Factories & OT
See what's reachable on your factory floor before a contractor does
AdminKit's free tools let factories check Modbus and remote-access exposure today, including port forwards like VNC, RDP, or Modbus TCP that a contractor opened for a single maintenance job and nobody ever closed afterward, with identity-based OT remote access planned as a later paid layer.
Updated October 21, 2026
The problem
Factory floors run a mix of machines, sensors, and controllers that were often installed years apart by different vendors, with little central tracking of what’s connected to what. Some of this equipment “calls home” to a vendor’s server for telemetry or firmware updates as part of normal operation, a configuration decision that’s easy to lose track of once the installer has left.
A more pressing issue is remote access for contractors and maintenance staff. It’s common for a technician to need temporary access to a machine’s control system, and for that access to get set up quickly, often as a port forward to a protocol like VNC, RDP, or Modbus TCP, aimed at getting the job done that day. The trouble is that this kind of access routinely stays open long after the maintenance job is finished, because closing it isn’t anyone’s specific responsibility.
Industrial protocols like Modbus were generally designed for isolated networks and don’t include built-in authentication, which is fine as long as the network stays isolated. Once a path from the internet reaches that network, there’s often nothing checking who’s allowed to send commands.
What you can do for free today
- Check if a Modbus TCP endpoint is reachable — only run this against an asset you own or are authorized to test.
- Check your public IP and whether it’s shared via CGNAT — helpful context before investigating exposure further.
- Check which commonly-exposed ports are open — useful for spotting a port-forwarded VNC, RDP, or Modbus path left open after a maintenance job.
What AdminKit will add
AdminKit’s planned OT remote access product is a later-phase item, further out than AdminKit’s other products, and does not exist yet. The idea is identity-based tunnels for contractors instead of raw port forwards, with session recording and scheduled maintenance windows so access isn’t left open indefinitely. For factories that want a hands-on review of their current remote-access setup now, AdminKit also offers a remote-access redesign through services, offered as a quote since no fixed price is published.
The free tools above only check what’s reachable from outside your factory’s network; they don’t see inside it or touch production systems unless you’re running the check against your own equipment with consent. Mapping out current remote-access paths and checking which ports are still open from old maintenance jobs is a reasonable starting point while the longer-term access product is still being built.
This page is general guidance, not a security audit of your specific network — see our disclaimer for what AdminKit's guidance does and does not commit to.
Frequently asked questions
Is it safe to run the Modbus check tool on our equipment?
Only run it against assets you own or are authorized to test, since it queries the device directly over the network. It's meant as a visibility check, not a scan of networks you don't control.
Can AdminKit see data moving on our factory floor network?
No. From outside, AdminKit only sees what's reachable at your public IP, the same as any other visitor would see. It would only see more if you specifically connected an agent or remote-access product, which isn't live yet.
What's the problem with giving contractors VNC or RDP access?
The access itself isn't the problem; the issue is that it's often set up quickly through a port forward for a single maintenance job and then left open indefinitely. Nobody ends up tracking who has access or when it was last used.
Is AdminKit's OT remote access product available now?
No, it's a later-phase item, further out than AdminKit's other products. The plan is identity-based tunnels with session recording and scheduled maintenance windows, but none of that exists yet.
Do machines really send data to vendors without IT knowing?
It happens when equipment is set up to phone home for telemetry or updates as part of its normal operation, and that configuration isn't documented or reviewed afterward. It's a configuration gap more than anything malicious, but it's still worth knowing about.
Want AdminKit set up for you?
Tell us about your setup — we will follow up about early access and, if you need it, expert help.