Build Your First OT Toolbox: It’s Dangerous to Go Alone, So Take These Tools!

Jori VanAntwerp

CEO and Founder at EmberOT || Web

For over two decades, Jori has enabled industrial and IT organizations to be successful in reducing risk, increasing compliance, and improving their overall security efforts. He has had the pleasure of working with companies such as Gravwell, Dragos, CrowdStrike, FireEye, McAfee, and is now CEO & Founder at EmberOT, a cybersecurity startup focused on making security a reality for critical infrastructure.

What you keep in your digital toolbox is incredibly important. One of the lesser-discussed aspects of OT/ICS defense is how important the correct tool stack is for preventing downtime and keeping operations secure.

Given the wide variance across sites, systems, and operational environments, finding the right tool for specific needs is more challenging than one might think.

The good news is that, from the helpdesk to developers, operators, and defenders, we all share the same challenges of keeping our systems up, efficient, healthy, and safe. So it’s no surprise that a plethora of open-source tools have been designed to address these common challenges.

The bad news is… There is a plethora of free, open source tools designed to specifically address these challenges…and it can be difficult to understand what tool to use when or which tool best fits your needs. Fortunately, we are here to help ignite the path. It is dangerous to go alone, so take this. A curated set of community open source tools that help you see what is actually happening in your environment and start breaking through challenges.

Every OT environment is unique. Each one is purpose built, shaped by real operational needs, and engineered to keep critical processes running. Because of that, no single tool will be the perfect fit for everyone. The good news is that community open source gives you room to adjust and adapt many of these tools so they support your workflow as you learn.
To make things easy, we’ve grouped everything into three categories. Network Analysis. System and File Analysis. Emulation and Testbeds. Each one includes a quick note on the experience level usually needed so you can choose the right place to begin and build from there.

How to Use This Guide

You do not need to learn every tool in this list. Start with one or two that match your comfort level and the challenge in front of you. Use the difficulty and OS columns as quick filters.

Whenever possible, begin in a lab, test network, or low-risk segment. Capturing and analyzing traffic is usually safe, but generating or replaying traffic can affect sensitive systems. When in doubt, check with your OT or operations team before testing new tools in production.

Tool Categories

These tools help you understand what is happening across your environment. From network activity to system behavior and defensive insight, they give you a clearer view of assets, protocols, operational patterns, and environmental interactions across your environment no matter the Purdue level.

Network, System, and Defensive Insight Tools

These tools help you understand what is happening across your environment. From network activity to system behavior and defensive insight, they give you a clearer view of assets, protocols, operational patterns, and environmental interactions across your Purdue levels.

Reading the Table

• Difficulty
  • 🟢Beginner: Good starting point if you are new to OT, networking, or security
  • 🟡Intermediate: Best if you have used basic command-line tools or similar utilities
• OS shows where the tool is most commonly used
• 🔥Indicates EmberOT Approved. We regularly use these tools ourselves.

🧰 System & File Analysis Tools

These tools help you explore the inner workings of devices, logs, and file structures. They support troubleshooting, learning, and investigative work as you deepen your understanding of OT systems. Use these for forensics, vulnerability checks, and evaluating your OT environment’s security posture.

⚙️ Emulation & Testbed Tools

These tools let you practice, experiment, and learn in a safe space. You can model devices, simulate traffic, replay scenarios, and build intuition without touching production systems or even virtually.

Conclusion

The OT, technology, and security world runs on community. People who build, fix, operate, and protect systems and operations that keep everything moving. These open source tools come straight from that spirit. They are created by practitioners who face the same challenges you do and share the same drive to keep things running strong.
Explore them. Experiment with them. See what sparks new ideas as you grow your skills. And if you end up improving one or building something of your own, we would love to hear about it.

* This list will evolve over time as the community discovers new projects and improves existing ones. If you rely on a tool that belongs here, or you are building something you want others to try, share it with us and we may add it to a future update.