Cybersecurity in industrial environments is undergoing a major transformation as protection moves from perimeter defenses to hardened, secure‑by‑design devices.

At the same time, AI is reshaping both attack and defense—accelerating reconnaissance for adversaries while enabling faster anomaly detection and behavioral analytics for defenders. Regulatory pressure, including the EU Cyber Resilience Act and IEC 62443, is pushing manufacturers toward consistent, lifecycle‑focused security practices across multi‑vendor systems. Zero Trust networking, secure remote access, segmentation, and unified monitoring are becoming essential as IT/OT convergence grows. The goal is clear: protect production, maintain reliability, and build cyber‑resilient operations capable of safely supporting modern connectivity and smart‑manufacturing innovation.

In this special report, Industrial Ethernet magazine reached out to industry experts to get their perspectives on the current state Industrial Cvbersecurity.

Security at Device Level

New edge controllers ship with a hardened operating system, a built-in firewall, user accounts and encrypted communications.

Dan White, Director of Technical Marketing at Opto 22 said that “the biggest shift is that security is moving into the device. For years, OT security meant wrapping an insecure controller inside firewalls and hoping no one got past them. That model is breaking down. New edge controllers ship with a hardened operating system, a built-in firewall, user accounts, and encrypted communications out of the box. Security is a property of the device, not a perimeter bolted on later.”

White said that a second trend is publish-subscribe messaging, specifically MQTT with Sparkplug. Instead of SCADA polling controllers through open inbound ports, the controller makes a single outbound TLS connection to a broker and reports by exception. You close the inbound holes attackers look for, and you get a secure data pipe as a side effect. Third is identity. Devices now authenticate with certificates, not shared passwords, so you know what is actually on your network.

The Impact of AI

“AI cuts both ways. On defense, machine learning is good at spotting the thing a human misses: a controller that suddenly talks to an address it has never contacted, a process value drifting outside its normal envelope, a login at 3 a.m. from a new device,” White said. “Anomaly detection is only as good as the data feeding it, though. Garbage in, garbage out. This is where a clean, contextualized pipeline from the edge matters.”

Models trained on robust, high-quality data see the process clearly instead of guessing. On offense, attackers use the same tools. AI writes better phishing emails, finds vulnerabilities faster, and lowers the skill needed to launch an attack. The barrier to entry is dropping. The practical takeaway for OT teams: AI raises the stakes on the basics. It does not replace segmentation, patching, and least-privilege access. It makes them more urgent. And wherever you run AI, at the edge or in the cloud, watch how the data gets there. Every new pipe is a new thing to secure.

Technology Solutions

White added that the concrete benefit is a smaller attack surface. When a controller reports out to a broker over one encrypted connection, you can close the inbound ports that legacy polling required. Fewer open doors, fewer ways in. You also get data integrity you can trust. Encrypted, authenticated messages mean the number in your dashboard is the number the sensor actually sent, and nobody changed along the way.

For analytics and AI, that matters as much as security does. Device-level identity changes the game too. When every controller carries its own certificate, you know exactly what is on the network and can revoke access to one device without touching the rest. The larger impact on smart manufacturing is that you can finally connect the plant floor to the enterprise safely. The old answer to “can we get this data to the cloud” was “not without opening a hole.” Now you move production data up to MES, databases, and cloud analytics through a secure, decoupled pipe, and get the visibility a smart factory needs without betting the plant on a firewall rule.

Innovative Technologies

“Take a modern edge controller as the example,” White said. “Underneath the control engine runs a hardened Linux OS that the vendor patches and signs. The device has two or more network interfaces, so you physically separate the trusted control network from the plant or business network and route only what you choose between them. Each interface has its own firewall. Communications are encrypted with TLS and authenticated with device certificates.”

He said that, for data movement, the controller acts as an MQTT edge node: it publishes tag changes to a broker using Sparkplug, which defines a standard payload plus birth and death messages so consumers always know a device’s state and structure. A controller runs the machine, publishes its data outbound to a broker in the DMZ, and a VPN handles remote access for maintenance, with no permanent inbound path to the floor. Logic apps run on the same box, so edge processing happens next to the I/O instead of on a PC someone has to patch separately. One hardened device does the control, the security, and the connectivity.

Automation Engineering Concerns

White said that the first concern for automation engineers implementing security solutions is legacy equipment. Most plants run controllers installed before security was a design goal, and you cannot patch or replace them without downtime. Engineers have to protect gear that will be on the floor for another decade.

The second is uptime. In OT, availability wins. A patch that reboots a line is a production loss, so engineers are cautious about the update cycles IT takes for granted. Security has to fit around the process, not the other way around. Third is ownership. IT and OT often report to different bosses with different priorities: IT wants to patch and lock down, OT wants the line running. Somebody has to own OT security, and in many companies no one clearly does.

“Then there is the skills gap. The person keeping the plant running may not be a network security expert, and the security team may not understand a PLC. The honest answer is that good tools help but do not solve this alone. The wins come from segmentation, least-privilege access, and starting with the highest-risk assets, not from trying to secure everything at once,” White concluded.

