Top OT And ICS Penetration Testing Companies In 2026
Daria Pohrebniak
Marketing Director - ReVerb
10.23.2026
The best OT penetration testing companies for most industrial operators in 2026 are White Knight Labs, for adversarial OT assessments that test the IT/OT boundary, industrial protocols and HMIs with safety as the first constraint; Dragos, for OT-only testers backed by industrial threat intelligence; and Pen Test Partners, for hands-on ICS testing that goes down to PLCs, RTUs and field devices. This guide to the Top OT And ICS Penetration Testing Companies In 2026 covers seven more firms, from European ICS boutiques to industrial engineering specialists.
This list is for security, engineering and operations leaders at utilities, manufacturers, oil and gas, water and other critical infrastructure operators who need someone to test control systems without stopping the process. We only included service firms that publish OT, ICS or industrial penetration testing, or active OT testing within a named assessment service. We compared what each firm says about scope, safety, standards and deliverables, using the companies’ own websites. Claroty is not included because it does not list penetration testing as a customer service.
OT And ICS Penetration Testing Companies At A Glance
Company
Headquarters
Best For
OT Testing Scope
White Knight Labs
Guys Mills, Pennsylvania, USA
Adversarial testing of the IT/OT boundary and control layer
Segmentation, Modbus and DNP3, HMIs, engineering workstations, vendor remote access, OT red team
Dragos
Washington, DC, USA
OT-only testers with threat intelligence
Vulnerability assessment, penetration testing, purple team exercises
Pen Test Partners
Buckingham, United Kingdom
Device-level ICS testing for energy and transport
PLCs, RTUs, instrumentation, ICS/IT boundaries, infrastructure, red team
Gap assessment, architecture review, assumed breach testing, retest
RMC
Arlington, Virginia, USA
Energy, utility and defense environments
Devices and firmware, OT/IT networks, cloud, APT-style red teaming
NCC Group
Manchester, United Kingdom
Industrial equipment makers
IoT, ICS and SCADA product testing, firmware review, OT architecture
Kudelski Security
Switzerland, Spain and US fusion centers
Factories, buildings and IoT-heavy sites
ICS, SCADA, BMS and IoT, active probing, IT-to-OT attack path analysis
Best OT And ICS Penetration Testing Companies In 2026
1. White Knight Labs — Safety-First Adversarial Testing Of The IT/OT Boundary And Control Layer
White Knight Labs is a boutique offensive security firm founded in 2017, with offices in Guys Mills, Pennsylvania, and Grand Rapids, Michigan. Its OT adversarial security assessment is explicitly separate from its IT testing, because legacy protocols, uptime requirements and equipment that cannot tolerate aggressive scanning call for a different approach. The firm also offers OT red team operations for organizations that want a full adversary emulation.
The assessment covers five areas. Testers check ICS and SCADA network segmentation to see whether an attacker on the corporate network can reach control systems. They analyze industrial protocols such as Modbus and DNP3 for weaknesses that allow unauthorized command injection or manipulation. They test HMIs and engineering workstations, review third-party and vendor remote access connections, and test with Safety Instrumented Systems in mind so that physical consequences shape what is attempted.
Safety is described as the first constraint, not an afterthought. Work is scoped and sequenced with the client’s operations team, with defined safe testing windows and systems that receive passive-only analysis, and the firm favors passive analysis and controlled, low-impact techniques where aggressive testing could disrupt a process. Tradecraft is drawn from real ICS-targeting threat actors, findings are mapped to MITRE ATT&CK for ICS where relevant, and attack paths are validated only within agreed safety boundaries. White Knight Labs holds CREST Pathway+ status and is a Service-Disabled Veteran-Owned Small Business.
Best for: Operators that want to know whether an attacker could cross from IT into OT and manipulate the process, tested by a firm that also runs OT red team operations.
2. Dragos — OT-Only Testers Informed By Industrial Threat Intelligence
Dragos was founded in 2016, is headquartered in Washington, DC, and focuses entirely on industrial cybersecurity. Its red team services include three engagement types: network vulnerability assessments that find weaknesses without exploiting them, penetration testing that attempts exploitation to see whether controls hold, and purple team exercises that build detection and response skills hands-on.
The firm says its red team consists exclusively of OT security experts who understand industrial processes and safety systems, and that engagements draw on current Dragos threat intelligence about adversaries targeting the client’s sector. Safety is stated as the top priority: testing follows OT-specific methodologies and agreed rules of engagement, the team stays in contact with operations staff, and on active production systems Dragos uses a white box approach in which the client’s team knows about and directs all testing.
Best for: Utilities and industrial operators that want testers who work only in OT and bring sector-specific threat intelligence.
