Twelve Beacons and Four Hundred Servers

Twenty-four hour sequence:

1. Scope before containing broadly. Pull DNS and proxy logs for the domain across all 3,000 endpoints and 420 servers, plus NetFlow for the servers without an agent. The beacon's regular interval is a gift: it will appear in DNS even where EDR is absent.
2. Network-contain the 12 known hosts using EDR isolation rather than shutdown, so volatile evidence survives, and reset the service account implicated in the credential dumping.
3. Block the domain and resolved IPs at DNS and egress, then tighten server egress toward deny-by-default. That buys time while you hunt.
4. Hunt the scheduled task name, binary hash, and parent process across EDR telemetry, and treat the uncovered 25% as potentially compromised until network evidence says otherwise.
5. Escalate to full incident response if a domain controller or the OT segment shows the same indicators.

What I deliberately do not do: reimage the 12 hosts before forensics, actively scan the OT network, or declare scope from EDR coverage alone. The flat /16 puts HR and finance one hop from the beaconing hosts, and the sorter shares that segment - a broadcast-heavy scan could be the event that stops production, and then security owns the $90,000 penalty instead of the attacker.

Real protection for a 180-device OT segment with no agent:

• Segmentation with explicit conduits: an industrial firewall or VLAN boundary permitting only the specific sorter-to-MES protocols and ports, no direct route to corporate, and no internet egress except brokered, logged, time-boxed vendor support tunnels.
• Passive monitoring from a SPAN port or network TAP, giving asset inventory and anomaly detection without touching the devices.
• Application allowlisting on the Windows hosts fronting the sorter where the vendor permits it, a hardened baseline, and no shared local administrator.
• Strict control of vendor remote access: named accounts, MFA at the jump host, session recording, and a defined window.
• A tested manual fallback procedure and a recovery image of the sorter controller, because availability is the safety property here.

Theatre:

• A traditional antivirus agent the vendor has not certified, on timing-critical software.
• Credentialed vulnerability scans against legacy PLCs that can crash them.
• 'Air gap' claims while a vendor 4G modem or a shared USB drive provides a path.
• A policy forbidding OT-to-IT traffic while the flat /16 remains in place.

The plant manager's constraint is legitimate but narrow: no agent and no stop. Segmentation, passive monitoring, and access control all fit inside that constraint.

The 1,400 is a portfolio, not a to-do list. This week the priority is the intrusion path, not the CVE count.

1. Anything the attacker is using now: the domain, the service account, the persistence, and the lateral movement paths. Patching does not evict an active foothold.
2. The VPN appliance with a known exploited vulnerability: internet-facing and pre-authentication, so either patch it or remove it from service behind a compensating control, with a dated decision record.
3. Criticals on assets holding credentials and backups - domain controllers, backup servers - because those determine whether the next incident is recoverable at all.
4. Then exposure-based triage: KEV status, exploit availability, internet reachability, asset criticality, and business dependency.

To the audit committee, state the population, the risk-based criteria, the number actually addressed, and the residual accepted by name. Do not promise 'all criticals in 30 days' across a fleet with 60% of servers on an out-of-support operating system; you would be writing next year's finding. Instead, name the root cause - unsupported platforms - and attach a funded remediation plan with dates. A defensible triage method plus honest residual risk is a stronger position than an unachievable SLA that everyone quietly knows will be missed.