EU Cyber Resilience Act (CRA)

Accelerating the focus on secure-by-design products, vulnerability management, software updates and lifecycle support.

The ISHG—comprising leading industry organizations including the FieldComm Group, ODVA, OPC Foundation, and PROFIBUS & PROFINET International (PI)—are working to align security concepts across industrial technologies and multi-vendor environments.

“For plant and automation engineers, cybersecurity is becoming part of the everyday engineering process. It now must be considered when selecting devices, designing networks, managing user access, and planning how systems will be maintained over their full lifecycle,” said Stephen Mitschke, Director – Standards Development & Conformance at FieldComm Group.

Mitschke said that the EU Cyber Resilience Act (CRA) is helping accelerate that shift by putting more focus on secure-by-design products, vulnerability management, software updates, and lifecycle support. At the same time, IEC 62443 gives engineering teams a practical, risk-based way to decide what protections are appropriate for a specific system or application.

“Another big trend is industry harmonization,” Mitschke said. “Through the Industrial Security Harmonization Group (ISHG), FieldComm Group, ODVA, OPC Foundation, and PI are working to align security concepts across industrial technologies and multi-vendor environments. NAMUR NE 201 is helping inform that work with practical OT use cases for identity and access management, particularly around authentication and authorization.”
For engineers, the goal is straightforward: security that is consistent, interoperable, and practical to deploy without making the plant harder to operate, maintain, or support.

New Solutions Benefits

“For end users, one of the biggest benefits of new industrial cybersecurity solutions is the move toward common, standards-based security approaches that can be applied across multi-vendor, multi-protocol automation environments,” Mitschke said. “This helps reduce the complexity of managing separate credentials, access methods and security policies for individual devices.”

Approaches reflected in NAMUR NE 201 use cases support centralized identity management, role-based authorization, and time-limited access tokens. Engineers and technicians can authenticate through a central system and receive access only to the devices and functions they are authorized to use, helping support least-privilege access while improving traceability.

“The broader benefit is scalability,” he said. “When common security concepts can be used across technologies such as HART-IP, EtherNet/IP, OPC UA and PROFINET—and across wired, wireless and Bluetooth interfaces—plants can apply more consistent security policies as networks become more connected.”

For smart manufacturing, Mitschke said that this creates a stronger foundation for secure remote access, asset management, diagnostics, analytics and IT/OT integration, while preserving the interoperability and operational flexibility that end users need.

“IT/OT convergence continues to be a major driver. As industrial environments become increasingly connected, responsibility for OT security is often moving from plant-level teams to centralized IT and cybersecurity organizations,” Michael Metzler, Vice President, Horizontal Management Cybersecurity for Digital Industries, Siemens.

IT/OT Convergence Driver

OT security often moving from plant-level teams to centralized IT and cybersecurity organizations.

According to Michael Metzler, Vice President, Horizontal Management Cybersecurity for Digital Industries at Siemens, several technology trends are shaping the newest Industrial Cybersecurity Solutions.

First, IT/OT convergence continues to be a major driver. As industrial environments become increasingly connected, responsibility for OT security is often moving from plant-level teams to centralized IT and cybersecurity organizations. “Many OT incidents can be traced back to compromised IT environments, remote access paths, or interconnected systems, driving the adoption of enterprise-grade security practices while still respecting OT requirements for availability, reliability, and safety.

Second, Zero Trust is evolving from a security concept into a practical deployment model for industrial networks. In the past, implementing Zero Trust in brownfield environments often required significant network redesign. Today, overlay-network technologies such as Siemens’ SINEC Secure Connect enable identity-based, certificate-backed, end-to-end encrypted communications between machines, cloud services, and users on top of existing network infrastructure, reducing deployment effort while improving security.

Third, AI adoption and AI-specific cybersecurity are becoming increasingly important. Industrial organizations are deploying AI for applications such as quality inspection, predictive maintenance, and operational optimization, creating new security requirements. Finally, there is a broader trend toward integrated, pre-validated cybersecurity platforms that combine networking, visibility, segmentation, remote access, and security monitoring into operationally deployable solutions.

AI Effect on Industrial Cybersecurity Landscape

“AI is significantly reshaping the Industrial Cybersecurity landscape. On the attacker side, generative AI is lowering the barrier to entry. Activities such as reconnaissance, phishing content creation, malware modification, and vulnerability research can potentially be performed faster and at greater scale than before, allowing attackers to operate more efficiently,” Metzler said.

He said that, on the defender side, industrial organizations are increasingly using AI to improve threat detection, anomaly identification, incident investigation, and response automation. Because industrial networks often contain heterogeneous assets and legacy systems, AI-driven behavioral analytics can help identify suspicious activities that traditional signature-based approaches may miss.

At the same time, the growing adoption of AI within industrial environments introduces new cybersecurity requirements. AI models, training data, inference engines, and edge AI infrastructure become additional assets that must be protected against manipulation, unauthorized access, data poisoning, and intellectual property theft. As a result, cybersecurity is expanding beyond protecting OT systems and networks to also securing the AI applications that increasingly support industrial operations.

