A city water-utility OT network has controllers with tiny CPU and memory budgets that cannot host endpoint agents. How should the SOC choose monitoring coverage for those devices?
Select an answer to reveal the explanation.
Short Explanation
Tiny PLC brains choke on fat agents—so watch them from the network side instead. Put agents where the hardware can handle them, and use agentless sensors for the constrained OT gear.
Full Explanation
Agent-based monitoring installs software on the endpoint; agentless approaches observe via network taps, SNMP, API, or remote interrogation without a local agent. Constrained OT and ICS devices often cannot support agents, so municipal SOCs select agentless coverage there while using agents on servers and workstations that can sustain them. Ignoring OT visibility or forcing unsuitable agents creates operational and security risk.