How to Find Undocumented External Connections in Your OT Network

There’s probably a path out of your control network that nobody has written down. In most critical infrastructure environments, OT external connections aren’t hidden so much as forgotten. A tunnel somebody opened for a cutover and never closed. A cellular gateway sitting in a cabinet. A radio link between two buildings. An analog line with a modem on the end of it that’s been billed quietly for years.

Nobody hid any of it. Each one solved a real problem on a real day, usually under pressure, usually for a good reason. Then the technician who installed it moved to another account, the engineer who approved it retired, and the connection stayed exactly where it was.

Those are undocumented OT external connections, and most environments have a few. CISA put the category in writing on July 30. Its alert to the water sector tells water organizations, including those with mature cybersecurity processes, to validate their external connections, because the targeting includes cellular modems installed by operators, vendors, or system integrators that may not be documented or included in routine attack surface scans. The alert went to one sector, but the pattern belongs to all of them.

That list of installers matters. Operators, vendors, system integrators. Two of those three likely don’t work for your organization.

OT External Connections Fall Into Two Categories

OT external connections are paths that allow traffic, access, or communications to leave or reach a control environment through vendor tunnels, cellular gateways, firewall rules, modems, radio links, remote-access systems, or other networked paths

The distinction that matters is whether the connection uses your infrastructure or brings its own, because it decides which method will ever find it.

Connections riding your own network. A vendor VPN tunnel set up for a commissioning window and never torn down. A firewall rule written for two weeks in 2021 that’s still permitting traffic in 2026. A jump host with accounts nobody has reviewed since the integrator handed over the keys. A dual-homed workstation quietly bridging two zones. These move across equipment you own, over circuits you already pay for.

Connections that never touch your network. A cellular gateway an integrator dropped into a cabinet because the site had no fiber. A legacy analog line or T1 with a modem on it, still live, still invoiced. A short-range radio bridging a remote asset back to a contractor’s equipment. A device with its own SIM, phoning a vendor’s cloud on a schedule. These carry their own way out. No amount of watching your own traffic will surface them, because they never cross it.

That second category is harder to validate. It’s genuinely invisible to network monitoring, and assuming otherwise creates a blindspot. It gets found through physical inspection, procurement records, and conversations with the people who installed it.

What a Clean OT Scan Result Actually Covers

Before any dig in the United States, you call 811. Member utilities send locators to mark the lines they own, up to a demarcation point, usually the meter or the property line. Everything past that point belongs to whoever owns the property. The conduit a contractor laid in 2014, the feed added during a parking lot expansion, the secondary run to an outbuilding: none of it gets marked, because none of it is registered with anyone. Private locating firms put the share that 811 never marks at somewhere around sixty percent of what’s actually buried on a developed site. Those firms sell that service, so weigh the figure accordingly, and it still matches what anyone who has dug on an occupied property already suspects.

The ticket comes back as a status. Depending on the state, that can be little more than the word clear, with no drawing and no record of what was checked. It’s easy to read clear as full coverage. What it means is that the registered facilities in the dig area were accounted for.

An external attack surface scan returns the same kind of answer. Scanning is worth doing and it does its job well. That job is finding what’s been declared and registered. The cellular gateway an integrator installed on a Tuesday in 2019 was never on that inventory to begin with.

As-Designed and As-Built Are Two Different Drawings

Any engineer who has walked a site with a drawing in hand knows the gap. It shows what somebody intended to build. The facility shows what actually got built, plus fifteen years of changes made under pressure by people solving real problems.

Network diagrams age the same way. The one on the wall shows a clean hierarchy, a firewall between levels, one path in and one path out. The environment running today includes the laptop somebody connected to troubleshoot a drive, the switch added when the process expanded, and the gateway a contractor left behind after a project closed out.

Treat the diagram as a hypothesis. Go find the evidence.

How to Find Undocumented OT External Connections

None of this needs a project or a budget cycle. It needs questions that don’t get asked often enough. The first three work the traffic side. The last three work the physical and paper side, and the last one works both.

Watch what leaves. Outbound traffic from a control network is the highest-value thing to observe. Devices at Levels 1 and 2 should have short, predictable lists of who they talk to. Anything reaching past that list is worth a conversation.

Read the firewall as it exists today, not as it was originally written. Rules accumulate. Compare what’s actually permitted today against what anyone can still explain, and retire the ones nobody can account for.

Audit remote access accounts. Every account that reaches into the environment belongs to somebody. Find the ones that belong to a company you stopped working with, a person who left, or a project that closed.

Read through historical purchase orders and invoices. This is one of the steps people frequently skip, but it’s often the fastest and can reveal a lot. Connectivity shows up in procurement long after it disappears from a drawing. Cellular data plans, analog lines, T1 circuits, service contracts with remote support clauses. An active line item on an invoice is proof that something’s still connected, whether or not anyone remembers what.

There’s urgency here. In March 2026 the FCC removed the approval process carriers needed to retire copper, cutting the notice period to as little as 90 days, and AT&T began decommissioning copper across roughly 500 wire centers in June. Remote monitoring, alarm circuits, and dial-up links to equipment nobody visits are exactly what’s still riding those lines. Teams are likely to find out what depends on them either way. Finding out from an invoice beats finding out from an outage.

Walk the site and inspect the physical environment (i.e., look up). Antennas are physical objects. So are modems, cellular gateways, unmanaged switches, and the cable somebody ran through a hole in a cabinet. An afternoon on site with your eyes open and physical inspection in mind finds things most scans never will.

Ask your integrators directly. Send one email to every vendor and integrator who has touched your environment in the last five years. What did you install, what connectivity does it use, and how do you reach it today? Most will tell you. Some will discover they don’t know either, which is useful information.

Then write down what you find. Records fall behind because updating them competes with keeping the process running, and it loses that fight most days. Give it one week where it wins.

Two Halves of the Same Job

A connection carrying traffic across your own network announces itself the moment somebody is watching. It doesn’t have to be documented to be observable. It only has to be used, and that side of the problem yields to visibility alone.

The rest yields to a walkdown, an invoice, and a phone call. Less elegant, and there’s no substitute for it.

You don’t need a perfect inventory to start finding undocumented external connections. Start by assuming your diagram is incomplete, and then begin working both halves.

If you want a look at the traffic side, our OT PCAP Analyzer is free (no sales conversation required). Point it at a capture and it’ll show you what’s on the wire. Every path you confirm makes the next one easier to find.