How Often Should African Manufacturers Conduct VAPT?

Manufacturers in Africa should generally conduct Vulnerability Assessment and Penetration Testing (VAPT) at least annually, with more frequent testing based on cybersecurity risk, network changes, regulatory obligations, and exposure to external threats. Quarterly vulnerability assessments can provide additional visibility into emerging weaknesses, while penetration testing should be scheduled according to the criticality of the environment and the potential impact of testing on production operations. Industrial control systems, operational technology (OT), remote access connections, and internet-facing assets may require additional testing after significant changes or security incidents.

There is no single VAPT frequency that applies to every manufacturing facility. A manufacturer operating a small production plant with limited external connectivity has different security requirements from a large industrial group with multiple factories, interconnected operational technology, and third-party maintenance access. The appropriate testing schedule should reflect these differences while maintaining production availability and worker safety.

For manufacturers across South Africa, Nigeria, Kenya, Egypt, Morocco, Ghana, and other African markets, a risk-based VAPT programme can help identify exploitable weaknesses in production networks before attackers use them to disrupt manufacturing processes, access sensitive information, or compromise industrial systems.

Strengthen your cybersecurity posture with INTERCERT’s Vulnerability Assessment and Penetration Testing (VAPT) services. Identify security weaknesses across applications, networks, APIs, and cloud environments.

What Is VAPT for Manufacturing Production Networks?

Vulnerability Assessment and Penetration Testing combines two related security activities. A vulnerability assessment identifies known weaknesses, misconfigurations, outdated software, and exposed services across an agreed scope. Penetration testing uses controlled techniques to determine whether selected vulnerabilities can be exploited and what access or impact might result.

In manufacturing environments, VAPT may cover corporate IT networks, production servers, industrial network segments, remote access gateways, engineering workstations, and selected operational technology assets. The scope depends on the facility's architecture, business priorities, safety requirements, and testing authorisation.

Manufacturing networks require particular care because cybersecurity weaknesses can affect more than business data. A compromised system may interrupt production scheduling, interfere with the availability of industrial applications, expose intellectual property, or create conditions that affect physical operations.

Vulnerability Assessment vs Penetration Testing in Manufacturing

A vulnerability assessment identifies and prioritises weaknesses across systems within the agreed scope. It may include network discovery, configuration checks, vulnerability scanning, and analysis of known vulnerabilities. Its findings provide visibility into the security condition of the environment at a particular point in time.

Penetration testing goes further by examining whether selected weaknesses can be exploited under defined conditions. Depending on the scope, testers may assess authentication controls, network segmentation, access permissions, exposed services, and possible attack paths between connected systems.

For example, a vulnerability assessment may identify an outdated service on a production network. A penetration test may examine whether an attacker could exploit that service to obtain unauthorised access or move from a corporate network into a restricted environment. Any attempt involving operational technology must follow agreed safety restrictions and approved testing procedures.

Both activities have a role in a manufacturing security programme. Vulnerability assessments can take place more frequently because they provide recurring visibility into known weaknesses. Penetration testing generally requires more detailed planning, particularly when production systems have limited maintenance windows or cannot tolerate active probing.

Production Networks, Industrial Networks, and OT Environments

A manufacturing facility often operates several connected technology environments. The corporate IT network includes systems such as email, enterprise resource planning platforms, business applications, and office endpoints. The industrial network connects production equipment, engineering systems, industrial servers, and supervisory applications. Operational technology includes hardware and software that monitor or control physical processes.

Programmable logic controllers (PLCs), supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), human-machine interfaces (HMIs), and industrial sensors may form part of an OT environment. Their security requirements differ from those of ordinary office systems because availability, predictable performance, and physical safety are central considerations.

A VAPT programme should account for these differences rather than treating every device as a conventional IT endpoint. Some industrial assets may not tolerate standard scanning techniques, and certain legacy systems may have limited vendor-approved testing methods. The testing scope and methods should therefore be agreed with the plant's operational and engineering teams before activity begins.

