The Factory Floor Has No Patch Management: Why OT Environments Demand a New Standard of ARP Expertise

Walk onto the floor of an American manufacturing plant and you will find controllers that have run without interruption since before the current security team was hired. These are not forgotten systems; they are the ones that make the plant profitable. They also, very frequently, have no ability to authenticate their neighbors on the network — which makes the humble Address Resolution Protocol a live attack surface that almost no one on site is qualified to defend.

Convergence Created the Exposure

For years, industrial networks stayed safe largely through isolation. Air gaps and segmented control networks kept OT traffic away from the threats that haunted enterprise IT. That era is ending. Predictive maintenance dashboards, cloud analytics, remote vendor support, and enterprise resource planning integration all require data to flow from the plant floor outward — and every connection carved in that direction is a path that runs in reverse as well.

The consequence is that ARP-based techniques, long understood in enterprise contexts, now apply to networks full of devices that cannot run endpoint agents, cannot be patched on any reasonable timeline, and cannot be taken offline for security testing without production consequences measured in millions of dollars.

Why Legacy Devices Change the Problem

In an office network, a poisoned ARP cache is an inconvenience that monitoring can catch and remediation can fix. In a control network, the same technique can let an attacker position themselves between a controller and the sensors it trusts, feeding manipulated values to equipment that physically acts on what it is told. The stakes are not data loss. They are equipment damage, product defects, and worker safety.

And the devices involved — PLCs, RTUs, and legacy HMIs — often implement none of the inspection or port-security features that enterprises rely on. Defense must happen at the network infrastructure layer and in the monitoring that surrounds it, which means the people responsible must understand exactly what normal ARP behavior looks like in an industrial context, and what deviates from it.

The Qualification Gap Is Real

Here is the uncomfortable part: the professionals who understand OT rarely have deep protocol-level networking expertise, and the professionals who understand ARP deeply have rarely set foot in a plant. The overlap is thin and getting thinner as convergence accelerates. A recent pattern in industrial incident response bears this out — investigations that stall for weeks because no one on the team could reconstruct Layer 2 activity on the control network.

A Baseline Worth Setting

This publication's position is direct: ARP-focused credentialing should become a standard expectation for security roles that touch OT environments. Such training must cover several things generalist certifications do not:

• ARP behavior on flat, unsegmented control networks where broadcast domains span entire production lines
• Passive detection techniques suitable for networks where active scanning is prohibited
• The interaction between industrial protocols and Layer 2 resolution during failover and device replacement
• Forensic reconstruction of ARP activity on equipment that keeps no logs of its own

None of this replaces broader OT security knowledge. It underpins it. You cannot defend a protocol-dependent environment from someone who understands the protocol and you do not.

The Window Is Closing

Convergence is not a trend that security teams can opt out of; it is an economic reality already underway across American manufacturing, utilities, and logistics. The organizations that invest now in professionals who hold both operational context and protocol depth will be the ones that detect the next intrusion in hours rather than weeks. The credentialing infrastructure to build that workforce exists. What remains is for the industry to demand it.