Impact on Smart Manufacturing

“Industrial networks are the backbone of modern manufacturing and are becoming increasingly complex as organizations connect to machines, production systems, edge computing platforms, cloud services, and AI applications,” Metzler said. “As a result, hardware alone no longer determines network performance and resilience. Software-defined network management, continuous visibility, and integrated cybersecurity have become essential components of industrial operations.”

“Modern industrial cybersecurity solutions improve visibility into OT assets and communications, enable earlier detection of abnormal behavior, and help organizations respond more quickly to potential incidents,” he added.

Technologies such as Zero Trust networking, secure remote access, network segmentation, and identity-based communication reduce the attack surface while protecting both modern and legacy industrial assets. These solutions also help increase operational resilience by reducing the likelihood and impact of cyber incidents that could disrupt production. In addition, centralized management and security policies can simplify administration, reduce operational complexity, and support compliance with standards such as IEC 62443 and emerging regulatory requirements. For smart manufacturing networks, the impact is significant.

Protecting Production Environments

Metzler said that industrial cybersecurity must protect production environments against increasingly sophisticated cyber threats while maintaining the availability, reliability, and safety of industrial processes. Modern cybersecurity solutions therefore combine the principles of Defense in Depth and IEC 62443 with advanced technologies specifically designed for operational technology (OT) environments. What makes today’s cutting-edge cybersecurity technologies unique is their ability to provide strong security without disrupting industrial operations.

Unlike traditional IT security solutions, modern OT cybersecurity technologies can integrate into existing brownfield environments, including legacy devices that were not originally designed with cybersecurity in mind. Examples include AI-driven anomaly detection, which continuously analyses network traffic and device behavior to identify suspicious activities that may not match known attack signatures. It also includes industrial firewalls with deep packet inspection, which understand industrial protocols such as PROFINET, Modbus TCP, or OPC UA and can detect unauthorized commands; and Zero Trust solutions that establish identity-based, encrypted communication between authorized devices, users, and applications.

In factory environments, these technologies are applied to segment production networks, secure remote maintenance access, monitor industrial assets, detect abnormal behavior in real time, and protect data flows between machines, edge systems, cloud platforms, and enterprise IT systems. Increasingly, security functions are also being integrated directly into the infrastructure layer, enabling continuous inspection, visibility, and threat detection without impacting production performance.

He noted that the primary concern when implementing cybersecurity strategies is to ensure that security measures do not negatively impact availability, reliability, and safety. Production environments are designed to operate continuously, and any change that could introduce downtime, latency, or operational risk is carefully evaluated before deployment.

A second major challenge is the age and heterogeneity of industrial infrastructure. Many production assets remain in service for 15 to 20 years or longer and were not originally designed with modern cybersecurity features such as authentication, segmentation, encryption, or centralized asset management. Securing these legacy environments without requiring complete modernization or network redesign remains a significant technical challenge. Companies also frequently struggle with asset visibility and risk assessment. Before implementing effective cybersecurity controls, organizations must first understand which assets are deployed, how they communicate, their software and firmware versions, and which vulnerabilities may affect them. In many brownfield environments, this information is incomplete or unavailable.

Another important challenge is the ongoing OT cybersecurity skills gap. Industrial organizations often lack personnel who possess both deep operational technology expertise and modern cybersecurity knowledge. Finally, organizations face increasing pressure from regulatory requirements.

Yokogawa perspective on the trends shaping secure and resilient smart manufacturing.

Goal is Resilience of Entire Industrial Operation

Interconnected, traditional perimeter-based security is no longer sufficient.

“Industrial cybersecurity is undergoing a fundamental shift from protecting individual devices toward protecting the resilience of the entire industrial operation. As information technology (IT), operational technology (OT), Industrial internet of things (IoT), cloud platforms, and edge computing become increasingly interconnected, traditional perimeter-based security is no longer sufficient,” said Charles Lim, Head of Digital Security Solution for Yokogawa Engineering Asia.

Lim said that several technology trends are accelerating this change. First is continuous OT asset visibility to understand not only what devices exist, but their communication relationships, vulnerabilities, configurations, and operational criticality. Second is increasingly granular network segmentation and identity-based access, reducing unnecessary pathways between IT, OT and third-party environments. Third is the convergence of network, endpoint, identity, and process information into unified security monitoring.

Another important development is the growing emphasis on cyber recovery. Industrial organizations must assume that prevention will not always succeed, and therefore design environments capable of detecting abnormal activity, containing an incident, and safely restoring production.

“At Yokogawa, we see cybersecurity increasingly becoming an engineering discipline integrated throughout the industrial system lifecycle. The objective is therefore moving beyond “secure the network” toward maintaining safe, reliable, and resilient operations despite cyber disruption,” Lim said.

AI and Industrial Cybersecurity

“AI is changing industrial cybersecurity on both sides of the equation. Attackers can use AI to accelerate reconnaissance, vulnerability discovery, social engineering, and malware development, while defenders can use AI to process volumes of operational and security data that humans cannot realistically analyse manually,” Lim added.

For industrial environments, however, he said that AI must go beyond conventional IT threat detection. The real opportunity is to correlate network behaviour system behaviour, user activity, and process behaviour. A network connection may appear legitimate from a traditional cybersecurity perspective, for example, while the resulting command or process change may be highly abnormal.