Why VAPT Frequency Matters for Manufacturers in Africa

Manufacturing networks change as companies introduce new equipment, connect additional facilities, adopt cloud-based applications, and provide remote access to suppliers or maintenance contractors. Each change can introduce new exposure or alter existing security boundaries. A testing schedule that does not account for these developments may leave important weaknesses undetected between scheduled assessments.

Manufacturers operating across African markets may also face different regulatory obligations, customer expectations, supply chain requirements, and technology constraints. These vary by country, industry, and the type of information or infrastructure involved. A risk-based approach allows organisations to consider their actual operating environment instead of applying one frequency to every facility.

Cyber Risks Facing African Manufacturing Operations

Manufacturers face cyber risks involving ransomware, credential theft, unauthorised remote access, exploitation of unpatched systems, insecure network configurations, and attacks through third-party connections. Threat actors may target corporate systems first and then attempt to reach production environments where network segmentation or access controls are weak.

Industrial environments can also contain legacy equipment that cannot be updated as frequently as modern IT systems. Such constraints can increase the importance of understanding exposed services, network pathways, access permissions, and compensating security controls.

The risks are not identical across Africa. A manufacturing business in South Africa may operate under a different combination of legal, customer, and sector-specific requirements from a facility in Kenya, Nigeria, Egypt, or Morocco. Multinational manufacturers should consider the requirements applicable to each site alongside group-wide cybersecurity policies.

VAPT frequency should reflect these factors, including the sensitivity of production processes, the extent of external connectivity, the potential consequences of compromise, and the speed at which the network changes.

Operational and Financial Impact of Infrequent Testing

Infrequent testing can leave vulnerabilities undetected for longer periods, particularly when new assets, software changes, or remote connections are introduced between scheduled assessments. If an attacker exploits an overlooked weakness, the resulting incident may interrupt production, delay customer orders, increase recovery costs, or expose confidential manufacturing information.

A compromised corporate account may also create a route towards production systems if identity controls and network segmentation are inadequate. Similarly, an insecure supplier connection may introduce risk even when the manufacturing company's own systems have not recently changed.

Regular VAPT does not eliminate these risks, and a clean test result does not guarantee that a network is secure. It provides evidence about the weaknesses identified within the agreed scope and at the time of testing. Combining recurring assessments with vulnerability management, monitoring, access control reviews, and timely remediation creates a more consistent view of network security.

How Often Should Manufacturers Conduct VAPT?

Manufacturers should establish an annual penetration testing baseline where appropriate, supplement it with more frequent vulnerability assessments, and schedule additional testing when significant changes or incidents alter the network's risk profile. The precise frequency should be documented in the organisation's cybersecurity policy and aligned with applicable regulatory, contractual, and customer requirements.

The following schedule is a practical planning model, not a universal legal requirement or a mandatory frequency prescribed by every cybersecurity standard.

Recommended VAPT Frequency for Manufacturing Companies

A manufacturer's testing calendar can use different frequencies for different activities and network segments. The schedule should consider asset criticality, external exposure, known vulnerabilities, operational constraints, and the time needed to address previous findings.

For example, an organisation may use the following planning approach:

• Annual penetration testing: Assess agreed corporate and production network boundaries, critical applications, and selected attack paths at least once a year, where appropriate to the risk profile.

• Quarterly vulnerability assessments: Review exposed systems, known vulnerabilities, configuration weaknesses, and relevant changes on a recurring basis.

• Additional testing after significant changes: Reassess affected network segments after major architecture changes, new external connections, production system upgrades, or significant security incidents.

• Risk-based testing for critical assets: Consider more frequent testing for internet-facing systems, remote access infrastructure, high-impact production environments, and assets exposed to elevated threats.

• Targeted retesting after remediation: Verify whether important findings have been resolved, using methods appropriate to the affected system and operational constraints.

These activities are complementary rather than interchangeable. A quarterly vulnerability scan does not automatically replace a penetration test, and an annual penetration test does not provide continuous visibility into newly disclosed vulnerabilities.

Annual VAPT as a Baseline

Annual VAPT can provide a structured review of network security, particularly when the organisation's architecture, asset inventory, and risk profile remain relatively stable. It establishes a recurring opportunity to examine security controls, test agreed attack paths, review findings, and compare results across testing cycles.

