Dispersed pumping and treatment stations, telemetry over modems, old PLCs speaking clear-text Modbus. The sensor inventories equipment and sees write commands and integrators' remote access.
Heating plants and substations with SCADA on mixed IT/OT networks. We follow the links between the office network and the process network and any new device.
Substations and distributed sources with IEC-104 and DNP3. We see the commands (select/operate, reset) and who sends them, plus clear-text protocols.
Buildings have an OT side too: BACnet automation, HVAC, medical gas monitoring. The sensor inventories them and flags remote access and new devices, without touching the installations.