The Cybersecurity and Infrastructure Security Agency (CISA) issued a warning about a network mapping tool developed by the National Security Agency (NSA). According to the agency, a vulnerability concerning extensible markup language (XML) allows “crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information.” Security researcher Anna Quinn In a GitHub post explained that insufficient hardening of the XML parsing process could allow users to craft malicious requests when opening stored sessions, allowing actors to induce errors in the Grassmarlin message console. Grassmarlin is an operation technology (OT) tool created to help NSA security teams passively identify IP-based devices on industrial control systems (ICS) and supervisory control and data acquisition (SCADA) networks. The tool was retired in 2017 and no fixes exist for the issue. CISA recommended users minimize network exposure for all control system devices and/or systems, and locate firewall-protected control system networks and remote devices to then isolate them from business networks. As recently explored by SDxCentral, the OT-based security threat has seen big ticket acquisitions such as Mitsubishi's buyout of Nozomi Networks, and ServiceNow snaring Armis recently for $7.75 billion. Mauricio Sanchez, senior director at Dell’Oro Group, said cyber asset attack surface management (CAASM) and external attack surface management (EASM) are converging with IoT security needs, helping asset management become a “hot” security theme in 2026. This has been reflected by government advice from authorities such as Britain’s National Cyber Security Centre, which recently published principles to help firms manage OT system security. Zero Networks CEO Benny Lakunishok said such advice is essential for natural infrastructure. “In OT environments supporting energy, water, transport, and manufacturing, attackers often abuse trusted access that already exists – an approach seen in incidents affecting fuel pipelines, power grids, and water utilities,” Lakunishok