The objective of this report is to provide nuanced insight into the ICS risk and vulnerability landscape, the challenges it poses to operational technology (OT) security practitioners, and what conclusions can be drawn from publicly available data.