This analysis discusses the challenge posed by AI-driven vulnerability discovery in operational technology (OT) environments where patching is often infeasible due to legacy or bespoke systems. It highlights that unpatchable systems remain vulnerable to exploitation, especially when attackers gain internal network access. The recommended mitigations include building visibility through network fingerprinting, applying micro-segmentation using VLANs and ACLs to restrict communication to authorized devices, and deploying next-generation firewalls with up-to-date intrusion prevention systems to inspect and block malicious traffic. The article also notes that air gaps and data diodes, while theoretically isolating OT systems, are frequently compromised in practice. The overall approach is to compensate for unpatchable vulnerabilities with rigorous network defenses and visibility.

Unpatchable vulnerabilities in OT systems expose critical infrastructure such as medical equipment, building management, and industrial control systems to potential exploitation. These vulnerabilities can be discovered increasingly quickly due to AI-assisted analysis, increasing risk. Exploitation could lead to disruption or compromise of essential services. Systems running end-of-life software or bespoke platforms with common vulnerable components are particularly at risk. Attackers with internal network access can identify and target these vulnerable systems despite lack of public exposure. The inability to patch these systems leaves them persistently exposed unless mitigated by network controls.

Applying official patches remains the primary mitigation strategy. When patching is not possible, organizations should deploy compensatory controls including: 1) Building visibility of vulnerable OT systems through network fingerprinting to maintain an accurate inventory; 2) Implementing micro-segmentation using VLANs and ACLs to restrict OT system communications to authorized devices only; 3) Deploying next-generation firewalls with up-to-date intrusion prevention systems upstream to inspect and block exploit attempts via deep packet inspection; 4) Recognizing that air gaps and data diodes may be circumvented in practice and maintaining vigilance for breaches. These network-based defenses provide virtual patching and reduce attack surfaces for unpatchable systems.