Vulnerability tracking for OT/ICS professionals
OT vulnerability advisories are packed with technical detail that can be complex and overwhelming, especially when you're managing dozens of them a week. OTPulse translates them into plain language so you can quickly understand what's affected, what's being exploited, and what to do about it.
The question this tool answers: “I have S7-300 PLCs and Schneider EcoStruxure on my network. Do I need to do something this week?”
What OTPulse monitors
Advisory sources are checked daily. Only ICS/SCADA/OT-specific advisories appear. No general IT CVEs.
The primary US source for ICS advisories from all major OT vendors. Updated multiple times per week.
Covers SIMATIC, SINUMERIK, SCALANCE, WinCC, and the full Siemens OT portfolio. CSAF JSON format.
Security Events and Vulnerabilities Disclosures. Covers EcoStruxure, Modicon, and AVEVA products.
Covers Allen-Bradley, FactoryTalk, Logix, and related industrial automation products.
Each advisory is enriched with CVSS scores from NVD, exploitation data from CISA's KEV catalog, and EPSS probability scores from FIRST.org.
How to read a card
Hover over any part of the card below to see what it means.
Remotely exploitable, could allow full system takeover, no credentials needed
Hover over any part of the card above to see what it means.
How to read the detail panel
Click any advisory card to open the detail panel. Here's what each section means:
Attack Path strip
- Attack Vector - how the attacker reaches the target. Globe = Network, Wifi = Adjacent network, Monitor = Local access, USB = Physical access.
- Auth Required - whether the attacker needs credentials. Lock = yes, Unlock = no.
- Complexity - how difficult the attack is to pull off. High or Low.
- User Interaction - whether someone needs to click or open something. Required or None.
Exploitability indicator
Fix availability
"What This Means" block
Affected Products table
Tiered remediation
Remediation checklist
How to triage a week of advisories
Monday morning, 20 minutes, new week of advisories:
Check the stat cards
Critical count this week, High count, vendors affected, average CVSS. If Critical is 0, quiet week. If 3+, start there.
Set up My Environment (once)
Check the boxes for the vendors you run. Advisories matching your vendors get flagged with “In your environment.”
Sort by Most Exploitable
KEV-flagged and high-EPSS advisories surface first. If it's being exploited right now, you see it first.
Work through Act Now items
Read the impact preview, check your products, open the detail panel for compensating controls. Use j/k or arrow keys to move between advisories without leaving the keyboard. Mark dispositions as you go.
Dismiss what doesn't apply
Hover any card and click the dismiss icon to hide advisories that aren't relevant. Toggle “Show dismissed” in the toolbar to review them later. Use bulk selection to dismiss multiple at once.
Sort by Severity to cross-check
Make sure no Critical items were missed - sometimes a Critical advisory has low EPSS and sorts below the fold.
Save the view for next week
Click “Save view” in the active filter bar to bookmark your current filter combination. Load it next Monday with one click from the Views dropdown.
Export for compliance
Download CSV with CVSS scores, KEV status, EPSS scores, exploit status, patch availability, action level, and your disposition states. That's your audit trail.
Urgency tiers reference
How each tier is determined:
| Tier | When it applies | Typical action |
|---|---|---|
| Act Now | CVSS ≥ 9.0 + network vector, OR CISA KEV, OR EPSS > 10% | Compensating controls immediately. Escalate to operations. |
| Plan Patch | CVSS ≥ 7.0 with fix available, or CVSS ≥ 8.0 | Schedule a maintenance window within your normal patch cycle. |
| Monitor | CVSS ≥ 4.0, limited exploitability, local/physical access | Track. Re-evaluate if exploitation status changes. |
| Low Risk | CVSS < 4.0 or physical access + high complexity | Log for awareness. Low priority unless specific exposure. |
CVSS score vs. OTPulse urgency
CVSS scores vulnerability severity in isolation. How bad is this bug if someone exploits it? It doesn't account for whether anyone is actually trying to exploit it, whether your network makes it reachable, or whether a fix even exists.
A 9.8 CVSS requiring physical access to an air-gapped RTU is not the same as a 7.5 CVSS that's remotely exploitable and already on CISA's KEV list. OTPulse's urgency tier factors in attack vector, exploitation status, and patch availability. Three things CVSS ignores.
The raw CVSS score is still shown in small text on the badge for compliance reporting. It's there for reference, not as the primary triage signal.
My Environment
Click “My Environment” in the feed toolbar, check the boxes for your vendors, optionally add product names. A live counter shows how many advisories match your draft selection before you save. Advisories matching your profile show a green “In your environment” label. Matching is at the vendor level - if it's tagged Siemens and you have Siemens checked, it gets flagged.
Stored in your browser's localStorage. No account or login required. Persists across sessions on the same device.
Keyboard shortcuts
Navigate the feed without touching your mouse:
Shortcuts are disabled when you're typing in a search box or filter input.
Saved views and dismiss
Saved viewslet you bookmark filter combinations. Set your severity, vendor, date range, and search filters, then click “Save view” in the filter bar and give it a name. Load any saved view from the Views dropdown in the toolbar. Up to 10 views are stored in your browser.
Dismisshides advisories that aren't relevant to you. Hover any card and click the eye icon, or use bulk selection to dismiss several at once. Dismissed advisories stay accessible behind the “Show dismissed” toggle in the toolbar.
Bulk actions let you select multiple advisories, then export or dismiss them together. A bottom bar appears with your selection count and available actions.
Disposition tracking
Mark each advisory with a workflow state from the detail panel dropdown:
You don't have the affected product. Dismissed from active review.
Reviewed and understood. No action needed beyond monitoring.
Actively working a mitigation or patch. Stays visible with orange badge.
Patch applied or mitigation complete. Green “Done” badge.
Dispositions persist in your browser. CSV export includes disposition status for compliance audits.
Data freshness and sources
CISA ICS-CERT and vendor feeds are checked daily. CVSS scores come from the advisory (vendor-reported) and NVD. CVSS v3.1 preferred, v3.0 as fallback.
Exploitation data: CISA's KEV catalog (checked daily) and EPSS from FIRST.org (updated daily). Both are automatically applied to all advisories with CVE IDs.
Stop reading CVEs. Start triaging them.
See what's actually urgent for your environment.
Open the vulnerability feedBuilt for the people who protect operational technology. Feedback from practitioners shapes everything. Reach us at hello@otpulse.io.