Three years and counting: How long critical vulnerabilities survive in industrial systems

Holm Security's Security Research team has found that the typical critical vulnerability in operational technology environments was disclosed more than three years ago, and it rarely sits alone.

STOCKHOLM, Sept. 29, 2026 (GLOBE NEWSWIRE) -- The typical critical vulnerability in operational technology (OT) environments was disclosed more than three years ago, and it rarely sits alone, according to new research released today by Holm Security's Security Research team.

Operational Technology (OT) has a reputation for being difficult to patch, but the scale of the resulting exposure is rarely measured. From what our Security Research team sees across industrial environments, the pattern is clear enough to put numbers to.

The typical critical vulnerability in industrial and SCADA environments has been publicly known for more than three years and is still unresolved. Industrial environments are also considerably more likely than others to carry active, ransomware-exploitable risk on their IT network at the same time.

None of this points to negligence. It reflects the reality of securing systems that can't simply be taken offline and patched. What it shows is how long known industrial risk persists in practice, and why visibility across both IT and OT has become essential.

The typical critical industrial vulnerability was disclosed more than three years ago

Across industrial environments, the typical open critical vulnerability is one whose underlying issue was first publicly disclosed more than three years ago. It's a vulnerability that has been publicly documented, with a fix or mitigation already available. In IT, a three-year-old unresolved critical vulnerability is unusual. In OT, it is the norm.

Detection isn't the obstacle. Production systems often can't be patched on demand, maintenance windows are infrequent, and vendor certification can dictate what can be changed and when. The result is a long tail of known, unaddressed critical risk sitting in environments that are frequently the most sensitive to disruption.

Industrial risk rarely sits alone

Industrial vulnerabilities don't exist in isolation. Where there are active industrial vulnerabilities, the great majority of those environments also carry an active critical or ransomware-exploitable vulnerability on the IT network at the same time. This suggests industrial environments are more likely to be managing serious exposure on both fronts at once.

Why it matters

Industrial risk and IT risk are not separate problems. Yet the two are still routinely managed by different teams, with different tools, on different schedules. Seeing industrial and IT risk through one system, prioritized against each other rather than in isolation, is what turns two partial views into a single picture of where an organization is exposed.

Holm Security assesses IT and OT environments through one platform, bringing exposure and vulnerability management to industrial risk alongside IT risk instead of treating them separately.

About Holm Security

Holm Security is a European leader in exposure and vulnerability management. Founded in 2015 in Stockholm, Holm Security helps more than 1,500 organizations across the public and private sectors see their risk clearly, prioritize what matters, and prove that it is going down. Its Next-Gen Vulnerability Management Platform finds, prioritizes, and helps remediate vulnerabilities across systems and networks, cloud, web applications, APIs, and users, spanning both IT and Operational Technology (OT). Learn more at holmsecurity.com.

Media contacts marketing@holmsecurity.com