Bedem - Vulnerability Management Across Corporate IT and Substation OT

Dashboard, findings list, finding detail, triage queue and patch windows. Each of the 26 demo findings opens its own detail page with evidence, remediation, exceptions and history.

CVSS, EPSS, CISA KEV, exposure, asset criticality, exploit maturity, OT safety impact, attack vector and compensating controls add up to a 0 to 100 risk score, banded P1 to P4 with 2 override rules.

Substation and control-centre findings come from passive sensor traffic. Active scanning of an OT zone needs an approved exception tied to a patch window with an engineer on site.

22 IT and OT assets, 16 vulnerabilities, 10 remediation tickets, 9 patch windows, 6 scan sources, 8 IEC 62443 zones and 13 items in the triage queue.

Severity Is Not Risk

A CVSS score measures how bad a flaw is, not how likely it is to be attacked. Bedem has to weigh it against the EPSS probability, membership of the CISA KEV catalogue, exposure and how critical the asset is, and store CVSS v4.0 and v3.1 side by side because many records still carry only the older score.

Substations Cannot Be Scanned

An earlier attempt to scan an RTU network with a standard IT scanner froze two older devices. OT assets have to be found and assessed from mirrored network traffic, where firmware versions are inferred and can be wrong, so every OT match carries a confidence level.

OT Fixes Wait for an Outage

Following IEC TR 62443-2-3, Kozjak installs only patches the vendor has qualified, and a relay or RTU can be updated only during a planned maintenance outage. A P1 in a substation needs a compensating control now and a fix in the next qualified window, not a 7-day deadline.

Exceptions Without an End

Risk acceptances were agreed by email with no expiry, so nobody knew which were still valid. Each one needs an approver at the level the policy sets, controls with evidence and a review date, and re-approval when a covered finding's priority rises.