key evolution of risk management, especially as AI-powered cybersecurity becomes more integrated into overall OT security programs. Exposure management combines the contextual information gathered from asset visibility tools, asset inventories, and overall asset management and informs the overall security program.
This is a much more thorough approach than traditional vulnerability management that is reliant upon vendor-supplied criticality scores that don’t take into account overall system context and business outcomes.
Exposure management covers a broader range of business risks stemming not only from software and firmware vulnerabilities, but also from poor access controls, insecure system and network configurations, legacy protocols, and more. The context derived from asset management capabilities is critical as controls such as virtual network segmentation are applied. These controls require insights such as machine-to-machine communication, which highlights some of the attack paths an adversary may take in order to take advantage of a glaring exposure.
Ultimately, exposure management is a more complete security approach that informs more complete remediation and mitigation activities, and reduces overall risk.
Five Core Challenges in OT Exposure Management
Managing the High-Impact Risk of Unique OT Assets
OT assets pose a higher impact risk in the event they are compromised due to their unique nature and the critical environments in which they operate. Any disruption or manipulation of these assets could impact critical services or the physical safety of employees or the public.
Propagating the risk further is the legacy nature of many of these assets. Outstanding vulnerabilities should be considered forever-day vulnerabilities given that security and feature updates are no longer available for unsupported assets. Insecure configurations, unpatched known exploited vulnerabilities (KEVs), insecure remote access, and overprivileged systems access are critical exposures that jeopardize an organization’s financial health, compliance efforts, and insurability.
Eliminating Visibility Gaps Across OT Assets and Protocols
Communication over legacy protocols that lack basic security features can also put organizations at risk since systemic changes are avoided given their potential to disrupt OT processes or cause physical harm.
Existing enterprise security monitoring and visibility solutions may be blind especially to these protocols given their proprietary nature. Claroty research released in November 2025 coinciding with the availability of the CPS Library found that 88% of OT assets currently do not transmit an exact product code, and 76% transmit product names that differ from the vendor's official record.
This leaves security teams struggling to ascertain whether they have a complete picture of the assets in their environments, and can be left with a partial correlation of vulnerabilities to individual assets, creating blind spots, prolonged exposure to attacks, and incomplete remediation.
Prioritizing an Overwhelming Volume of Vulnerabilities
Since Anthropic announced the Claude Mythos preview and Project Glasswing in April, Microsoft has issued more than 1,300 CVEs across its monthly security updates, including 570 in July and 421 in August. The post-Mythos spike in disclosures is not exclusive to Microsoft; Adobe, Cisco, and other vendors participating in Project Glasswing are also reporting record numbers of new CVEs across product lines.
While uncovering exploitable software vulnerabilities is an overall positive for enterprises, those companies now are tasked with managing this influx of disclosures, prioritizing them against business outcomes, testing patches, and deploying them to affected systems. Given the volume, it stands to reason that some systems may sit exposed and vulnerable longer.
The White House’s recently announced Gold Eagle vulnerability clearinghouse promises to use frontier AI-model capabilities to find, validate, and recommend remediations for critical security issues. Finding software and firmware vulnerabilities has never been an issue for researchers and vendors. Developing a process for fixing vulnerabilities at scale, and eliminating classes of vulnerabilities remains a decades-old challenge.
Critical infrastructure organizations heavily reliant upon OT assets cannot just shut down production lines or critical patient care systems to update medical systems or devices. Identifying vulnerabilities at an unforeseen scale puts further stress on engineers and asset operators in environments where downtime is largely unacceptable and mitigations figure to remain in the form of compensating controls for the foreseeable future.
This puts more of a priority on an exposure management approach to defending critical systems and assets. Such a strategy hinges on systems that bring contextual information to assessments that determine the likelihood of an asset being exploited, its business impact if compromised, and recommendations for compensating controls.
The Complexity of Validating Attack Paths in OT Environments
Having a contextual understanding of machine-to-machine communication in OT environments is critical to understanding how an attacker might target critical assets and achieve lateral movement in the event of compromise.
Mapping attack paths requires visibility into network connections and process dependencies. A complete asset inventory is critical, listing not only every connected device, but identifying data flows between digital and physical systems, and understanding trust relationships between each. Asset inventories must be organized, regularly updated, physically validated, and tied to an OT-specific taxonomy to be accurate or defensible.
Only then can an inventory become more than a catalog of assets, and instead is a resource that supports a risk management program. Exposures such as unsupported operating systems, end-of-life assets, and legacy protocols are dependencies that can increase risk.
Each, in turn, can become a valid attack path putting OT assets at risk. It’s crucial that organizations run attack simulations that illustrate these attack paths, frequently test controls in order to prevent attackers from crossing over to OT assets from the enterprise network. An assessment of these validations must identify the attack paths creating the riskiest exposures, and also highlight chokepoints that can be used to disrupt attacks through updated firewall rules or manual OT safety system overrides.
Mobilizing a Unified OT Security Program
Full mobilization of an OT cybersecurity program requires integrations into existing cybersecurity workflows, OEM alliances to support remediation paths onsite, downtime and maintenance considerations, and program recommendations and support to prove the value of the cybersecurity program over time.
Further emphasizing this challenge is the fact that more than 95% of CISOs in critical infrastructure sectors are or will soon be responsible for securing not only their organization’s IT environment but also their OT environment.
A purpose-built security platform such as Claroty xDome provides automated recommendations and detailed reporting in order to fully mobilize your overall cybersecurity program. Capabilities include:
Recommended actions: Claroty xDome provides device recommendations with various approaches including asset-centric hardening and patching, or network compensating controls.
Reporting: In addition to prioritizing and executing on remediation tactics, Claroty xDome also provides reporting and dashboards to review effectiveness and improvements in security posture.
Technical alliances and integration: Our industry-leading technical alliance program provides our customers with a robust portfolio across cybersecurity and asset management platforms to streamline remediation
Exposure management strategies aim to empower users further to understand their OT cybersecurity weaknesses, better allocate existing resources, and accelerate their OT security cybersecurity programs.
Talk to an expert about CPS exposure management and Claroty xDome.
