In August 2025, a coalition of cybersecurity agencies from the U.S., Canada, Australia, New Zealand, the Netherlands, Germany—and later joined by the U.K.—issued new guidance calling on OT/ICS operators to develop and maintain a definitive, continually updated system inventory. This isn’t just bureaucratic advice. It addresses a core pain point: if you don’t reliably know what’s in your environment and how it connects, you can’t secure it.
This new guidance underscores that inventories must be dynamic, accurate, and context-rich—supporting not just compliance, but actual security operations. The days of stale spreadsheets are over.
At Leargas Security, we see this as a perfect match for our unified XDR platform: a living inventory is not just a compliance checkbox—it’s foundational telemetry that empowers detection, response, and proactive defense. Here’s how the guidance connects to real-world OT/ICS security challenges, and how Leargas can help you implement it.
Core Principles of the Guidance (and Why They Matter)
1. Define the process and governance for your “definitive record.”
You need more than one-off scans. Identify and integrate multiple data sources (control systems, network tools, CMDBs, host agents). Build validation, reconciliation, and processes to keep the record current.
2. Treat the inventory system as a critical asset.
The definitive record becomes a high-value target. Who has access? How is it encrypted, logged, segmented? Design role-based access, audit trails, and protective controls.
3. Categorize assets by risk value.
All OT equipment isn’t identical—classify devices by criticality, exposure, and business impact. That lets you focus effort and secure where it matters most.
4. Map connectivity and communication paths.
Document how devices talk, what protocols they use, and any architectural or bypass paths. You’ll discover hidden lateral movement vectors that attackers could exploit.
5. Manage third-party risk and vendor access.
External connections and remote vendors often inject risk. Understand trust models, access rights, and how vendor systems could influence your OT environments.
What This Means in Practice — and How Leargas Helps
From Static Lists to Real-Time Awareness
Many organizations today use manual or static inventories that fall out of date almost immediately. The guidance mandates continual update—ideally via automation.
How Leargas helps: Our XDR platform ingests endpoint / network / log data continuously. We can integrate OT inventory data streams, detect changes, and raise alerts when discrepancies or drift appear.
Visibility Across OT, IT, and Security
Traditionally, OT and IT security operate in silos. But this guidance demands they converge.
Leargas role: As a unified security solution, Leargas is built to cross domain boundaries. We bring telemetry from endpoints, network flows, logs, and asset metadata into one ecosystem—closing visibility gaps.
Prioritize What Matters
Because it’s impossible to secure every device at once, you must triage based on risk.
Leargas helps you operationalize that by letting you tag assets (based on importance, exposure, or connectivity) and filter alerts, detection, and response workflows accordingly.
Protect the Inventory Itself
Your “source of truth” must be protected.
With Leargas, the inventory functions as a trusted data input within the XDR system. We enforce least-privilege access, encryption, logging, and segmentation of that data. We also detect suspicious access or changes to the inventory.
Turn Inventory into Action
A living inventory must drive defense. Once you know what’s where and how it’s connected, you can do:
Smarter segmentation
Targeted patching or hardening
Threat modeling and “what-if” attack path analysis
Faster, more informed incident response
Leargas amplifies that by tying detection and response rules to your asset contexts, so alerts become richer, more precise, and faster.
Steps to Modernize Your OT Inventory with Leargas
Here’s a pragmatic progression to move from inventory chaos to operational strength:
Discover & consolidate sources
Pull in existing asset lists, network scans, vendor logs, control system catalogs—and bring them into one schema.Integrate with continuous monitoring
Leverage Leargas XDR’s telemetry (endpoint, network flows, logs) to detect additions, removals, or configuration drift.Define context and classification
Assign attributes like asset type, criticality, connectivity zones, vendor, exposure level. That metadata becomes a core filter for security operations.Protect & govern inventory data
Enforce access control, audit trails, isolation. Treat the inventory with the same rigor as your crown-jewel systems.Operationalize decision tools
Use inventory context to drive segmentation policies, detection priorities, patch campaigns, and incident response workflows.Continuous refinement & validation
Don’t let the inventory become stale again. Build review cycles, spot-checks, and feedback with Operations or ICS engineers.
Why Leargas Security Is a Natural Fit
Leargas Security offers a unified XDR platform that is purpose-built to ingest, correlate, and act on rich security telemetry. By integrating OT/ICS inventory and context, we transform what is often a compliance burden into a foundational layer for advanced defense:
Unified telemetry ingestion: Endpoint, network, and log data in one pane
Context-aware detection & response: Use asset metadata to tailor alerts
Change detection & drift alerts: Be alerted when inventory deviates
Governance built in: Role-based access, audit logging, segmentation
Scalable across IT + OT domains: Bridge visibility from IT into operational systems
Because Leargas is designed to support converged security operations, including emerging threats, it is well positioned to serve OT environments where visibility, speed, and context matter.
Final Thoughts
The new guidance paints a clear picture: a dynamic, authoritative OT inventory is no longer optional—it’s essential.
Rather than building it as a standalone artifact, embed it into your security operations.
Leargas Security is uniquely positioned to support that transition, turning inventory from a compliance project into a live data backbone for threat detection and response.
If your organization is seeking to modernize inventory, harmonize OT/IT security, or scale detection and response, let’s talk about how Leargas can help you stand up this foundation.
