{"id":"https://openalex.org/W7138256376","doi":"https://doi.org/10.1145/3802592","title":"The Challenges of Operational Technology Penetration Testing","display_name":"The Challenges of Operational Technology Penetration Testing","publication_year":2026,"publication_date":"2026-03-17","ids":{"openalex":"https://openalex.org/W7138256376","doi":"https://doi.org/10.1145/3802592"},"language":"en","primary_location":{"id":"doi:10.1145/3802592","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3802592","pdf_url":null,"source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1145/3802592","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5000727349","display_name":"Richard Derbyshire","orcid":"https://orcid.org/0000-0003-3902-5056"},"institutions":[{"id":"https://openalex.org/I4210137437","display_name":"Orange County Department of Education","ror":"https://ror.org/04mqvep70","country_code":"US","type":"education","lineage":["https://openalex.org/I4210137437"]}],"countries":["US"],"is_corresponding":true,"raw_author_name":"Richard Derbyshire","raw_affiliation_strings":["Orange Cyberdefense, London, United Kingdom of Great Britain and Northern Ireland"],"raw_orcid":"https://orcid.org/0000-0003-3902-5056","affiliations":[{"raw_affiliation_string":"Orange Cyberdefense, London, United Kingdom of Great Britain and Northern Ireland","institution_ids":["https://openalex.org/I4210137437"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":["https://openalex.org/A5000727349"],"corresponding_institution_ids":["https://openalex.org/I4210137437"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.3262822,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"7","issue":"2","first_page":"1","last_page":"13"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5504999756813049,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.5504999756813049,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.10249999910593033,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11807","display_name":"Infrastructure Resilience and Vulnerability Analysis","score":0.0340999998152256,"subfield":{"id":"https://openalex.org/subfields/2205","display_name":"Civil and Structural Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/penetration","display_name":"Penetration (warfare)","score":0.4595000147819519},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.40470001101493835},{"id":"https://openalex.org/keywords/relevance","display_name":"Relevance (law)","score":0.40369999408721924},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.3901999890804291},{"id":"https://openalex.org/keywords/penetration-test","display_name":"Penetration test","score":0.32670000195503235},{"id":"https://openalex.org/keywords/set","display_name":"Set (abstract data type)","score":0.30649998784065247}],"concepts":[{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5332000255584717},{"id":"https://openalex.org/C80107235","wikidata":"https://www.wikidata.org/wiki/Q7162625","display_name":"Penetration (warfare)","level":2,"score":0.4595000147819519},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.43860000371932983},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.40470001101493835},{"id":"https://openalex.org/C158154518","wikidata":"https://www.wikidata.org/wiki/Q7310970","display_name":"Relevance (law)","level":2,"score":0.40369999408721924},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.3901999890804291},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.35530000925064087},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.34860000014305115},{"id":"https://openalex.org/C98214672","wikidata":"https://www.wikidata.org/wiki/Q1501923","display_name":"Penetration test","level":3,"score":0.32670000195503235},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.30799999833106995},{"id":"https://openalex.org/C177264268","wikidata":"https://www.wikidata.org/wiki/Q1514741","display_name":"Set (abstract data type)","level":2,"score":0.30649998784065247},{"id":"https://openalex.org/C56739046","wikidata":"https://www.wikidata.org/wiki/Q192060","display_name":"Knowledge management","level":1,"score":0.30379998683929443},{"id":"https://openalex.org/C55587333","wikidata":"https://www.wikidata.org/wiki/Q1133029","display_name":"Engineering ethics","level":1,"score":0.2985000014305115},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2922999858856201},{"id":"https://openalex.org/C77595967","wikidata":"https://www.wikidata.org/wiki/Q3151013","display_name":"Forensic engineering","level":1,"score":0.2919999957084656},{"id":"https://openalex.org/C121017731","wikidata":"https://www.wikidata.org/wiki/Q11661","display_name":"Information technology","level":2,"score":0.28540000319480896},{"id":"https://openalex.org/C2988617437","wikidata":"https://www.wikidata.org/wiki/Q6627318","display_name":"Materials testing","level":2,"score":0.2842999994754791},{"id":"https://openalex.org/C184356942","wikidata":"https://www.wikidata.org/wiki/Q830382","display_name":"Best practice","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C195094911","wikidata":"https://www.wikidata.org/wiki/Q14167904","display_name":"Process management","level":1,"score":0.28060001134872437},{"id":"https://openalex.org/C89702864","wikidata":"https://www.wikidata.org/wiki/Q746994","display_name":"Technology assessment","level":2,"score":0.2612999975681305},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.2554999887943268}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3802592","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3802592","pdf_url":null,"source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3802592","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3802592","pdf_url":null,"source":{"id":"https://openalex.org/S4210235901","display_name":"Digital Threats Research and Practice","issn_l":"2576-5337","issn":["2576-5337","2692-1626"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Digital Threats: Research and Practice","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":12,"referenced_works":["https://openalex.org/W633987297","https://openalex.org/W1537604812","https://openalex.org/W2618452333","https://openalex.org/W2690638300","https://openalex.org/W2765362015","https://openalex.org/W2832719672","https://openalex.org/W3192615057","https://openalex.org/W3205502046","https://openalex.org/W4319736177","https://openalex.org/W4385192315","https://openalex.org/W4392338492","https://openalex.org/W4399850416"],"related_works":[],"abstract_inverted_index":{"Operational":[0],"technology":[1],"(OT)":[2],"is":[3,44],"foundational":[4],"to":[5,29,129,134],"critical":[6],"sectors":[7],"such":[8],"as":[9],"water,":[10],"energy":[11],"and":[12,57,61,79,85,105,112,126,132],"manufacturing,":[13],"yet":[14],"securing":[15],"it":[16],"presents":[17],"unique":[18],"challenges.":[19],"Conventional":[20],"IT":[21],"penetration":[22,49,71],"testing":[23,50,72],"methods":[24],"cannot":[25],"be":[26,52],"directly":[27],"applied":[28],"OT":[30,55,70],"because":[31],"of":[32,35,69,76,95,101,123],"the":[33,67,93,98,118],"risks":[34],"disrupting":[36],"live":[37],"production":[38],"environments.":[39],"As":[40],"a":[41,74,121],"result,":[42],"there":[43],"little":[45],"consensus":[46],"on":[47],"how":[48],"should":[51],"conducted":[53],"in":[54],"environments,":[56],"practice":[58,131],"remains":[59],"inconsistent":[60],"poorly":[62],"understood.":[63],"This":[64],"article":[65,119],"explores":[66],"state":[68],"through":[73],"review":[75],"existing":[77],"literature":[78],"qualitative":[80],"interviews":[81],"with":[82],"both":[83],"practitioners":[84],"procurers.":[86],"The":[87],"findings":[88],"highlight":[89],"three":[90],"central":[91],"challenges:":[92],"absence":[94],"standardised":[96],"methodologies,":[97],"limited":[99],"relevance":[100],"IT-style":[102],"vulnerability":[103],"reporting,":[104],"cultural":[106],"tensions":[107],"between":[108],"cyber":[109],"security":[110],"specialists":[111],"operational":[113],"engineers.":[114],"From":[115],"these":[116],"insights,":[117],"proposes":[120],"set":[122],"short-,":[124],"medium-":[125],"long-term":[127],"recommendations":[128],"improve":[130],"points":[133],"key":[135],"areas":[136],"for":[137],"future":[138],"research.":[139]},"counts_by_year":[],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-03-18T00:00:00"}