This creates an important role for an AI-assisted security operations center (SOC) to perform behavioural analytics and industrial anomaly detection.

The goal should not be autonomous decision-making without context, but instead helping engineers understand what is abnormal, why it matters operationally and what action is safe to take.

Industrial AI must therefore be explainable, trustworthy, and grounded in process knowledge. Yokogawa believes the strongest future cybersecurity models will combine AI intelligence with OT engineering expertise and human judgement, rather than attempting to replace operators with algorithms.

Empowering Manufacturers

“The most significant benefit of modern industrial cybersecurity is not simply preventing cyberattacks, it is instead empowering manufacturers to pursue digital transformation without introducing unacceptable operational risk,” Lim said.

Smart manufacturing depends on connectivity among production systems, edge platforms, analytics, cloud applications, remote specialists, suppliers, and enterprise systems. Each connection creates business value but also creates another potential pathway into the operational environment. Modern cybersecurity provides the visibility, segmentation, authentication, monitoring, and governance necessary to make that type of connectivity sustainable.

For operators, better asset visibility reduces blind spots. Network detection identifies abnormal communications without disrupting sensitive OT equipment. Secure remote access allows vendors and engineers to support plants while controlling identity, privilege, and session activity. Integrated monitoring gives security teams greater context when incidents occur.

“Perhaps most importantly, modern solutions help organizations transition from reactive security toward cyber resilience. Manufacturers can identify critical operations, prepare response procedures, isolate affected environments, and restore essential functions in a controlled manner,” Lim said.

“Cybersecurity should therefore not be viewed as a barrier to smart manufacturing. Properly implemented, it instead becomes a foundation that allows greater connectivity, automation and innovation to occur safely.”

Lim said that the distinguishing characteristic of cutting-edge industrial cybersecurity is context. Traditional security technologies may detect IP addresses, vulnerabilities, or suspicious traffic; but industrial cybersecurity must also understand assets, communication protocols, production dependencies, and the potential consequence to the physical process.

A modern factory architecture therefore combines multiple defensive layers. Passive OT network monitoring can identify industrial assets and establish normal communication patterns without actively interrogating sensitive controllers. Network segmentation separates production zones according to their function and criticality, while industrial DMZs mediate connections between enterprise and plant environments. Identity-based secure remote access controls which engineers or vendors can access which asset, for what purpose, and for how long.

These telemetry sources can then feed an IT/OT security operations capability where information from firewalls, endpoints, identity systems, OT network sensors, and industrial systems is correlated.

The next step is process-aware detection. Instead of analyzing cyber indicators independently, security platforms increasingly combine network anomalies with system and operational behavior.

This defense-in-depth architecture empowers staff to detect threats earlier, while respecting a fundamental OT requirement: cybersecurity controls must never compromise safety, availability, or deterministic plant operation.

Addressing Engineering Challenges

“One of the biggest challenges is that industrial cybersecurity cannot simply apply enterprise IT security practices directly to the plant floor. OT environments have different priorities: safety, availability, and production continuity often come before confidentiality and data protection, and many systems were designed to operate for decades rather than follow short IT technology refresh cycles,” Lim said.

He noted that automation engineers therefore face several concerns. Legacy controllers and operating systems may not support modern security controls, patching may require production shutdowns, and active vulnerability scanning can introduce operational risk. Plants may also contain undocumented assets, flat networks, and third-party systems that no one currently owns from a cybersecurity perspective.

Another challenge is organizational. Cybersecurity increasingly sits between IT, OT, engineering, operations, safety and external vendors. Without clear governance, responsibility can become fragmented.

Companies should therefore avoid beginning with technology procurement. The starting point should instead be understanding the assets, critical processes, threats, and operational consequences, followed by a risk-based roadmap aligned with frameworks such as IEC 62443 and NIST CSF.
Ultimately, successful industrial cybersecurity requires three elements working together: technology, processes, and people. Technology alone cannot create cyber resilience.

“We are seeing expansion of cybersecurity regulations across all industries, which are being enforced not only locally, but also with regulations like NIS 2 and CRA as a requirement in Europe as a whole, potentially with international implications,” Tadeu Batista, global cybersecurity business development manager, Emerson.

AI Beginning to Make Impact

Primary user goals include increased visibility into infrastructure and detection of abnormal behavior.

“It can be hard to identify individual trends in cybersecurity because it’s never a one-size-fits-all response. Some industries are more open to using new technologies, while others may take years, or, in some cases, even decades to implement cybersecurity measures,” Tadeu Batista, global cybersecurity business development manager at Emerson told Industrial Ethernet magazine.

“When talking to end users, what we hear the most is the request to increase visibility into their infrastructure, and to detect abnormal behavior and respond to it on a timely basis. This all starts with a consistent asset inventory defining the criticality of each asset to drive tactics, techniques and procedures. The way end users approach this goal differs, with some industries are very open to cloud-based solutions, while others are more conservative, wanting everything on-prem and as isolated as possible,” Batista said.

