# Insecure by Design in the Backbone of Critical Infrastructure

arXiv: https://arxiv.org/abs/2303.12340 · HTML: https://mlsanity.com/paper/2303.12340/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Mar 2023.

## Built on by (most cited first, 1 of 1)

- [Security Bug Report Prediction Within and Across Projects: A Comparative Study of BERT and Random Forest](https://mlsanity.com/paper/2504.21037/) (2025)

## Abstract (arXiv)

We inspected 45 actively deployed Operational Technology (OT) product families from ten major vendors and found that every system suffers from at least one trivial vulnerability. We reported a total of 53 weaknesses, stemming from insecure by design practices or basic security design failures. They enable attackers to take a device offline, manipulate its operational parameters, and execute arbitrary code without any constraint. We discuss why vulnerable products are often security certified and appear to be more secure than they actually are, and we explain complicating factors of OT risk management.