OT Asset Criticality & Exposure Ranker
You cannot protect every OT asset equally, so rank them. Add your assets by form or paste a CSV, and this scores each one on a transparent 0–100 risk model — criticality (safety and business consequence × Purdue level) against exposure (internet/remote reach, patchability, redundancy). You get a sortable table, a risk scatter that puts your crown-jewel, high-exposure assets in the top-right, and a prioritised remediation order. Nothing leaves your browser.
Add an asset
Portfolio
Model: Risk = Criticality × (0.4 + 0.6 × Exposure/100). Criticality blends safety 45%, business 30%, Purdue proximity 15%, redundancy 10%. Exposure blends network reach 50%, patchability 35%, asset surface 15%.
Risk scatter
Criticality (vertical) vs exposure (horizontal). Top-right = protect first.
Ranked assets
| Asset | Type | Purdue | Criticality | Exposure | Risk | Band | |
|---|---|---|---|---|---|---|---|
| Substation RTU | RTU | L1 | 89 | 85 | 81 | Critical | |
| Safety ESD logic solver | SIS | L1 | 96 | 62 | 74 | Critical | |
| Boiler PLC | PLC | L1 | 81 | 54 | 59 | High | |
| Plant HMI (control room) | HMI | L2 | 73 | 65 | 58 | High | |
| Engineering workstation | EWS | L3 | 57 | 66 | 45 | Medium | |
| Vendor VPN appliance | Network | L3.5 | 34 | 87 | 31 | Medium | |
| Flow transmitter | Field device | L0 | 40 | 45 | 27 | Low | |
| Data historian (DMZ) | Historian | L3.5 | 22 | 78 | 19 | Low |
Prioritised remediation order
Remove from the public internet; terminate access in a DMZ; Virtually-patch and tighten network ACLs until a window opens; Add redundancy / tested manual fallback for this single point
Isolate/segment and wrap with compensating controls (it cannot be patched); Strongly isolate from the control network; verify SIS independence
Virtually-patch and tighten network ACLs until a window opens; Add redundancy / tested manual fallback for this single point
Broker remote access through a monitored jump host with MFA
Broker remote access through a monitored jump host with MFA
Remove from the public internet; terminate access in a DMZ; Virtually-patch and tighten network ACLs until a window opens
Isolate/segment and wrap with compensating controls (it cannot be patched)
Remove from the public internet; terminate access in a DMZ