Detecting an Unauthorized Device in an OT Environment Before It Became a Larger Risk

The Challenge

For organizations operating critical industrial environments, detecting an anomaly is only the beginning. The harder question is determining what that anomaly means, and whether it represents a genuine threat requiring immediate action.

A global oil & gas organization had established monitoring within its operational technology environment using Nozomi and SIGA, and uses Sygnia MDR for 24/7 monitoring of its IT and CPS networks. Alerts generated within OT were passed to the organization’s SIEM and transferred across the IT/OT boundary via a data diode and FortiSIEM. Sygnia’s Pathfinder then ingested the relevant data into the Velocity platform for investigation.

A previously unseen device can have many explanations, from an authorized operational change to an unmanaged asset or unauthorized connection. In an industrial environment, simply knowing that a device appeared is therefore insufficient. Security teams need to quickly establish what the device is, what it is communicating with, whether it belongs in the environment, and what action should follow.

The challenge was not generating another alert. It was establishing context.

This architecture provided multiple sources of telemetry, but the organization still needed the ability to turn an individual OT alert into an informed security decision.

That need became clear when Sygnia MDR identified a new MAC address in the OT environment.

The Detection

Sygnia MDR received the alert indicating that a new MAC address had been detected in the OT environment.

Rather than treating the alert as an isolated event, Sygnia analysts began investigating the activity using Velocity. The platform is designed to bring together data from multiple sources across IT and OT environments, enabling analysts to investigate activity beyond the telemetry that generated the original alert.

This cross-environment visibility is particularly important in OT. Traditional detection approaches can leave information distributed across OT monitoring technologies, SIEM platforms, endpoint telemetry, network infrastructure, and other systems. Sygnia’s MDR approach is designed to break down those silos and provide analysts with broader investigative context. This aligns with Sygnia’s continuous-security model: combining near real-time visibility with threat detection informed by frontline incident response experience.

The Investigation

The analyst investigation focused on answering three questions:

• What else had been observed from this device? Using Velocity, Sygnia analysts searched for additional records associated with the newly observed MAC address. They examined related communications and connection attempts to understand how the device was interacting with the environment.

• What could be established independently about the device? Analysts checked open-source intelligence sources for information associated with the MAC address. This provided another source of context for determining what the device could represent.
  
  
• Was the device supposed to be there? Critically, the analysts did not rely solely on technical telemetry. As part of the MDR service, the customer had provided a list of known and authorized hosts. The detected device was cross-checked against this inventory to determine whether it aligned with the customer’s expected environment.
  
  This combination of telemetry, enrichment, external research, and customer-specific context allowed the MDR team to move beyond a generic “new device” notification and conduct a focused investigation of its significance.

From Alert to Actionable Context

Once the investigation was complete, the findings were communicated to the client so the organization could determine the appropriate next action.

In an OT environment, effective detection is not about escalating every deviation as a crisis. Excessive alerting can create noise that ultimately makes genuine malicious activity harder to identify. Sygnia’s broader OT detection methodology emphasizes tailoring detections to an organization’s architecture, threat landscape, and operational requirements rather than relying exclusively on generic vendor alerts.

The goal is to give defenders enough evidence to make an informed decision, quickly and with the operational consequences in mind.

The Sygnia MDR Difference

This case demonstrates the value of combining OT telemetry with broader investigative capabilities rather than treating industrial monitoring as an isolated security function.

Sygnia MDR uses the Velocity platform to provide visibility across IT, OT, cloud, network, endpoint, and application data. The platform supports more than 250 third-party integrations and hundreds of detection rules, with detection logic spanning baseline rules, customer-specific rules, and rules informed by Sygnia’s incident response experience.

For the customer, that meant an OT alert could be investigated in a broader context by analysts able to search associated activity, enrich raw telemetry, compare findings against the organization’s known environment, and communicate findings back to the security team.

The same platform also supports Sygnia’s incident response work, providing continuity between ongoing detection and investigation should suspicious activity develop into a confirmed incident.

That reflects Sygnia’s broader approach to continuous security: apply lessons learned on the front lines of incident response to ongoing detection so organizations can identify threats earlier, reduce unnecessary noise, and be prepared to move quickly from investigation into response.

Key Takeaways

For security leaders responsible for industrial environments, this case highlights several practical principles:

• An alert without context is not enough. Detection needs to establish what happened, what else the asset interacted with, and whether the behavior fits the expected environment.

• OT visibility should not exist in isolation. Correlating OT telemetry with broader enterprise data gives analysts a stronger foundation for determining whether suspicious activity represents genuine risk.

• Customer-specific context improves detection quality. Known-host inventories, architecture knowledge, operational practices, and tailored detection logic help distinguish meaningful anomalies from expected activity.

• Detection and response should be connected. When monitoring and incident response share investigative technology and expertise, organizations can reduce friction if an alert develops into a material incident.

Building Continuous Security Across IT and OT

Industrial organizations do not need more alerts. They need the ability to identify the activity that matters, understand it in operational context, and respond before a security event becomes a business crisis.

Sygnia combines frontline incident response expertise, vendor-agnostic technology, and continuous detection across complex IT and OT environments to help organizations turn fragmented security signals into actionable decisions and build greater resilience before the next incident occurs.