For manufacturers, annual testing should not be limited to the corporate office network if production systems, industrial connectivity, remote maintenance pathways, or other critical assets are within the intended security scope. The scope should reflect the systems that could materially affect manufacturing operations.

However, annual testing alone may be insufficient for organisations with rapidly changing infrastructure, extensive internet exposure, frequent production upgrades, or high-impact OT environments. These businesses may need additional assessments throughout the year.

Annual VAPT should therefore be treated as a planning baseline where suitable, not as a guarantee that the organisation meets every applicable legal, regulatory, contractual, or industry requirement.

Quarterly and Continuous Vulnerability Assessments

Quarterly vulnerability assessments can help manufacturers identify weaknesses introduced by routine changes, new vulnerabilities, and changes in asset exposure. This frequency may be suitable for many production environments, although higher-risk assets can require more frequent monitoring or assessment.

Continuous vulnerability management does not necessarily mean continuously running active scans against industrial equipment. It can include ongoing asset discovery, vulnerability intelligence monitoring, configuration monitoring, and prioritisation of newly identified weaknesses. Active scanning should be scheduled and configured according to the capabilities and risk tolerance of the affected systems.

For example, a manufacturer may assess corporate IT assets quarterly while reviewing internet-facing services and high-risk vulnerabilities more frequently. Industrial devices may require a different approach, such as passive network monitoring, vendor-approved checks, or carefully scheduled active assessments.

The objective is to reduce the time between the introduction or discovery of a weakness and the organisation's decision to address it. Findings should be prioritised according to exploitability, asset criticality, potential production impact, and the availability of effective mitigations.

Manufacturing Network Penetration Testing Frequency by Network Type

Different parts of a manufacturing environment have different exposure levels and operational constraints. A single testing interval may not be suitable for corporate IT, industrial networks, OT systems, and third-party access pathways. Manufacturers should define separate testing requirements for these environments while assessing the connections between them.

Corporate IT Network Testing Frequency

Corporate IT networks can often accommodate conventional vulnerability scanning and penetration testing more readily than sensitive production systems. These networks may include user endpoints, identity infrastructure, business applications, email systems, file servers, and enterprise resource planning platforms.

An annual penetration test can provide a recurring review, while quarterly or more frequent vulnerability assessments may identify newly introduced weaknesses. Internet-facing applications, VPNs, identity systems, and other exposed services may warrant more frequent checks based on risk.

Testing should also examine whether an attacker who compromises a corporate endpoint or account could reach production networks. Network segmentation, privileged access controls, authentication mechanisms, and restrictions on administrative pathways are relevant areas of investigation.

Where the organisation introduces major infrastructure changes, acquires another business, or deploys new externally accessible applications, targeted testing may be appropriate before or shortly after the change, depending on the risk and release process.

VAPT Frequency for Industrial Networks

Industrial networks connect production equipment and the systems that manage industrial processes. Their exposure may change when machinery is replaced, new production lines are introduced, engineering workstations are updated, or connections are established between facilities.

Manufacturers should establish a documented testing interval based on the network's criticality and exposure. Annual penetration testing may be suitable for some environments, while high-risk segments may need additional targeted testing after changes or security events.

Active testing should not be performed indiscriminately across industrial devices. Some equipment may be sensitive to network traffic, and an aggressive scan can affect performance or availability. Before testing begins, the parties involved should define permitted techniques, excluded systems, escalation contacts, testing windows, and conditions that require activity to stop.

A combination of carefully scoped penetration testing, passive monitoring, configuration review, and vulnerability assessment can provide a more appropriate approach than relying on conventional scanning alone.

OT Penetration Testing Frequency for Manufacturers

OT penetration testing frequency should be based on process criticality, safety implications, network architecture, exposure to external connections, and the feasibility of testing without disrupting production. There is no universal rule requiring every OT environment to undergo the same number of penetration tests each year.

For example, a facility operating critical industrial processes with remote vendor access and extensive connectivity may need more frequent targeted testing than a relatively isolated plant with stable equipment and strong access restrictions. Both still require a documented approach to identifying and managing security weaknesses.

