Why your business can't trust the data behind its own security decisions

Date:
Thu, 03 Sep 2026 09:18:47 +0000

Description:
Your asset data may be lying to you and it's putting your entire security strategy at risk.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter When a critical vulnerability alert lands in a traditional IT environment, its rarely a cause for panic regarding the operational continuity of the business . The affected laptops, servers, and applications can be identified quickly, and a good team can catalogue and patch them within hours if its urgent. The priorities are
clear, and theres very little guesswork involved. Andrew Lintell Social Links Navigation

General Manager for EMEA at Claroty. Now picture the same alert landing
across a hospital's imaging equipment, a factory floor's control systems, or
a building's HVAC network. These cyber-physical systems (CPS), the connected devices that run physical operations rather than just processing data, sit at the sharp end of IT and OT (operational technology) convergence. But unlike traditional IT assets, confirming whether that alert even applies to a specific device can take days, and often ends in a guess rather than an answer. Latest Videos From TechRadar Watch full video here:

While this kind of uncertainty would be considered a failure of basic
hygiene, for cyber-physical systems, its unfortunately much more often the norm.

So why is this such a widespread problem for CPS, and how can security teams get these vital assets back in line with their IT network? You may like The cyber risk hiding in plain sight Why operational technology risk still slips past the boardroom Mythos shows why AI governance must catch up to the speed of risk discovery Bad visibility into cyber-physical systems is worryingly widespread The inability to manage incoming vulnerabilities for CPS isnt an outlier or worst-case scenario, which is especially concerning when these assets are at the heart of critical infrastructure like energy and
healthcare.

The issue comes down to the product codes that help networks identify what
CPS is in the environment, which is an essential part of identifying and applying security patches. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features
and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Across a dataset of 17 million cyber-physical assets, our research found that 88% failed to transmit an exact product code, and 76% sent a code that didn't match the vendor's own record.

Its a side effect of the way these systems were initially designed and later integrated into modern IT environments. Programmable logic controllers
(PLCs), medical scanners, and industrial sensors were engineered for decades of physical reliability, not for tidy digital labeling. Network
identification was rarely part of the design brief, so the same device can report itself differently depending on which protocol or integration is asking.

We found a similar state of affairs when it comes to the operating systems behind the physical hardware . In our research, 41% of devices have no OS version available, and 24% have no OS name at all. What to read next Why organizations are falling into an AI Security Illusion Predictable attacks, unpredictable defenses: why observability is the real security gap From alert fatigue to autopilot fatigue: How agentic AI shifts cyber risk

Without these details, matching a device to a known vulnerability stops being a quick database lookup or automated process, and becomes a guessing game or painstaking manual search.

Added to this, CVE advisories, the industry's standard mechanism for tracking vulnerabilities, are compiled from this same patchy vendor data. An official advisory can be just as incomplete as the network it's meant to protect. Translating product code chaos into boardroom risk This kind of blind spot adds another layer of concern to a leadership that is already anxious about threat visibility. Among 1,100 security leaders surveyed globally, 44% named understanding their organization's risk exposure as one of their biggest operational concerns, more than compliance pressure or budget constraints.

A further 45% said they were struggling to reduce cyber risk to their most important assets and processes, yet the connection between that struggle and an unreliable asset inventory is often missed entirely. Leadership sees the symptom, a rising sense that risk is unmanageable, without ever seeing the cause sitting underneath it.

This is where security and the business can end up talking past each other. Security teams that start describing the problem in terms of missing product codes and inconsistent naming conventions wont get far.

Business leaders hear none of that; they hear only that risk cannot be quantified with confidence. Until those two conversations are connected,
every risk register that a CISO presents upward carries an asterisk that nobody in the room can see. Context is key to closing the gap Resolving this issue starts with a shift in what visibility means. Knowing a device exists
on the network is only half of the job. Knowing what it does, what process depends on it, and what happens if it's compromised is what actually makes a risk register useful.

Achieving this shift at scale requires specialized tools to manage the often eclectic and proprietary nature of CPS assets, and an automated approach to cope with the scale.

In one example, applying AI-driven mapping techniques to an OEM's device catalogue lifted product code identification from 4% to 83%, turning a near-blind spot into a near-complete picture. The follow-through mattered
just as much, with 56% of devices receiving a new or updated firmware recommendation as a result, and vulnerability identification accuracy improving by 25%.

Numbers like these matter because they change the question security teams can answer. Instead of asking what's connected to the network, teams can ask
which systems would cause the greatest disruption if compromised, and act on the answer with confidence rather than inference. That is the difference between an asset inventory that exists on paper and a resilient one that
holds up under pressure. Fixing the foundation, not just the alarm None of this gets solved by adding another tool to the stack. Instead, it means treating asset data quality as a board-level risk issue rather than
background IT housekeeping, with the same scrutiny applied to budgets, compliance and third-party access.

Achieving this means a new CVE alert no longer triggers a scramble to work
out which critical devices might be affected, but the confirmed, prioritized response youd expect from any good vulnerability management program.

The alert landing on a hospital's imaging equipment or a factory floor's control systems should be no harder to act on than the one landing on a laptop. Getting there starts with making the invisible visible. We've
featured the best firewall software. This article was produced as part of TechRadar Pro Perspectives , our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit



======================================================================
Link to news story: https://www.techradar.com/pro/why-your-business-cant-trust-the-data-behind-its -own-security-decisions


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)