Verified Files, Not Trusted Files: The Hidden Risk in OT
According to OPSWAT, scanning files only once at the point of entry leaves a gap in OT security. This is sponsored content, best read as the vendor's viewpoint, but it offers useful ideas for anyone managing updates and firmware.
On 9 November 2026, IIoT World published an article by OPSWAT on how files are distributed in OT environments. It is sponsored content that draws on an article from the vendor's own blog, so it is not an independent analysis. Its thesis, however, concerns a common practice in plants and deserves attention.
The gap between approval and installation
At most OT sites, files are scanned and approved when they enter the environment. These include vendor firmware, patches brought in by external maintenance staff, and configuration updates. Approvals are logged. After that point, however, security teams lose visibility until the file reaches a PLC or an HMI.
The problem, according to the article, is that a file modified after scanning, whether by mistake or through deliberate tampering, looks identical to an unmodified one. The scan record and the approval log remain valid. A scan shows that the file was clean at a given moment, not that it is the same file at the time of installation.
Why legacy devices are exposed
The article points to several typical limitations of older PLCs, HMIs and engineering workstations:
- they cannot run EDR agents;
- they cannot verify that the file they receive matches the one that was approved;
- when a media device or drive is connected, files are accessible by default.
Relying on every operator to follow every step at every site is a process assumption, not a security control.
The proposed model: continuous verification through to deployment
OPSWAT proposes moving from "scan once and distribute" to "verify continuously until installation." In its solution, MetaDefender Drive with Smart Touch uses a protected repository (Secure File Storage): files copied from vendor or contractor devices stay isolated and cannot be distributed until they pass verification through MetaDefender Kiosk. If a verified file is modified before installation, it is automatically blocked and hidden until it is verified again. The system enforces the rule, not the diligence of the operator at each individual site.
Among other security requirements for OT devices, the article lists:
- scanning contractor and supply chain devices before they are connected to OT systems;
- consistent inspection policies across distributed sites, with centralized management;
- management of firmware distribution in air-gapped environments;
- central visibility and audit-ready records.
Reading with caution
The article reports no incident data or statistics, cites no standards, and names only OPSWAT products as the solution. Its claims should therefore be treated as the vendor's point of view. The underlying reasoning, however, is not product-specific: file integrity must be guaranteed along the entire path, not just at the entry point.
What to do in practice
IT/OT managers and plant directors can check whether their firmware and patch workflows include integrity controls between approval and installation. Some useful questions: where are approved files stored, and who can modify them? Can it be shown that the file installed on a PLC or HMI is the one that was approved? Would the logs stand up to an audit? The issue is most relevant for multi-site operations that depend on external vendors and contractors, and for companies in regulated sectors or food production, where traceability of changes is part of compliance.