OT testing should consider segmentation between corporate and industrial networks, access to engineering workstations, remote maintenance channels, authentication controls, and potential pathways to critical systems. Where direct testing could introduce unacceptable risk, passive techniques, isolated test environments, and vendor-approved methods may be more appropriate.

The testing schedule should be reviewed when the plant's architecture changes, new threats affect relevant assets, or previous findings reveal weaknesses that materially change the risk profile.

Remote Access and Third-Party Connections

Remote access services and third-party connections deserve particular attention because they can create pathways into otherwise restricted networks. Manufacturers commonly rely on external vendors for equipment maintenance, software updates, troubleshooting, and specialist engineering work.

The organisation should assess VPN gateways, remote desktop services, jump servers, privileged accounts, identity controls, and the network restrictions applied to external users. Testing frequency should reflect the exposure and privileges associated with these connections.

A manufacturer may conduct periodic penetration testing of remote access infrastructure and additional targeted testing after introducing a new supplier connection, changing authentication methods, or expanding access to production systems. The same principle applies when a vendor receives new privileges or when a connection is extended to another plant.

Supplier access should be reviewed as part of the wider security programme. A successful test of the manufacturer's own network does not establish that every third-party system or connection is secure unless those assets are explicitly included in the agreed scope.

Events That Should Trigger Additional VAPT

A fixed annual schedule may not reflect every change in a manufacturing environment. Certain events can alter network exposure or create new attack paths, making additional assessment appropriate before the next scheduled testing cycle.

Network Changes and System Upgrades

Significant network changes can affect firewall rules, routing, segmentation, authentication, and the exposure of internal services. Examples include deploying new network equipment, changing network architecture, migrating applications, introducing cloud connectivity, or modifying access between corporate IT and production systems.

Manufacturers should assess the security impact of these changes and determine whether targeted VAPT is necessary. A minor change may only require a configuration review, while a major architectural change may warrant broader penetration testing.

The decision should be based on the potential impact of the change rather than a blanket requirement to conduct a full penetration test after every modification.

New Machinery, PLCs, and SCADA Deployments

New production equipment may introduce additional network interfaces, remote management features, engineering software, or communication protocols. If these components connect to existing industrial networks, they can change the facility's attack surface.

Before connecting new PLCs, SCADA components, HMIs, or other industrial assets to a live production environment, manufacturers should establish the applicable security requirements and evaluate whether testing is appropriate. Where feasible, security checks can take place in a staging environment before the equipment is connected to operational systems.

The assessment should consider default credentials, unnecessary services, access restrictions, firmware and software versions, communication pathways, and network segmentation. Testing methods must account for the equipment manufacturer's limitations and the consequences of unexpected behaviour.

Security Incidents and Newly Disclosed Vulnerabilities

A security incident may reveal weaknesses that were not identified during previous testing. After containing an incident, manufacturers should determine whether targeted VAPT is needed to establish whether related weaknesses remain or whether the incident exposed additional attack paths.

Newly disclosed vulnerabilities can also justify an out-of-cycle assessment, particularly when the affected systems are internet-facing, connected to production networks, actively exploited, or difficult to patch. Not every vulnerability requires a full penetration test, but the organisation should evaluate exposure and determine the appropriate verification method.

Where remediation changes network controls or system configurations, retesting can establish whether the original weakness remains exploitable. Critical findings should be prioritised according to risk, with compensating controls considered when immediate patching is not possible.

Mergers, Expansions, and New Plant Rollouts

Mergers and acquisitions can introduce networks with different security configurations, legacy assets, unknown external connections, and inconsistent access controls. A manufacturer expanding into a new African market may also deploy additional facilities, connect new suppliers, or establish links between previously separate production environments.

These changes can create risks that are not covered by an existing testing schedule. Targeted assessments can examine newly acquired networks, connections between sites, remote access arrangements, and the boundaries separating production environments.

The scope should be proportionate to the complexity of the change. A new plant with a different OT architecture may require a more extensive review than a small expansion using an established, standardised network design.