He said that, fortunately for the more conservative teams, the Emerson DeltaV Automation Platform provides everything they need—application protection, endpoint protection and more—on prem. Emerson also partners with expert OT cybersecurity solutions providers to support many cloud technology strategies.

“We are also seeing increased discussion around ‘IT/OT convergence’. Conceptually, this idea is important, though we prefer “IT/OT confluence” because although IT/OT synergies are happening more frequently, we must recognize the objectives and behaviors in IT and OT remain different, typically requiring distinct measures. Working closely with an expert automation partner can help teams navigate those disparities,” Batista said.

Shifting Industrial Cybersecurity Landscape

Today’s most advanced automation solution providers are delivering secure-by-design software built around a zero-trust cybersecurity methodology to further enhance the traditional layered cybersecurity approach.

Batista said that the industrial cybersecurity landscape is anything but homogeneous, as different organizations in different industries will undoubtedly be on different maturity levels when it comes to cybersecurity. Nonetheless, artificial intelligence (AI) has made an impact as more reports detail the increased threat and increasing capabilities of deterrent solutions delivered by the rise of AI. Even the least cybersecurity-mature organizations are taking notice by making moves towards improving their cybersecurity posture, all thanks to the new possibilities AI is bringing on both sides of the fence.

It’s too early to say if novel vulnerabilities have been discovered, but the exploitation landscape has changed regardless. More numerous and sophisticated attacks can be carried out faster at a much lower cost, and the ability to explore non-obvious affordances is creating a new paradigm.

Therefore, he noted that Emerson sees increased need for tools that can identify threats faster and leverage AI-compatible behavior to respond accordingly.

This does not mean that traditional methods should be discarded altogether, however. IEC 62443 provides a comprehensive framework in a very structured way for organizations to improve their security program using traditional methods. As we continue to develop and deploy zero-trust cybersecurity principles, Emerson always recommends a layered approach that includes traditional cybersecurity strategies and technologies.

Managing Cloud Connectivity

“We’re seeing a significant shift in how organizations manage cloud connectivity. There is increasing demand for cybersecurity tools that can secure data movement to and from cloud platforms, and for secure remote access, while also detecting abnormal behavior on prem before any impact is caused to operations,” Batista said. “At Emerson, we partner with expert cybersecurity solutions providers like Belden, Trellix, Dragos, Nozomi Networks, OPSWAT and others to help customers design customized solutions to meet their need for increased data accessibility in the emerging AI era. With secure data connectivity, teams have the tools they need to improve continuous operations with less downtime.”

He said that many organizations have been gathering process data for several years or even decades. This data is hosted on cloud-based data lakes, and with frontier models these organizations are creating high fidelity process models and using them to improve their production systems.

Another example is using statistical models on advanced process control (APC) applications to deliver tighter control and optimize processes. And today AI is taking these strategies to a whole new level—but delivering those strategies means having the tools in place to securely deliver that data to AI engines so teams can detect issues before process upsets occur, and without creating new attack surfaces.

AI as Defensive Asset

Even as AI creates new threats, Batista said that it is also playing a key role in defense. At Emerson, they are using AI as part of the secure IEC 62443-4-1 certified development processes. Secure development augments code testing and provides vulnerability discovery/assessment to support developers so they can address vulnerabilities before they ever make it into the product. He said that the result has been incredibly secure solutions.

Patching is another foundational requirement that’s being transformed by AI technology. Adversaries have been augmenting their exploit capabilities, which makes it even more important for teams to keep their systems up to date. This means replacing end-of-life systems that are no longer maintained or receiving patches, while developing a regular patching strategy for modern systems to ensure new vulnerabilities don’t create additional attack vectors. A consistent, up to date asset inventory is the basis for this plan.

Endpoint protection is another important foundational requirement. Endpoint detection and response (EDR) and extended detection and response (XDR) are becoming very relevant, and vendors have been using AI to significantly improve their behavioral models.

“While protecting the endpoint is important, we cannot forget that data flows across the network, which is where intrusion detection solutions that are specifically tailored for OT environments deliver tremendous advantages,’ Batista said. “Fit-for-purpose solutions can understand industrial and vendor specific protocols, along with OT specific behaviors, to better identify abnormal behaviors. These include but aren’t limited to detecting new devices on protected network segments, firmware updates from unauthorized devices/users, logic downloads from unusual devices/users, and mode changes to control loops outside of normal conditions.”

Engineering Concerns

“We are seeing regulation expanding rapidly beyond just critical infrastructure to impact other companies as well. Many industrial asset owners will be impacted by regulations such as the Network and Information Security Directive (NIS2) and Cyber Resilience Act (CRA). Going back to the IT/OT

Confluence paradigm, security engineers are now tasked with finding solutions that provide compliance while improving plant operational performance. Simply applying IT tools and techniques as-is will not work because OT requirements are fundamentally different,” Batista said.

He said that this is creating an environment where meeting organizational objectives will include, among other things, adherence to local and/or industry specific regulations. Cybersecurity-specific regulations are nothing new, for example NERC-CIP is a cybersecurity regulation focused on critical infrastructure in the U.S. and it came into effect in 2010, with discussions starting as early as 2006.

