Getting Started in OT/ICS Cybersecurity 2026 (Part 8): The Ultimate OT/ ICS OSINT Masterclass

Value of the Information & Strength of the Argument

The video delivers strong practical value by demonstrating real techniques with live examples, showing how to search for exposed PLCs and HMIs using freely available tools. The argumentation is solid: he ties each technique to the overarching goal of finding vulnerabilities before attackers, using recent real-world attacks as motivation. The steps are clear and reproducible, and he provides cautionary notes about not touching live systems. The logical flow from simple Google searches to specialized engines builds a coherent methodology.

Scientific Rigor, Source Quality, Title Accuracy

The scientific rigor is moderate: the information is accurate and up-to-date, but it is largely experiential and based on the instructor’s own expertise. Sources cited include the Exploit DB, NSA ELITE WOLF GitHub project, and tool websites like Shodan, although not all are explicitly referenced with URLs in the video. The title aligns well with the content, which is a masterclass covering both basic and advanced OSINT techniques. There is no mention of comments analysis as none were provided.

The title accurately reflects the content, which is a comprehensive masterclass on OSINT for OT/ICS environments, covering multiple tools and techniques.

8/10

The tutorial provides practical, actionable OSINT techniques for discovering exposed OT/ICS assets, backed by real-world examples and current threat scenarios. The content is technical and methodical, but relies heavily on third-party tools and the author's experience, with limited verification of the claims about specific attacks.

• 00:00The Urgent Need for OT OSINT: Breaking down the August 2026 attacks on water facilities and exposed Siemens PLCs.
• 06:28Google Dorks & Exploit DB: Using the Google Hacking Database to find sensitive network diagrams and exposed directories.
• 20:00NSA's ELITE WOLF Project: How to convert NSA Snort signatures into custom search strings to find exposed Rockwell/Allen-Bradley PLCs.
• 39:26WHOIS Records & DNSlytics: Investigating malicious IP addresses and the limitations of modern anonymized WHOIS data. 53:15 - DNS Dumpster & ASNs: Mapping out corporate infrastructure and separating cloud hosting from actual target networks.
• 58:40The Danger of Social Media: Analyzing critical OpSec failures on Reddit and LinkedIn, from exposed PLC setups to visible network monitoring dashboards.
• 1:08:48Shodan Masterclass: Moving beyond default ports to safely identify exposed industrial control systems using device identification commands.
• 1:36:20Automating Searches with Smappy: Bypassing free-tier limits by scripting API queries to pull service and firmware versions.
• 1:52:42Shodan Images: Hunting for exposed RDP sessions, legacy Windows servers, HMIs, and security cameras.
• 2:01:51Censys: Utilizing the American Shodan competitor to scan all 65,535 TCP ports and dig into digital certificates.
• 2:09:03ZoomEye: Exploring the Chinese search engine alternative for unique global visibility.
• 2:14:55ICS Rank: Leveraging the ultimate database for OT-specific search dorks across all major platforms.

• Getting Started in OT/ICS Cybersecurity (OnDemand course) — Mentioned as a paid course for further learning.
• Mike Holcomb's website — Referenced for free OT/ICS cybersecurity resources.
• Mike Holcomb's main site — Linked for subscription and more content.

• Shodan — Referenced as a primary tool for finding exposed OT devices.
• Exploit DB GHDB — Source of Google dorks, including OT-specific searches.

• No conflicting sources identified — The video does not present controversial claims; the techniques are well-established in cybersecurity practice.