Measuring What Matters: Revisiting Internet Exposure of OT Networks

• We propose a noise-aware method to filter deceptive OT Internet scans. • We define four noise types: condensation, displacement, volatility, and hostility. • We perform an Internet-wide scan of Modbus, Fox, IEC 104, and EtherNet/IP using a noise-aware methodology, including custom probes for IEC 104 and EtherNet/IP. • Using high-confidence noise labels, 6-20% of vulnerable OT endpoints are attributable to measurement noise. • Even after filtering noise, thousands of legacy OT devices remain exposed. Many Internet-wide measurement studies report thousands of vulnerable OT (ot) devices exposed to the Internet. This growing focus on ot is essential for informing new regulations, mitigation techniques, and defense strategies, but many studies overlook false positives in their datasets. Ignoring artifacts such as honeypots, network telescopes, and tarpits leads to misinterpretations and a distorted view of the Internet. This paper revisits the exposure of ot networks to the public Internet. We apply a noise-aware methodology to an Internet-wide scan of networks that expose Modbus, Fox, EtherNet/IP, and IEC 60870-5-104 services, and we filter likely noise from vulnerable devices. Our findings show that noise systematically pollutes datasets and inflates estimates of exposed ot services; across protocols, 7% of the total observations, and up to 20% for particular protocols, can be traced reliably to four sources of noise that we term condensation, displacement, volatility , and hostility using conservative policies with high-confidence signaling classifiers. That said, even after filtering these artifacts, the security landscape of Internet-facing ot devices remains largely unchanged. Devices are still widely affected by misconfigurations, obsolescence, and broader security management issues.