“We are seeing expansion of cybersecurity regulations across all industries, which are being enforced not only locally, but also with regulations like NIS 2 and CRA as a requirement in Europe as a whole, potentially with international implications,” Batista added.

“Frameworks such as IEC 62443 help manufacturers, system integrators, and asset owners establish common expectations for areas such as authentication, access control, network segmentation, secure communications, system integrity, vulnerability management, and secure development practice,” Tim Wheeler, cybersecurity manager for industrial products, AutomationDirect.

Cybersecurity’s Changing Landscape

Industrial cybersecurity moving from a recommended practice toward a defined business and product requirement.

According to Tim Wheeler, cybersecurity manager for industrial products at AutomationDirect, regulation is one of the strongest technology trends driving the development of new industrial cybersecurity solutions. Requirements such as the EU Cyber Resilience Act (CRA), along with other emerging cybersecurity regulations, are moving industrial cybersecurity from a recommended practice toward a defined business and product requirement.

Manufacturers are increasingly expected to address cybersecurity throughout the product lifecycle, including secure-by-design development, vulnerability management, secure updates, incident reporting, and software supply-chain transparency. As these requirements mature, they are driving demand for industrial products with stronger built-in security capabilities and encouraging organizations to take a more proactive approach to managing cybersecurity risk.

“Cybersecurity frameworks and standards are providing the structure needed to turn these regulatory and security objectives into practical solutions,” said Wheeler. “Frameworks such as IEC 62443 help manufacturers, system integrators, and asset owners establish common expectations for areas such as authentication, access control, network segmentation, secure communications, system integrity, vulnerability management, and secure development practices. As these frameworks become more widely adopted, they are helping the industry move away from isolated security solutions toward a more consistent, risk-based approach. This provides a common language between IT, OT, engineering, manufacturers, and cybersecurity teams and helps organizations determine which security controls are appropriate for their specific systems and risks.”

Wheeler said that Artificial intelligence (AI) represents one of the newest and potentially most significant technology trends affecting industrial cybersecurity. AI provides the ability to analyze large volumes of network, asset, vulnerability, and operational data much faster than traditional manual processes, creating new opportunities for anomaly detection, threat identification, vulnerability research, predictive maintenance, and incident response.

“AI is also increasingly being used by both cybersecurity defenders and attackers, making it important for industrial organizations to understand both its opportunities and its risks. When combined with stronger regulatory requirements and established cybersecurity frameworks, AI has the potential to improve visibility and response capabilities while allowing limited cybersecurity resources to focus their attention on the risks that matter most to industrial operations,” he added.

The move to AI

AutomationDirect supports cybersecurity needs by following global standards, reducing unnecessary complexity, considering the entire product lifecycle, and providing practical resources and guidance to help end users strengthen their overall approach without making cybersecurity feel disconnected from day-to-day operations.

Artificial intelligence is rapidly changing the industrial cybersecurity landscape by giving defenders new capabilities for monitoring, analysis, and system verification. Industrial environments generate enormous amounts of network, device, and operational data that can be difficult for security teams to analyze manually. AI can help identify unusual network behavior, detect changes in system configurations, prioritize vulnerabilities, verify expected device behavior, and recognize potential threats before they develop into larger incidents.

This is especially valuable in OT environments where cybersecurity resources are often limited and where understanding what is “normal” for a system is critical to identifying potential problems. AI does not replace experienced cybersecurity and engineering personnel, but it can significantly increase their visibility and ability to respond quickly.

“At the same time, AI is increasing the capabilities available to attackers. Techniques that once required significant expertise, time, and resources can increasingly be assisted or automated through AI, including vulnerability research, reconnaissance, malware development, social engineering, and analysis of unfamiliar systems and protocols,” Wheeler said. “This has the potential to give less sophisticated attackers access to capabilities that begin to approach those historically associated with highly skilled or state-sponsored threat actors. For industrial organizations, this means the threat landscape is likely to become faster and more sophisticated. The challenge moving forward will be to use AI as a defensive force multiplier while continuing to strengthen industrial systems against attackers who are benefiting from many of the same technological advances.”

Industrial Cybersecurity Solutions

Wheeler said that new industrial cybersecurity solutions provide greater visibility, control, and resilience across increasingly connected smart manufacturing networks. Technologies such as AI-assisted monitoring, secure communications, network segmentation, stronger authentication, automated asset discovery, and continuous vulnerability management allow organizations to identify abnormal behavior and security risks faster while maintaining the availability and reliability required by industrial operations.

As smart manufacturing continues to connect PLCs, robots, sensors, production systems, cloud platforms, and enterprise applications, these capabilities make it possible to take advantage of greater connectivity and data sharing without unnecessarily increasing operational risk. Ultimately, stronger cybersecurity enables manufacturers to adopt new technologies with greater confidence, making security an enabler of smart manufacturing rather than a barrier to innovation.