Factors That Influence VAPT Frequency for Manufacturers

The right VAPT schedule depends on the likelihood of exploitation and the consequences of a successful attack. Manufacturers should consider technical exposure alongside operational, safety, and business requirements when deciding how often different assets need testing.

Network Size, Complexity, and Criticality

Larger networks can contain more devices, applications, communication pathways, and administrative accounts. Multiple factories, shared services, centralised identity platforms, and interconnected production lines can increase the number of potential attack paths.

Complexity alone does not determine the testing interval. A smaller facility with an internet-facing control system or weak remote access restrictions may face greater exposure than a large but well-segmented network.

Manufacturers should prioritise assets according to their business and operational importance. Systems that could interrupt production, affect product quality, expose sensitive intellectual property, or create safety concerns may warrant more frequent or targeted assessment.

Production Uptime and Safety Considerations

Manufacturing plants often operate within tightly controlled production schedules. Unexpected system behaviour can affect output, equipment availability, and worker safety. Testing frequency must therefore be balanced with the need to identify security weaknesses.

A documented testing plan should define the systems in scope, approved techniques, permitted time windows, contacts for operational escalation, and criteria for stopping the activity. These controls are particularly important for environments where active scanning or exploitation could affect industrial devices.

Safety considerations do not mean that OT systems should be excluded indefinitely from security testing. Instead, manufacturers should select methods that produce meaningful security evidence while respecting engineering constraints and operational risk.

Legacy Systems and Patching Limitations

Legacy industrial systems may run older operating systems, firmware, or software that cannot be updated without vendor involvement or production downtime. Some assets may also depend on software that is incompatible with newer security controls.

Where patching is restricted, manufacturers should establish whether the weakness is exposed, exploitable, or reachable from other network segments. Appropriate measures may include segmentation, restricting remote access, removing unnecessary services, increasing monitoring, and scheduling controlled testing.

Testing frequency should reflect the residual risk. A legacy system with a known exploitable vulnerability and broad network exposure may require more frequent review than an isolated asset with strong compensating controls.

Risk Level and Threat Exposure

Risk can change when a new vulnerability is disclosed, an exposed service becomes reachable from the internet, credentials are compromised, or threat intelligence identifies attacks targeting relevant technologies.

Manufacturers should review the testing calendar when these developments materially affect their systems. High-risk assets may require targeted verification outside the normal schedule, while lower-risk assets can follow the established periodic plan.

A risk-based approach also prevents organisations from treating every finding equally. Vulnerabilities should be prioritised by considering exploitability, exposure, business impact, production criticality, and the effectiveness of existing controls.

Compliance and Regulatory Drivers for VAPT Frequency

Cybersecurity standards and regulatory frameworks can influence how manufacturers plan security testing, but they do not all prescribe one universal VAPT interval. The applicable requirements depend on the organisation's certification scope, sector, location, customer contracts, and the specific framework or law involved.

Manufacturers should distinguish between an explicit requirement in an applicable obligation and a frequency selected as good practice. This distinction is important when developing audit evidence and communicating testing expectations to management.

ISO 27001 Expectations for Security Testing

ISO/IEC 27001 establishes requirements for an information security management system. Its risk-based approach requires organisations to determine and manage information security risks and select appropriate controls.

The standard does not establish a universal rule that every manufacturer must conduct a full VAPT exercise exactly once a year. Security testing frequency should be determined through the organisation's risk management process, applicable controls, legal and contractual obligations, and documented security policies.

Annex A includes controls relevant to technical vulnerability management and security testing. The applicability and treatment of these controls should be determined through the organisation's risk assessment and Statement of Applicability, rather than assuming every control applies identically to every business.

Manufacturers pursuing ISO/IEC 27001 certification should be able to demonstrate that their security testing arrangements are consistent with the risks, controls, and requirements relevant to their information security management system.

IEC 62443 Considerations for Industrial Networks

The IEC 62443 series addresses cybersecurity for industrial automation and control systems. It considers industrial system security across areas such as asset ownership, system integration, component development, and technical security requirements.

The relevant requirements depend on the specific IEC 62443 standard, its intended audience, the system under consideration, and the applicable project or contractual scope. It would be inaccurate to claim that every manufacturer must conduct the same annual OT penetration test under the entire IEC 62443 series.

