How do you inventory OT and IoT devices without touching them?

Why is OT different?

Operational technology runs physical processes: production lines, building systems, utilities, laboratory equipment. Its devices often run for many years, on old operating systems, with no room for an agent. Some respond badly to unexpected network traffic. An inventory approach that is safe on an office network can cause an outage on a plant floor.

IoT devices, such as cameras, printers and sensors, share some of the same limits: no agent, limited management interfaces, and long lives. Medical devices add regulation on top.

What do vendors describe?

Passive discovery is the common answer. runZero describes passive discovery for OT alongside active scanning for IT. Armis describes agentless, passive discovery across IT, OT and IoT, with a separate module for medical devices. Lansweeper covers IT, OT, cloud and IoT and runs passive detection by default. ServiceNow describes OT inventory through a separate Operational Technology Management product. Axonius lists IoT and OT among the asset types it covers through the tools it connects.

The market is moving here. Dragos, an OT security company, announced in September 2026 that it had acquired runZero and NetRise to extend its xOT security platform.

What does NIST's draft guidance say?

NIST published the initial public draft of SP 800-82 Revision 4, its guide to OT security, on 21 September 2026. It expands guidance on OT security controls, including asset management and network monitoring, and is open for comments until 30 November 2026. If OT is part of your estate, it is worth reading the draft alongside your vendor shortlist.

How do you work with the OT team?

Start with them, not with a tool. Agree which networks can be scanned at all, which only passively, and which not at all. Ask what inventory they already keep, often in an engineering system or a spreadsheet, because it will hold detail no tool can discover. Run any new discovery first on a segment they choose, at a time they choose.

What about medical devices?

Hospitals and laboratories face the same limits with an extra layer of regulation, since a device may not be changed without the manufacturer's approval. Armis describes a separate medical device security module. The same principles apply: discover passively, record what each device talks to, and plan compensating controls for devices that cannot be patched.

What should the inventory record?

At minimum: what the device is, where it sits on the network, what it talks to, who is responsible for it, and whether it can be patched. The last point matters because many OT devices cannot be, which moves the work to network controls and monitoring.

What next?

Tick OT, IoT or medical devices in question 01 of the finder and, if you cannot install agents, say so in question 02; the finder will check each vendor's OT coverage and agentless collection.