“Cutting-edge industrial cybersecurity technologies are designed to protect factory systems without getting in the way of production. Newer tools can monitor industrial networks, learn what normal activity looks like, and alert teams when something unusual happens,” Wheeler said. “AI can help sort through large amounts of network and device information to identify possible threats faster. At the same time, newer PLCs, HMIs, gateways, and other industrial products are being built with stronger security features such as secure boot, signed firmware, encryption, user access controls, and security logging. Instead of relying on one security tool, these technologies create multiple layers of protection throughout the factory.”

In practice, he noted that these technologies help manufacturers connect machines, production systems, business networks, and cloud services more securely. For example, passive monitoring can identify unusual PLC communications without actively scanning or disrupting production equipment, while industrial firewalls and secure gateways can control which devices are allowed to communicate. AI can then help security teams make sense of this information and focus on the issues that present the greatest risk. When these technologies are implemented using a framework such as IEC 62443, manufacturers can take advantage of greater connectivity and automation while still protecting the safety, reliability, and availability of their production systems.

“One of the biggest concerns for automation engineers is finding the right balance between cybersecurity and keeping the plant running. Unlike traditional IT systems, industrial systems often cannot simply be rebooted, patched, scanned, or taken offline whenever a security issue is discovered,” Wheeler said.

Changes can affect production, equipment reliability, and even personnel safety. Many facilities also have older PLCs, HMIs, and other equipment that were designed long before today’s cybersecurity expectations. Engineers therefore need to understand the actual risk and apply security controls that make sense for their environment rather than simply applying traditional IT security practices to the factory floor.

“Another major challenge is resource limitations and the growing complexity of cybersecurity requirements. Automation teams are being asked to understand new regulations, standards such as IEC 62443, vulnerability management, network segmentation, secure remote access, and increasingly AI and cloud-connected technologies—all while continuing to support production,” he said.

“Companies may not have enough people with experience in both cybersecurity and industrial automation, making cooperation between IT, OT, engineering, and management increasingly important. The most successful approach is a practical, risk-based strategy that focuses resources on the systems and threats that matter most while gradually improving the organization’s cybersecurity maturity over time,” Wheeler added.

“The overall trend is therefore toward integrated, risk-based cybersecurity: visibility, context, identity, segmentation, monitoring and resilience working together rather than as independent security products,” Steve Mustard, president of National Automation, Inc. and former president of the International Society of Automation.

Protecting Networks versus Managing Operational Risk

Simply building a stronger perimeter is no longer sufficient.

According to Steve Mustard, president of National Automation, Inc. and former president of the International Society of Automation, industrial cybersecurity is moving from protecting networks to managing operational risk. Industrial environments are increasingly connected to enterprise systems, cloud services, remote support, IIoT devices, analytics platforms, and AI. Simply building a stronger perimeter is no longer sufficient.

“One trend is improved asset visibility and contextualization,” Mustard told Industrial Ethernet. “Modern solutions increasingly identify not only what devices exist, but what they do, how they communicate, and how important they are to the industrial process. This enables cybersecurity decisions to be based on operational consequence rather than simply vulnerability severity.”

Mustard said that network segmentation and zero-trust concepts are becoming more practical in OT. Technologies such as industrial firewalls, secure remote access, identity-based access controls and software-defined segmentation allow organizations to restrict communications without redesigning entire control networks.

Secure-by-design products are another significant development, driven by standards, in particular ISA/IEC 62443. Asset owners increasingly expect security capabilities to be built into industrial products and systems rather than added afterward.

“The overall trend is therefore toward integrated, risk-based cybersecurity: visibility, context, identity, segmentation, monitoring and resilience working together rather than as independent security products,” he said.

AI Effect on Industrial Cybersecurity

“AI is affecting industrial cybersecurity in two very different ways: it is becoming both a cybersecurity tool and a new source of cybersecurity risk,” Mustard said.

On the defensive side, he noted that AI can help analyze the enormous volumes of information generated by modern industrial environments.

Machine-learning techniques can identify unusual communications, changes in device behavior and patterns that would be difficult for a human analyst to recognize. Generative AI can also help security teams investigate alerts, correlate information and explain complex findings, potentially making sophisticated cybersecurity capabilities accessible to organizations with limited specialist resources.

However, AI does not eliminate the need for engineering judgment. An unusual network connection might indicate an attack, or it might represent a legitimate operational condition. In an industrial environment, understanding the process and its consequences remains essential. The operational consequences of interrupting a process in response to a suspected cybersecurity event may be more severe than the event itself.

AI creates new attack surfaces. Organizations must consider the integrity and provenance of data used by AI systems, manipulation of models or inputs, inappropriate autonomous actions, and the security of connections between AI platforms and operational systems.

The important principle is that AI should augment industrial cybersecurity decision-making, not replace accountable human and engineering judgment.

Impact on Smart Manufacturing Networks

“The biggest benefit of newer industrial cybersecurity solutions is their ability to provide security while recognizing that OT networks have fundamentally different priorities from conventional IT environments,” Mustard said. “Availability, safety, product quality, and production continuity can be just as important as confidentiality.”

Passive asset discovery and network monitoring, for example, can provide visibility without actively interrogating sensitive controllers. Industrial intrusion-detection technologies can understand protocols such as EtherNet/IP, PROFINET, Modbus TCP and OPC UA, allowing them to identify behavior that would appear perfectly legitimate to a conventional IT security product but may be abnormal for the industrial process.