Manufacturers should identify which parts of the series apply to their industrial environment and determine how vulnerability assessment, security testing, change management, and risk management fit into their security programme.

For OT environments, the testing approach should also account for system availability, engineering constraints, and safety considerations. The objective is to evaluate industrial security without treating control systems as if they were ordinary office computers.

Regional and Country-Specific Requirements in Africa

Africa includes multiple jurisdictions with different privacy, cybersecurity, critical infrastructure, and sector-specific obligations. Requirements that apply to a manufacturing company in one country may differ from those that apply to a facility elsewhere.

For example, South African organisations may need to consider applicable provisions of the Protection of Personal Information Act (POPIA) when manufacturing operations process personal information. Other countries have their own legal frameworks, regulatory requirements, and sector-specific obligations. Whether a particular rule requires VAPT, and how often, must be established from the applicable legal text and relevant regulatory directions.

Manufacturers should identify the requirements that apply to each operating country, including any obligations arising from critical infrastructure designation, financial or telecommunications activities, customer contracts, and cross-border data processing.

A country-specific compliance review is necessary before stating that a particular testing frequency is legally mandatory. Where no prescribed interval applies, the organisation should determine an appropriate schedule based on risk and operational needs.

Customer and Supply Chain Security Requirements

Large customers, international buyers, insurers, and supply chain partners may establish cybersecurity requirements that go beyond a manufacturer's minimum legal obligations. These may include periodic penetration testing, vulnerability management, evidence of remediation, or testing of externally accessible systems.

Manufacturers supplying automotive, pharmaceutical, electronics, aerospace, food production, or other regulated and security-sensitive industries should review the relevant contractual and sector-specific requirements. The required frequency may depend on the customer, the systems involved, and the applicable industry framework.

A manufacturer serving several international customers may need to reconcile different testing expectations within a single security programme. The schedule should account for the strictest applicable obligation without assuming that every customer requirement applies to every network segment.

Building a VAPT Schedule for Production Networks

A practical VAPT schedule assigns testing activities to specific systems, defines the reason for each activity, and establishes how findings will be tracked and verified. It should be reviewed whenever significant operational or cybersecurity changes occur.

Risk-Based Testing Calendar

Manufacturers should begin by maintaining an inventory of relevant IT and OT assets, including network connections, asset owners, criticality, external exposure, and known limitations. The inventory provides a basis for deciding which systems need recurring assessment and which events should trigger additional testing.

The testing calendar should identify the scope, frequency, testing method, responsible stakeholders, approved windows, and requirements for reporting and retesting. It should also distinguish vulnerability assessments from penetration testing so that each activity has a clear purpose.

A sample planning model could include annual penetration testing of agreed network boundaries, quarterly vulnerability assessments for suitable assets, more frequent review of exposed systems, and targeted testing after significant changes or incidents. OT testing should follow a separately defined method where operational risks require additional precautions.

The calendar should be reviewed periodically rather than treated as a fixed document. Findings, new threats, changes in business operations, and the results of previous tests may all justify adjustments.

Scheduling Tests Around Production Cycles and Downtime Windows

Testing should be coordinated with production management, engineering teams, IT personnel, and relevant equipment vendors. The purpose is to choose a time and method that provide useful security evidence without creating unacceptable disruption.

For active testing of sensitive industrial assets, the plan should specify the authorised targets, techniques, timing, communication procedures, and conditions for stopping the exercise. Testing may be scheduled during maintenance windows where appropriate, although the availability of a maintenance window does not automatically make every technique safe.

Passive assessment or testing in an isolated environment may be preferable when a live system cannot tolerate active scanning. Any use of staging systems should account for differences between the test environment and the production configuration.

Clear coordination helps ensure that findings can be interpreted in the context of normal industrial behaviour and that any unexpected impact is addressed promptly.

Prioritizing Critical Assets and Network Segments

Not every asset requires the same testing scope or frequency. Manufacturers should prioritise assets according to the potential consequences of compromise and the likelihood that an attacker could reach them.

