OT (operational technology) security means protecting PLCs, SCADA, HMIs and other field control devices: the systems that run production itself rather than the business's IT. Its first priority is not data confidentiality but keeping the line running safely and continuously.
In practice you start with an asset inventory, separate the office and production networks with a controlled transfer zone, route and log all supplier remote access through a single point, and back up PLC programs and SCADA projects separately, all planned around maintenance windows so production never has to stop.
What is really on a factory network?
In many plants the production network has grown in layers over the years. A fifteen-year-old PLC, a SCADA client on a PC whose operating system is out of support, a remote access modem installed by the machine builder, energy analysers and mixed-brand IP cameras added later: all sitting on the same flat network. The "separation" from the office is often a single router, and the link that feeds data to the ERP for reporting quietly joins the two sides together.
This set-up brings its own challenges. A production PC cannot be updated because the machine builder has not approved the patch. Common industrial protocols such as Modbus TCP have no authentication or encryption, so anyone who can reach the network can send commands. Standard IT tools, an aggressive network scan for example, can lock up an old PLC. IT security methods therefore cannot be copied straight into OT: IT puts confidentiality first, while OT puts continuity and safety first.
Nor does an attacker need to target OT specifically. Ransomware that starts with a phishing email in the office can travel across a flat network to the SCADA server and encrypt the operator screens. The line stops even though every PLC is intact, because operators can no longer see the process.
What stopped production costs
In OT, the cost of a breach is measured less in stolen records than in lost production.
Siemens estimates that the world's 500 largest companies lose almost $1.4 trillion a year to unplanned downtime, equivalent to 11% of their revenues. (Siemens The True Cost of Downtime 2024)
The same Siemens report puts the cost of an hour of unplanned downtime at $2.3 million in a large automotive plant and $36,000 in fast-moving consumer goods plants. Those figures cover every cause of downtime; a cyber incident is only one of them, but it is the kind measured in days rather than hours.
The threat is widespread. The Verizon 2026 Data Breach Investigations Report found ransomware in 48% of all breaches, and ENISA's Threat Landscape 2025 reports that exploitation of vulnerabilities accounted for 21.3% of intrusions in the European incidents it analysed. Industrial PCs that have gone unpatched for years and internet-facing remote access modems sit exactly where those two trends meet.
How OT security differs from IT security
| IT (office) | OT (production) | |
|---|---|---|
| Priority | Confidentiality, integrity, availability | Availability and safety, then integrity |
| Patching | Monthly, automated | In maintenance windows, with vendor approval, sometimes never |
| Device lifetime | 3–5 years | 15–20 years or more |
| Protocols | Encrypted and authenticated | Modbus, Profinet and others, often unencrypted |
| Scanning | Routine active scanning | Active scans can lock devices; passive monitoring preferred |
| Outage impact | Disruptive | Scrap, lost orders, safety risk |
The table shows why OT security cannot be solved by "applying the IT security policy to the factory as well". The approach relies on protecting the device's surroundings rather than replacing the device.
An 8-step OT security framework for SCADA networks
The international IEC 62443 series of standards and the Purdue model provide the overall framework. The steps below are a practical order for a small or mid-sized plant:
- Build an asset inventory. Every PLC, HMI, SCADA server, engineering workstation, drive, analyser and camera, with model, firmware version, IP address and owner. Use passive network monitoring and a site walk; avoid active scans that could affect production. The vulnerability scanning that is routine on the office side is planned in OT only for maintenance windows and together with the vendor.
- Separate the networks. Put a transfer zone (DMZ) between the office and production networks. Data should reach the ERP through an intermediary server in that zone, not directly from the PLCs, and production should have no direct route to the internet.
- Segment by line or cell. A problem on one line should not spread to the others; firewall rules should allow only the protocols and addresses that are actually needed.
- Funnel remote access through one gate. Remove modems installed by machine builders; route all supplier access through a single point with multi-factor authentication, time limits and session logging, and close access when the job is done. If you manufacture for EU customers, expect this control to be checked under NIS2 requirements for suppliers as well.
- Change default passwords and disable unused services. No factory passwords left on HMIs, cameras, switches or modems; unused USB ports and services switched off. Restrict physical entry to panel, server and control rooms too; a zone-based card access control system such as SmartPass lets only authorised staff in and records entries in an audit trail. We cover zone design for server and control rooms in detail in data centre access control.
- Patch according to risk. List the devices that cannot be patched and compensate with segmentation and access restrictions. Apply patches with the vendor, in maintenance windows.
- Take OT-specific backups. PLC programs, HMI and SCADA projects, drive parameters and network device settings should be versioned, with an offline copy, and restores should actually be tested. Our ransomware backup strategy guide covers the wider backup approach.
- Monitor and write an incident plan. New devices, new connections or out-of-hours programming attempts on the production network should raise alerts. The plan should state who brings each line to a safe state and in what order, and operators should know it.
Who should own OT security?
The most common gap in OT security is organisational rather than technical. IT says the production network is not their territory, maintenance says security is IT's job, and nobody owns the space in between. In plants where this works, the production network has a named owner; segmentation and access rules are approved jointly by IT and the maintenance or automation lead, and every change is recorded briefly. Contracts with machine builders and system integrators should also include clear clauses on remote access, passwords and handover of backups.
What you can do in the first 30 days
The full framework takes time, but three things can be done straight away: find internet-facing remote access modems and either close them or route them through a single gate, take a current copy of PLC and SCADA projects to a location off the network, and change default passwords. Together these close a large share of the most common attack paths. The baseline controls to tackle on the office side at the same time are listed in our SME cyber security checklist. If you plan to connect machines to each other and to the ERP, treat these three tasks as a precondition for going digital; the order of work towards a connected plant is set out in our Industry 4.0 roadmap for SMEs.
Remotely accessible inverters and data loggers fall into the same risk class; we summarise solar-specific measures in our guide to solar power plant monitoring.
How Digital Bridge approaches OT security
As a team that both builds and tests industrial systems, we work in an order that does not put production at risk:
- Assessment: our cyber security consultancy includes IoT and OT security audits that examine the attack surface of smart devices, PLCs, SCADA systems and industrial networks: outdated software, unencrypted protocols and the separation between office and production networks. We agree scope and timing in writing and verify findings without interrupting service. Our penetration testing guide explains the general approach.
- Remediation: findings are reported by severity with practical fixes. Where a fix needs changes on the SCADA side, our SCADA and HMI team can deliver it under the same roof; with the custom SCADA systems we build, the source code belongs to the customer and there is no additional licence fee.
- Secure data flows: when production data needs to reach the office or management dashboards, we design the flow in remote monitoring and MES production management projects without breaking network separation.
- Field devices: because we design our own IoT devices and electronics, we know first-hand how field devices communicate and where they tend to be weak. IP camera monitoring in the plant is brought under the same segmentation rules.
If you want to understand the basic building blocks first, our article what is SCADA is a good starting point; the wider security and compliance topics on the office side are gathered in our Cyber Security & Compliance guide.
Next step
This week, sit down with your production manager and IT and answer one question: "In what ways can someone connect to our plant from outside?" List them all, including machine builders' modems, remote desktop connections and cloud dashboards. Next to each, note who uses it, when it was last used and what would be affected if it were closed; that table becomes the first draft of your segmentation project. If the list is longer than you expected, get in touch; we will review your site with you and send a written proposal with clear stages and cost.