Container deployments in operational technology (OT) environments pose unique security challenges, especially when privileged configurations are used. Traditional risk identification methods often fall short in addressing the complexity, dynamic nature, and interdisciplinary collaboration required in these settings. We propose a knowledge augmentation approach that combines semantic modelling, automated reasoning, and tool support to enhance security risk identification. Our approach is demonstrated through an industrial case study, highlighting its practical application. We also examine how large language models (LLMs) can support the instantiation and integration of the approach, improving usability and scalability.
Industries increasingly adopt containerised applications to modernise operational technology (OT)
environments [
Yet, risk identification is complicated by dynamic architectures, frequent changes, and the need for
collaboration across roles [
Identifying security risks in OT container deployments presents both technical and organisational
challenges. These arise from the decoupling of development and deployment, where containers built
in controlled environments are deployed in dynamic, interconnected OT systems [
A key issue is the fragmentation of knowledge. Security risk identification relies on stakeholders—such
as developers, operators, and security experts—interpreting shared artefacts like Dockerfiles to assess
risks [
The dynamic nature of containerised systems further exacerbates these issues. Frequent updates
to container images, deployment settings, or host configurations can invalidate previous risk
assessments [
We propose a model-based approach for identifying security risks in OT container deployments, using semantic web technologies to formalise domain knowledge. Ontologies represent deployment configurations, system assumptions, and threat scenarios in a structured, interoperable format, enabling consistent and context-aware assessments across roles.
Automated reasoning applies formal semantics to infer threats, validate assumptions, and assess the
impact of changes. This integration—referred to as knowledge augmentation [
We applied our approach in a case study on a large-scale industrial platform using Docker Compose for deployment. While operators can inspect Docker images (e.g., via vulnerability scans), doing so for every container is often too costly. As a result, decisions rely mainly on Docker Compose files. We formalised risks associated with these settings to support stakeholder risk identification.
Figure 1 illustrates the approach, structured into three iterative phases: Model, Instantiate, and Integrate. In the case study, we revisited earlier phases to refine the ontology and improve the knowledge graph based on feedback from operators and container developers.
In the Model phase, we developed an ontology linking Docker Compose settings, OT context
scenarios, and CORAS [
Large language models (LLMs) supported our approach from two perspectives: assisting risk modelling and improving usability. First, LLMs were used during the Instantiate phase to automate aspects of risk modelling. For example, they helped generate threat scenario templates from high-level deployment descriptions. While this improved eficiency, further research is needed to explore how LLMs can identify novel risks, connect attack vectors to impacts, and model complex, chained threat scenarios.
Second, LLMs enhanced the readability and accessibility of the CLI tool’s output by translating machine-readable JSON factsheets into human-friendly summaries. These summaries included key risks, treatment measures, and references to hardening guidelines. LLMs also show promise in adapting such resources to user-specific scenarios, such as translating general advice into context-specific recommendations. However, integrating LLMs into modelling introduces challenges: hallucinated risks may reduce trust, and overlooked threats may lead to false negatives. Thus, while LLMs ofer valuable support, expert validation remains essential.
Scalability and Practical Impact The semantic structure of the knowledge base enables scalability through modular updates, versioning, and integration with existing workflows. Users in our case study recognise the potential to automate risk assessment, especially as frequently updated applications from external providers are deployed. The adoption of risk factsheets reduces reliance on manual consulting and supports cross-role collaboration in dynamic OT environments. While initial efort is required to design the ontology and instantiate the knowledge base, the integration of command-line tools and LLMs improves long-term value. By making tool outputs deterministic, traceable, and actionable, the approach ensures that modelling eforts yield lasting benefits through structured knowledge reuse. Insights and Limitations Our evaluation highlights the potential of the proposed approach, but several limitations must be considered. We employ a qualitative method for risk assessment, meaning the quality of the generated factsheets depends heavily on the accuracy and detail of expert-driven modelling. Greater diligence during modelling improves the efectiveness of the results. In the case study, we primarily analysed Docker Compose files, which provide only partial insight into the applications. As such, the resulting factsheets reflect only the static deployment configuration and should be interpreted with caution. Additional artefacts—such as Dockerfiles, image vulnerability scans, or runtime behaviour—are currently not included but represent promising directions for future work.
We proposed a knowledge augmentation approach for identifying security risks in OT container deployments, combining semantic modelling, reasoning, and tool support. The method addresses key challenges and improves usability through LLM integration. Future work will focus on evaluating the completeness of identified risks, refining treatment measures, and exploring reliable LLM integration. Including additional artefacts like Dockerfiles and runtime data will further enhance applicability.
During the preparation of this work, the authors used Microsoft Copilot in order to: Grammar and spelling check, paraphrase and reword. After using these tool/service, the authors reviewed and edited the content as needed and take full responsibility for the publication’s content.