Internet-facing systems, remote access gateways, identity services, engineering workstations, and network boundaries between IT and OT often warrant particular attention because they may provide pathways into more sensitive environments.

Critical production systems should be evaluated using methods appropriate to their operational constraints. Where direct penetration testing is unsuitable, manufacturers can combine passive monitoring, configuration analysis, architecture review, and controlled testing of adjacent systems.

Prioritisation should be documented so that decisions about testing frequency can be explained to management, auditors, and relevant customers.

Safe VAPT Practices in Production Environments

A testing programme is effective only when the selected methods are appropriate for the systems being examined. In manufacturing, security testing should account for the possibility that network activity could affect equipment performance or production availability.

Testing Methods That Reduce Operational Disruption

Manufacturers should agree on the scope and rules of engagement before testing begins. These should identify authorised assets, excluded systems, permitted techniques, testing windows, escalation contacts, and the conditions under which testing must stop.

Testers should understand the difference between conventional IT infrastructure and industrial equipment. Broad scans, aggressive service enumeration, and exploit attempts may be unsuitable for certain PLCs, HMIs, SCADA components, or legacy devices.

Where appropriate, testing can focus on network segmentation, exposed services, authentication, access permissions, firewall configurations, and pathways between environments. The selected techniques should be proportionate to the risk and approved by the organisation responsible for the affected systems.

Testing should never be assumed to be risk-free. Manufacturers should consider vendor recommendations, operational procedures, and contingency arrangements before authorising activity against production assets.

Passive Testing vs Active Testing in OT Networks

Passive monitoring observes network communications without deliberately generating intrusive test traffic. It can provide visibility into connected devices, communication patterns, unexpected connections, and certain indicators of misconfiguration or suspicious activity.

Active testing sends traffic or performs controlled actions to evaluate system behaviour and identify weaknesses. Depending on the technique, it may provide stronger evidence about exploitability, but it can also introduce operational risk in sensitive industrial environments.

Neither method is a complete substitute for the other. Passive monitoring may not establish whether a vulnerability is exploitable, while active testing may be inappropriate for equipment that is sensitive to unexpected traffic.

Manufacturers should select a combination based on the system's risk, vendor constraints, and testing objectives. Where active testing is approved, it should be carefully scoped and monitored, with clear procedures for responding to unexpected behaviour.

Staging and Test Environment Use

A staging or isolated test environment can allow security teams to evaluate configurations, applications, and selected attack paths without directly interacting with live production equipment. This can be especially valuable when testing new machinery, software upgrades, industrial applications, or significant network changes.

However, a staging environment may not fully reproduce production conditions. Differences in firmware, configuration, network topology, access permissions, or connected devices can affect the findings.

Manufacturers should document these limitations and determine whether additional production-safe verification is needed. Testing in a laboratory or staging environment should not be presented as proof that the live production network has been fully tested.

For sensitive systems, a combination of isolated testing and carefully selected live-environment checks may provide a more realistic view of security while respecting operational requirements.

Retesting and Remediation Timelines

VAPT findings are valuable only when the organisation evaluates their significance and takes appropriate action. Manufacturers should establish remediation priorities and verification timelines based on the severity and business impact of each finding.

Verifying Fixes After Each VAPT Cycle

Retesting determines whether a previously identified weakness has been corrected or whether the relevant mitigation is effective. The verification method should match the original finding and the system's operational constraints.

For example, a corrected firewall rule may be verified through configuration review and a controlled connectivity test. A vulnerability affecting a production application may require targeted testing to establish whether the original attack path remains possible.

Critical findings should receive priority, especially when they involve exposed systems, privileged access, or pathways into production environments. The exact retesting deadline should reflect the risk, applicable obligations, and the feasibility of making changes safely.

For sensitive OT systems, retesting may require coordination with engineering teams or vendors. If a fix cannot be applied immediately, the manufacturer should document the reason, the interim risk controls, and the planned date for further action.

Tracking Findings Across Testing Cycles

Manufacturers should maintain a record of identified vulnerabilities, severity ratings, affected assets, remediation decisions, assigned owners, and verification results. This record makes it easier to identify recurring weaknesses and assess whether security is improving over time.

