Cybersecurity
Vulnerability Management
Handling advisories on equipment you cannot reboot.
Written guides in this section
Full references, procedures, and diagnostic guides published under Vulnerability Management.
Advisories and Alerts
Where a utility learns its equipment has a known vulnerability and what to do with the news: the government and vendor advisory feeds, the sector center, the exploited catalog, subscribing by product, a weekly triage on exposure and consequence, and records.
8 min readUpdated Sep 5, 2026
Risk-Based Patching
Deciding what to patch first when everything cannot be patched at once: priority from exposure, exploitation, and consequence rather than scores, tiers with timelines, different rules for servers, network gear, and controllers, and the written accept decision.
8 min readUpdated Sep 5, 2026
Compensating Controls
What to do about a vulnerability that cannot be patched now or ever: restricting who can reach it, disabling the service, blocking dangerous protocol functions, allowlisting, monitoring, physical and procedural controls, matched to the attack path.
8 min readUpdated Sep 5, 2026
Topics in this area
Advisories And Alerts
Advisories And Alerts — practical reference notes for controls engineers, integrators, and technicians working with vulnerability management.
Risk-Based Patching
Risk-Based Patching — practical reference notes for controls engineers, integrators, and technicians working with vulnerability management.
Compensating Controls
Compensating Controls — practical reference notes for controls engineers, integrators, and technicians working with vulnerability management.
Direct contact
Have a controls question?
Reach Eric Sullivan directly about anything on this site, a controls or automation topic, or one of his personal projects.
References to manufacturers, products, model numbers, software platforms, technical specifications, companies, standards organizations, or other organizations are provided for informational purposes and do not imply sponsorship, endorsement, authorization, or affiliation unless expressly stated. Manufacturer specifications must be independently verified against current manufacturer documentation.