# How do I protect an old production PC that cannot be patched?

Surround it, because you cannot fix it. Operator panels, HMIs and test-bench computers often run an operating system the vendor no longer supports, and the machine supplier forbids changes. Take it off every network it does not need, block its internet access, allow only the connections it needs to the controllers and servers it works with, disable USB ports and unused services where the supplier allows it, use application allow-listing if the vendor supports it, and keep a tested image so you can rebuild it. Ask the supplier for an upgrade path and record the remaining risk. Then watch it from the network, since nothing can be installed on it: NetSenX sees its connections from a SPAN or TAP port and flags beaconing, scanning, lateral movement and unusual outbound volume on every plan and, from the Pro plan, writes to controllers from hosts that are not allowed to write. It does not see what runs inside the PC.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/how-to-protect-an-unpatchable-pc-in-production

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [What is a compensating control for legacy OT systems?](https://netsenx.com/en/faq/what-is-a-compensating-control-for-legacy-ot-systems)
- [How do I build an OT asset inventory without active scanning?](https://netsenx.com/en/faq/how-to-build-an-ot-asset-inventory-without-active-scanning)
- [Which OT devices does passive monitoring miss?](https://netsenx.com/en/faq/which-ot-devices-does-passive-monitoring-miss)
- [How many sensors do we need to monitor three factories?](https://netsenx.com/en/faq/how-many-sensors-do-we-need-for-several-plants)
- [Can we monitor OT with open-source tools on a small budget?](https://netsenx.com/en/faq/can-i-monitor-ot-with-open-source-tools-on-a-budget)