Why cyber-physical assets are silently breaking enterprise risk management

Security teams get a clear, fast answer when a critical vulnerability alert targets a laptop, a server, or a traditional application. The same alert landing on a hospital scanner, a factory floor controller, or a building HVAC network triggers a different experience entirely, because the connected devices that run physical operations rarely identify themselves reliably on the network. New research on 17 million cyber-physical assets shows that 88 percent of those devices fail to transmit an exact product code and 76 percent send a code that does not match the vendor’s own record, leaving risk decisions built on inference instead of confirmed data.

How bad is the visibility problem on cyber-physical systems?

The problem is not concentrated in a few unlucky sectors. Across a dataset of 17 million cyber-physical assets, the research found that 88 percent of devices failed to transmit an exact product code, and 76 percent sent a code that did not match the vendor’s own catalogue entry. The gap shows up at the operating system layer too: 41 percent of devices had no OS version on file and 24 percent had no OS name at all.

The cause is rooted in how these systems were originally engineered and how they were later integrated into enterprise networks. Programmable logic controllers, medical imaging systems, and industrial sensors were designed for decades of physical reliability rather than tidy digital labeling. Network identification was rarely part of the original design brief, so the same device can present itself differently depending on which protocol or integration asks the question. When a CVE advisory arrives, the first question, does this alert actually apply to a specific device in our environment, becomes a multi-day investigation or a guess. CVE records themselves are compiled from the same patchy vendor information, so an official advisory can be just as incomplete as the network it is meant to protect.

What does this blind spot look like at the board level?

The pain surfaces as a vague, rising sense that risk cannot be quantified, rather than as a clearly labeled data problem. In a global survey of 1,100 security leaders, 44 percent named understanding their organization’s risk exposure as one of their biggest operational concerns, ahead of compliance pressure or budget constraints. A further 45 percent said they were struggling to reduce cyber risk to their most important assets and processes.

Security teams tend to cite technical issues like missing product codes, inconsistent naming conventions, and protocol mismatches. The cause is asset data that cannot answer the questions being asked of it.

How can teams turn guesswork into a confirmed answer?

Knowing exactly what a device does, what physical process depends on it, and what happens if it is compromised is what makes a risk register useful under pressure.

Doing this at the scale of modern industrial and clinical estates requires specialized tooling to handle the proprietary and eclectic nature of these assets, along with automation that can cope with millions of endpoints. In one example from the research, applying AI-driven mapping techniques to a single vendor’s device catalogue lifted product code identification from 4 percent to 83 percent. The follow-through was just as significant: 56 percent of devices received a new or updated firmware recommendation as a result, and vulnerability identification accuracy improved by 25 percent.

Such figures let a security team answer a question it can defend with evidence.

What should change in how organizations treat this problem?

Adding another tool to the stack will not fix the foundation. The shift that pays off is treating asset data quality as a board-level risk issue, alongside budgets, compliance, and third-party access. When the foundation is in order, a new CVE alert triggers the kind of confirmed, prioritized response security teams expect from any mature vulnerability management program, and the alert landing on a hospital scanner or a factory floor controller becomes no harder to act on than the one landing on a laptop.

The real challenge is whether the organization can confidently identify the assets a vulnerability affects, the services those assets support, and the value an attacker would gain by compromising them.

FAQ

What is a cyber-physical system and why does it matter for security?

A cyber-physical system is a connected device that runs a physical operation rather than just processing data, including medical imaging equipment, factory floor controllers, and building HVAC networks. Because these devices sit at the intersection of IT and operational technology, a successful compromise can affect physical safety and continuity, not only data.

Why can’t security teams match vulnerabilities to these devices quickly?

Most of these assets were built for physical reliability rather than clean network identification, and they often report different product codes depending on the protocol asking. Across 17 million assets studied, 88 percent failed to transmit an exact product code, and 41 percent had no operating system version on file, so confirming whether a CVE applies becomes a manual search.

How can organizations improve visibility on cyber-physical assets?

The research points to specialized tooling designed for the proprietary nature of these assets, combined with automated mapping of vendor catalogues. In one example, AI-driven mapping lifted product code identification on a single vendor’s catalogue from 4 percent to 83 percent and improved vulnerability identification accuracy by 25 percent.