3. Pen Test Partners — Device-Level ICS Testing For Energy And Transport
Pen Test Partners has worked in cybersecurity since 2010, with offices in Buckingham, UK, and New York. It holds CREST accreditation, is a UK CHECK provider and has an unusually deep OT practice. The firm says it works with UK distribution network operators, nearly half of the UK’s operators of essential services, vertically integrated energy companies and communications providers, with experience in gas control rooms, water treatment plants and oil refineries.
Its OT, ICS and IIoT testing is notable for going down to the device. Testers assess PLCs, RTUs and smart instrumentation in a lab or on site, for equipment makers and end users. Other services include build reviews against baselines, ICS/IT boundary, remote access and firewall testing, infrastructure testing of ICS servers, networks, segmentation and wireless, and including ICS environments in red team exercises.
Best for: Energy, utility and transport operators that want hardware-level ICS testing alongside network and boundary work.
4. Limes Security — IEC 62443-Aligned Plant Testing In Maintenance Windows
Limes Security is an Austrian industrial security firm based in Hagenberg with an office in Vienna. It serves water, energy, automation, oil and gas, pharmaceuticals, logistics, manufacturing and other sectors, and also consults on IEC 62443, the EU Cyber Resilience Act and NIS2.
Its OT penetration testing can cover a single production line or a whole plant, including PLCs, HMIs, network segments and remote access paths. By default it focuses on exposed control systems and IT/OT interfaces such as jump servers and remote access, with field-level components analyzed separately on request. The work references NIST SP 800-82, IEC 62443 with testing that supports security levels 1 to 4, NIST CSF, ISO/IEC 27001 and NERC CIP.
The safety model is practical. Limes discourages testing live systems and prefers maintenance windows; where that is impossible, it runs non-invasive passive tests or reduced tests on test systems. Tests are usually performed by two experts on site with a client supervisor present, average about a week, and end with a prioritized report, a joint findings discussion and optional retesting.
Best for: European manufacturers and utilities that want OT testing tied to IEC 62443, NIS2 and CRA work.
GuidePoint Security is headquartered in Reston, Virginia, and runs a dedicated OT, IoT and IIoT practice. Its OT penetration testing combines IT and OT/ICS testing methods to examine how vulnerabilities in IT infrastructure can be used to compromise OT systems, which reflects how most real industrial intrusions begin.
Scope can include any systems, devices and equipment in the production environment. GuidePoint calls out public exposure of OT assets, phishing on the enterprise network and access to production from unsecured zones, and separates focus areas so remediation is easier to prioritize. Tests are designed to assess risk without disrupting production.
Best for: Organizations with converged IT and OT networks, including TSA-regulated pipeline and rail operators.
6. Red Trident — On-Site VAPT With Engineers From Production Backgrounds
Red Trident was founded in 2014 and is headquartered in Houston, Texas, serving oil and gas, manufacturing, water and wastewater, government, electric power and chemical customers. Its assessment line includes asset and network discovery, a vulnerability assessment and penetration test (VAPT) and risk assessment, plus architecture reviews, ICS compliance assessments and red team exercises.
The VAPT covers controllers, HMIs, firmware and configurations, networks including enterprise-to-control paths, vendor and integrator remote access, engineering workstations and servers. The method starts passive and read-only, with configuration review, traffic observation and documentation analysis. Active checks are agreed in advance, limited to specific assets and run in maintenance windows with engineers present, and controller interaction is limited to what the client’s engineers approve.
Red Trident prefers on-site work and strongly recommends it for live production. Deliverables include prioritized findings with process risk, a remediation plan sequenced for a running plant, and compliance mapping to IEC 62443, NIST SP 800-82 or NERC CIP for multi-site programs. Its engineers come from production, manufacturing and energy backgrounds.
Best for: Process industries that want cautious, on-site testing by engineers who understand running plants.
7. Cutaway Security — Staged ICS Testing Led By A SANS ICS Instructor
Cutaway Security is a veteran-owned ICS and OT consultancy led by Don C. Weber, a SANS principal instructor and co-author of SANS ICS613, the institute’s ICS/OT penetration testing and assessment course. Weber is also an ISA/IEC 62443 Cybersecurity Expert and holds GICSP.
The firm treats penetration testing as a later step in an assessment journey rather than a starting point. Engagements can begin with a high-level gap assessment against the SANS Five ICS Critical Controls, move to an architecture review of segmentation, data flows and trust boundaries against ISA/IEC 62443 and the SANS ICS reference architecture, then a security assessment of live controls. Penetration testing comes once that foundation is in place, including assumed breach and M&A analysis, and is followed by remediation and retest.
