Most mining operations do not find out they have an OT security gap until something goes wrong. An assessment is how you find out before that happens, not after.
Here are five signs it is time to book one.
1. No one can tell you exactly what is on your OT network
If a straight answer to “what devices are on our OT network, and what do they run” takes more than a phone call to get, that is a sign. You cannot protect equipment you have not documented, and asset inventories tend to go stale fast as sites change, contractors come and go, and equipment gets swapped out.
2. Your IT and OT networks are not clearly separated
A lot of sites have some separation in place, usually physical, but the digital boundary is less clear. If a laptop in the corporate office could theoretically reach a control system, or a vendor’s remote access tool sits on the same network as safety-critical equipment, that is a real path for an incident to travel, not a hypothetical one.
3. It has been a while since anyone tested it
Ransomware groups targeting industrial organisations grew from around 80 to 119 in a single year, and are now estimated to have hit around 3,300 industrial organisations in 2025 (TXOne Networks). Oil and gas specifically saw ransomware activity surge 935 per cent in a single year (Dragos). If your last real OT risk assessment predates that shift, your understanding of your own exposure is out of date.
4. Ownership of OT security is unclear internally
If OT security sits in a grey area between IT and operations, with each team assuming the other has it covered, that gap is exactly where problems get missed. An assessment forces clarity: what is being protected, by whom, and against what.
5. You have converged IT and OT faster than your security has kept up
Cloud-connected historians, remote monitoring, and vendor remote access all bring real operational value, and most sites have adopted at least one. Recent research shows that 96 per cent of OT security incidents originate from an IT-level compromise (SANS Institute, cited via Industrial Cyber, 2025). If your operational systems are more connected than they were two or three years ago, your assessment scope needs to reflect that.
What an assessment actually gives you
A proper OT security assessment is not a compliance exercise. It gives you a clear, evidenced picture of where your real risk sits, in priority order, so decisions about budget and resourcing are based on evidence rather than guesswork.
Book yours
If any of the five signs above sound familiar, our OT cyber security team runs assessments specifically for mining, oil and gas, and other asset-intensive operations. Get in touch to scope one for your site.