Advisory Staleness in Operational Technology: Measuring Coverage and Latency of ICS/OT Vulnerability Intelligence for Critical Infrastructure

Abstract

Background: Vulnerability intelligence for operational technology (OT) — the control systems behind water, energy, and manufacturing — lives in a structurally different ecosystem from IT vulnerability intelligence: CISA ICS advisories (OT-specific analysis published as HTML prose), thin CVE/NVD coverage for OT vendors, heterogeneous vendor advisories, and community-maintained datasets (the ICS Advisory Project's CSV conversions). The 2026 issue's companion papers mapped the IT-side intelligence infrastructure; the OT side diverges at every machine-consumable step. Objective: We analyze where OT vulnerability intelligence exists, where it decays, and what coverage and latency the OT advisory lifecycle actually delivers. Methods: Source-structure analysis of the four OT intelligence channels; funnel decomposition of the advisory lifecycle (CVE assignment → enriched advisory → machine-readable format → patch availability); and a six-risk-versus-six-mitigation coverage assessment aligned with IEC 62443-era needs. Results: The OT intelligence funnel decays sharply at the machine-consumable steps: CVE identifiers exist for most OT vulnerabilities, enriched advisories cover a subset, machine-readable formats are rare, and patch availability for embedded control devices is the weakest stage. The community-maintained conversion layer (the ICS Advisory Project) demonstrates both the demand for machine-readable OT intelligence and its sustainability fragility. Conclusions: OT vulnerability staleness is an infrastructure property, not a data problem: until OT vendors publish machine-readable advisories through CVE-grade channels, OT consumers will depend on community stewardship and manual analysis — and resilience planning should treat that dependency explicitly.