Findings that remain unresolved should be reviewed against current exposure and the effectiveness of any compensating controls. A vulnerability should not be considered resolved solely because a patch has been scheduled or a configuration change has been proposed.

Comparing results across testing cycles can reveal patterns such as recurring access control weaknesses, inconsistent configurations across plants, or persistent exposure caused by legacy equipment. These patterns can inform future testing priorities and broader security decisions.

Reporting should distinguish confirmed vulnerabilities from potential risks, clearly state the scope and limitations of the assessment, and avoid implying that a test guarantees complete security.

Common Mistakes in Planning VAPT Frequency

A testing schedule can fail to reflect actual risk when it is based only on a fixed annual date, excludes sensitive environments, or ignores changes between testing cycles. Manufacturers should evaluate the following common planning mistakes when reviewing their VAPT programme.

Treating VAPT as a One-Time Activity

A single penetration test provides a view of selected systems at a particular point in time. New vulnerabilities, configuration changes, new equipment, and changes in attacker techniques can alter the risk after the test has ended.

Manufacturers should establish recurring assessment and testing activities based on risk, with additional reviews when significant changes occur. The interval should be documented and revised when evidence indicates that the existing schedule is no longer appropriate.

Excluding OT and Industrial Networks from Scope

Testing only corporate IT systems can leave important production pathways unexamined. Weak segmentation or insecure remote access may allow an attacker to move from a business network towards industrial assets even if those assets were not directly tested.

Manufacturers should determine whether and how industrial networks can be assessed safely. Where direct testing is unsuitable, alternative methods should be selected and their limitations recorded rather than treating the environment as secure by default.

Ignoring Changes Between Scheduled Tests

A network can change substantially between annual penetration tests. New remote access connections, exposed services, production equipment, and software vulnerabilities may create risks that were not present during the previous assessment.

Organisations should maintain change management and vulnerability monitoring processes that identify when additional security testing is warranted. This allows the testing calendar to respond to changes instead of relying exclusively on fixed dates.

Identify vulnerabilities before attackers exploit them. Connect with INTERCERT for VAPT Services tailored to your organization’s security requirements.

How to Choose a VAPT Provider for Manufacturing Networks

Manufacturers should evaluate a VAPT provider's technical capability, independence, testing methodology, reporting quality, and experience with the systems in scope. Production network testing requires a clear understanding of both cybersecurity risks and the operational limitations of industrial environments.

Industrial and OT Testing Experience

The provider should demonstrate relevant experience with manufacturing networks, industrial protocols, network segmentation, remote access architecture, and OT-related security risks. Experience with conventional web applications or corporate IT systems alone may not establish suitability for testing sensitive industrial environments.

Manufacturers should ask how the provider determines appropriate testing methods, handles safety restrictions, communicates unexpected findings, and distinguishes verified vulnerabilities from theoretical risks. The testing plan should define what can be tested actively, what requires passive assessment, and what must remain outside the authorised scope.

The provider should also explain how findings will be prioritised and how retesting can verify remediation without introducing unnecessary operational risk.

Accreditation, Independence, and Reporting Quality

Manufacturers should verify the provider's relevant credentials, technical qualifications, independence, confidentiality practices, and experience with the required scope. Accreditation may be relevant to certain assessment or certification services, but it should not automatically be assumed that every penetration testing activity is covered by a particular accreditation.

A useful VAPT report should identify the scope and methodology, summarise confirmed findings, explain business and technical impact, state limitations, and prioritise remediation actions. It should also distinguish vulnerabilities that were successfully verified from issues that require further investigation.

For organisations seeking ISO/IEC 27001 certification, VAPT results can form part of the evidence considered within the broader information security management system, where relevant. Certification decisions remain distinct from the delivery of penetration testing, and manufacturers should select services according to their specific objectives.

INTERCERT provides independent certification, audit, assessment, and assurance services. Manufacturers can review the relevant service scope and applicable credentials when determining which services align with their organisational and certification requirements.

Read More:
Penetration Testing Frequency for African Digital Banks
OT vs. IT: Reducing SCADA Vulnerabilities Through Industrial VAPT