Best for: Smaller or less mature OT programs that want a staged path to penetration testing from a recognized ICS testing educator.
8. RMC — Device, Network And Red Team Testing For Energy And Defense
Risk Mitigation Consulting (RMC) is based in Arlington, Virginia, and acquired Securicon, a firm known for OT and ICS penetration testing. Its industrial cybersecurity practice focuses on securing federal and commercial ICS and OT environments, and it works with large energy and utility companies and defense operations.
RMC’s penetration testing covers hardware and devices, including firmware, operating systems, interfaces and communications in robotics and advanced metering infrastructure. It also covers external and assumed-breach internal testing of OT and IT networks, application and cloud testing across AWS, Azure and Google Cloud, and red teaming that emulates advanced persistent threat tactics.
Best for: Utilities, energy companies and defense-adjacent operators that want device-level and APT-style testing from one provider.
9. NCC Group — Product Testing For Industrial Equipment Makers
NCC Group, headquartered in Manchester, runs an operational technology consulting practice alongside its broader testing business. For OT, its most specific testing offer sits under product development: it designs and tests industrial equipment across IoT, ICS and SCADA, including embedded firmware code review, vulnerability assessment and penetration testing.
The practice also covers designing, testing and verifying OT security architecture, OT cyber risk assessments for facility due diligence, and cyber safety and reliability work delivered with its safety consultancy Adelard, which covers safety modeling and safety case analysis.
Best for: Industrial equipment vendors and operators that want product-level ICS testing combined with safety case expertise.
Kudelski Security is the cybersecurity division of the Kudelski Group and runs cyber fusion centers in Switzerland, Spain and the US. Its CPS security assessment covers the full cyber-physical stack, including ICS, SCADA, building management systems and networked IoT devices, across factory floors, smart buildings and IoT-enabled operations.
The assessment chooses its testing mode by operational risk and network segmentation, with passive scanning as a non-disruptive option and active probing where safe. It includes an attack path analysis that simulates lateral movement from IT into OT.
Best for: Organizations with mixed OT, building systems and IoT that want active testing and attack path analysis inside a broader assessment.
How To Choose An OT Penetration Testing Company
How Do They Keep The Process Safe?
This is the first question to ask. Look for a written approach that starts passive, agrees active checks in advance, limits them to named assets and runs them in maintenance windows with your engineers present. White Knight Labs, Dragos, Red Trident and Limes Security all describe safety controls in detail.
Do They Test The IT/OT Boundary?
Most industrial incidents start in IT. A useful OT test shows whether an attacker on the corporate network or a vendor remote access path could reach control systems. Ask how the vendor tests segmentation, jump hosts and remote access. Our internal vs external penetration testing guide explains how starting points change results.
How Deep Do They Go Into The Control Layer?
Some firms stop at the network. Others test HMIs, engineering workstations, industrial protocols and the PLCs themselves. Pen Test Partners and RMC test devices and firmware, and White Knight Labs analyzes protocols such as Modbus and DNP3. Decide how deep you need to go and whether a test bench or spare controller is available.
Do You Need A Test, A Red Team Or An Assessment First?
Less mature programs often get more value from an architecture review or gap assessment before a penetration test, as Cutaway Security recommends. Mature programs may want an OT red team. See our red teaming vs penetration testing guide and top red teaming companies list.
Frequently Asked Questions
What Is OT Penetration Testing?
OT penetration testing is an authorized, controlled attempt to find and exploit weaknesses in operational technology, such as industrial control systems, SCADA, HMIs, PLCs and the networks that connect them, to show how an attacker could affect a physical process. For a broader primer, see what is penetration testing.
Is It Safe To Run A Penetration Test On A Live Plant?
It can be, with the right controls, but many firms prefer maintenance windows or test environments. Dragos uses a white box approach on active production systems, Red Trident runs active checks only in agreed windows with engineers present, and Limes Security discourages live testing altogether where alternatives exist.
How Long Does An OT Penetration Test Take?
Dragos cites five to 10 days of penetration testing and Limes Security about a week per test, plus analysis and reporting. Multi-site programs take longer.
Conclusion
The right OT penetration testing company depends on how mature your program is and how deep into the control layer you need to go. White Knight Labs suits operators that want adversarial testing of the IT/OT boundary, protocols and HMIs with safety written into the scope, Dragos suits teams that want OT-only testers with threat intelligence behind them, and Pen Test Partners suits energy and transport operators that want device-level ICS testing. Limes Security, GuidePoint, Red Trident, Cutaway Security, RMC, NCC Group and Kudelski Security each fit specific needs, from IEC 62443 alignment in Europe to staged programs and product testing.
