octovision Asset Inventory: Configuration-Based OT Inventory Explained

The octovision asset inventory answers a narrow but important question: what is actually installed in my plants, down to the firmware and software version? Unlike most OT inventory tools, it does not listen to the network. It is built from the configuration and project data that octoplant uploads from devices during its backup jobs, which AMDT describes as working “without network scanning or agents”. This page explains what that method sees, what it misses, how unmanaged assets enter by CSV, and why a plant serious about OT security usually needs both kinds of inventory.

It sits under the octovision overview, part of the AMDT cluster.

Two ways to build an OT asset inventory

AMDT’s own marketing frames this as “two ways to build OT visibility”, and the distinction is real.

Network-based discovery puts a sensor on a switch mirror port, or sends carefully crafted queries, and builds the inventory from what crosses the wire. Claroty, Nozomi, Dragos, Armis and Tenable work this way. It finds every device that communicates, including the ones nobody knew about.

Configuration-based inventory reads the engineering project or configuration from each device and records what is in it: the CPU, its firmware, the modules in the rack, the engineering software version, the logic version. octoplant collects this as a side effect of backup, and octovision aggregates it across sites.

What the octovision asset inventory sees, compared

Question	Network-based discovery	octovision (configuration-based)
How is data collected?	Passive traffic capture, sometimes active queries	Read from project and configuration data during octoplant backup jobs
Does it add network traffic?	Passive: no. Active: some, which some plants restrict	No additional traffic beyond the backup jobs themselves
Firmware version	Often inferred from traffic or queried; depth varies by protocol	Read from the device configuration
Modules, cards, logic version	Partial, protocol-dependent	Yes, for devices octoplant supports
Change history	Sees that a download happened, on supported protocols	Versioned history and compare against approved
Unnetworked or serial devices	Invisible	Covered where octoplant can reach them
IT, IoT and unknown devices	Yes, this is its strength	Only if imported
Communication paths and anomalies	Yes	No
Data freshness	Near real time	As fresh as the last successful job
Can it restore the device?	No	Yes, through octoplant

The plant consequence is in the last row. An inventory that can also put the configuration back is a recovery asset, not just a list. An inventory that sees every device on the wire is a detection asset. They answer different questions, and a CISO asking for “the asset inventory” usually needs both answers. The vendor-neutral version of this comparison is on our OT asset inventory page.

Checking the octovision asset inventory against CISA’s attribute list

In August 2025 CISA, with the NSA, FBI, EPA and cyber agencies in Australia, Canada, Germany, the Netherlands and New Zealand, published Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators. It names 14 high-priority attributes to record for each asset. The table shows where each one typically comes from. It is our reading of the two methods, not a statement of octovision’s field list, which AMDT does not publish in full.

CISA high-priority attribute	Configuration-based (octoplant, octovision)	Network discovery	Usually from people or the CMMS
Manufacturer, model, asset role or type	Yes, read from the project	Often, by fingerprint	As a cross-check
Operating system	For PCs and devices with an OS, depending on device support	Often	As a cross-check
Asset criticality	Classified in octovision since the Summer Release 2026	Some platforms support tagging	Yes: the judgement is human
Hostname, IP address, MAC address	Partly, where the project or configuration holds them	Yes	IP address plans, where kept
Ports and services, active protocols	Partly, from configuration	Yes, observed on the wire	Rarely
User accounts, logging	Rarely	Partly	Often a manual survey
Asset number, physical location	Only if imported	No	Yes

The pattern is clear. Configuration data is strongest on what the device is and what it runs; network data is strongest on how it communicates; and the business attributes come from people. A complete inventory joins all three, which is the case for the CSV import below and for reconciling the two tools.

Managed versus unmanaged assets in the octovision asset inventory

The Summer Release 2026 split the octovision asset inventory into two populations.

• Managed assets are under octoplant. AMDT states their configurations are “backed up, versioned and recoverable”.
• Unmanaged assets are everything imported from elsewhere. They appear in octovision and can be enriched with vulnerability and lifecycle data, but there is nothing behind them to compare or restore.

The ratio between the two is a useful number for management. A site at 95% managed has a recovery story. A site at 40% has a list. Tracking the ratio per plant over a year shows whether backup coverage is actually expanding, which is a far more honest progress measure than licences purchased.

Importing discovery data by CSV

AMDT states octovision accepts external assets by CSV from discovery tools, CMMS or spreadsheets. As of October 2026 we found no public, certified connector to Claroty, Nozomi, Dragos or Armis, so plan for a file-based process. A sensible sequence:

1. Export the asset list from the discovery tool, scoped to the OT zones you care about.
2. Clean it. Remove IT endpoints you do not want in an OT inventory, and drop duplicates where one device has two interfaces.
3. Map the columns to what octovision expects. Vendor, model and firmware fields from discovery tools rarely use the same names as engineering software.
4. Import and review what lands as unmanaged.
5. Reconcile. For each unmanaged PLC, HMI or drive, decide: bring it under octoplant, accept it as list-only, or retire it.
6. Repeat on a schedule. A CSV is a snapshot. Without a cadence, the unmanaged list drifts out of date within months.

Step 5 is where the value is. Every unmanaged controller in a production cell is a device that cannot be restored from a known-good copy, and that decision should be made deliberately.

Why plants need both

A network sensor will find the forgotten Ethernet-to-serial gateway an integrator installed in 2014. It will not tell you that the controller behind it runs logic that differs from the approved version. octovision will tell you the second thing and miss the first.

In our view the two inventories should be reconciled at least quarterly, and the differences treated as findings: a device the network sees that octoplant does not back up is a recovery gap; a device octoplant backs up that the network never sees talking may be isolated, retired or on a segment nobody documented. Both are worth knowing before an incident.

An illustrative case. A packaging plant runs a discovery sensor and octoplant side by side. The sensor lists 212 OT devices; octoplant manages 168. The 44 difference breaks down into IP cameras and printers that belong in the IT inventory, nine HMIs on an OEM skid that nobody had added to a backup job, and three PLCs on a line extension commissioned last year. Meanwhile octoplant manages six devices the sensor never sees: drives and a robot controller on a segment without a mirror port. Each list on its own looked complete. Together they produced a dozen concrete actions, and the most valuable was the nine HMIs, because their projects existed only on the OEM’s laptop. For how the two tool categories compare more broadly, see octoplant vs network OT security. If the network side is the weaker one, unmanaged switches are often where discovery sensors go blind.

Where it gets hard

• Identity matching. Network tools key on IP and MAC. octoplant keys on its own component structure. The same PLC can appear twice under different names until someone matches them by hand.
• Coverage is capped by octoplant’s device support. The official matrix is behind the myAMDT login. A device type octoplant cannot read will only ever be an unmanaged row.
• Stale jobs look like current data. If a backup job has failed for three months, the firmware shown is three months old. Check job status before trusting a version.
• Ownership. The discovery tool usually belongs to security, octoplant to controls. Someone has to own the reconciliation, or the CSV import happens once.
• Spreadsheets carry errors in. Importing a legacy asset register imports its mistakes, now with a dashboard on top.

A baseline inventory reconciled across both methods is the starting point of a plant systems assessment, and it is worth doing before buying a tool on either side.

---

Related: octovision overview · octovision Vulnerability Management · Asset Lifecycle and Obsolescence · OT security platforms and octoplant · AMDT hub