Improved segmentation can also reduce the consequences of compromise. Instead of treating an OT network as one trusted environment, organizations can establish zones and conduits based on function and consequence, consistent with concepts defined in ISA/IEC 62443.

For OT, these capabilities are particularly important because increased connectivity creates both opportunity and dependency. More data can improve optimization, predictive maintenance and production decisions, but every connection potentially creates another pathway for failure or attack.

Effective industrial cybersecurity therefore enables digitalization. The objective is not to prevent connectivity, but to make connectivity appropriately controlled, observable and resilient.

Cutting edge cybersecurity

“Cutting-edge industrial cybersecurity increasingly combines several layers of technology rather than relying on a single defensive control,” Mustard said. “At the network layer, deep packet inspection can interpret industrial protocols and identify commands, configuration changes, and abnormal communications. Passive monitoring allows this analysis to occur without introducing traffic into sensitive control networks.”

At the architectural layer, segmentation technologies enforce permitted communication between industrial zones. Industrial firewalls, access-control lists, secure gateways and, increasingly, identity-aware technologies can restrict communication to explicitly required pathways. Secure remote-access solutions add multifactor authentication, session control, and auditing to vendor and engineering access.

At the endpoint and device level, secure boot, signed firmware, hardware roots of trust, and stronger authentication help establish whether devices and software can be trusted. Asset-management and vulnerability platforms then combine device identity, firmware information, vulnerabilities, and operational context to support risk-based decisions.

This all forms part of an integrated, consequence-based approach. A vulnerability with a high technical severity does not automatically represent the organization’s highest operational risk. Increasingly, cybersecurity information must be considered alongside asset criticality, network architecture, operational context, and the potential consequences of compromise.

This allows organizations to move from asking, “What is vulnerable?” toward the more useful question: “What could actually affect our operation, what would the consequences be, and what should we do about it?” This is consistent with the risk-based approach embodied in the ISA/IEC 62443 series.

Concerns for Automation Engineers

“For automation engineers, one of the biggest concerns is that a cybersecurity control intended to reduce risk can itself create operational risk,” Mustard said. “A control that is routine in IT, such as automated patching, aggressive vulnerability scanning, or automatically isolating a suspicious device, can have very different consequences when the device controls a production process.”

Legacy equipment remains another major challenge. Industrial facilities frequently contain equipment with operating lives measured in decades. Some devices cannot support modern authentication, encryption, or endpoint-security software, and others cannot be patched without interrupting production. Replacement may be technically possible but economically or operationally impractical.

Organizations also face a skills problem. Effective industrial cybersecurity requires knowledge of cybersecurity, networking, automation, process operations, safety and risk. Few individuals possess all those skills, making collaboration between IT, OT, engineering and operations essential.
Finally, organizations must avoid treating compliance as the objective. Standards such as ISA/IEC 62443 provide an important framework, but implementing cybersecurity is ultimately an exercise in risk management.

“The question should not simply be, ‘Are we secure?’ It should be: ‘Do we understand our risks, their potential operational consequences, and whether those risks have been reduced to an acceptable level?’” Mustard concluded.

“AI is reshaping industrial cybersecurity for both defenders and attackers. On defense, machine learning can now perform tasks that once required engineers to analyze packet captures manually, such as identifying normal behavior on aging SCADA networks, filling gaps in asset inventories from limited device data, and prioritizing the unpatched vulnerabilities that pose the greatest process risk,” Anand Edke, Cybersecurity Executive, Siemens US Digital Industries.

AI Reshaping Industrial Cybersecurity

AI-assisted monitoring as a part of the broader security operation, not a separate plant function.

Anand Edke, Cybersecurity Executive, Siemens US Digital Industries said that three technology trends are reshaping industrial cybersecurity.
First, asset visibility is becoming more intelligent. Passive monitoring tools now use machine learning to identify device types and establish communication baselines for controllers that cannot report their own status, helping close a long-standing OT security gap.

Second, identity is replacing network location as the basis of trust. More facilities assign each PLC, HMI, and workstation a unique cryptographic identity through plant-specific public key infrastructure, requiring devices to verify themselves before communicating.

Third, as plants send more process data to cloud historians and analytics platforms, security is moving closer to the edge. Lightweight cryptographic modules embedded in PLCs and RTUs can keep data encrypted from the machine to the cloud, while secure gateways extend similar protection to legacy devices. Together, these advances signal a shift from perimeter-based defenses to continuous verification and data-centric encryption.

“AI is reshaping industrial cybersecurity for both defenders and attackers. On defense, machine learning can now perform tasks that once required engineers to analyze packet captures manually, such as identifying normal behavior on aging SCADA networks, filling gaps in asset inventories from limited device data, and prioritizing the unpatched vulnerabilities that pose the greatest process risk,” Edke said.

Edke noted that a recent OT survey found that more than half of organizations placed OT security under the CISO in 2025, compared with 16 percent three years earlier. This shift reflects a growing view that AI-assisted monitoring should be part of the broader security operation, not a separate plant function. At the same time, adversaries are using generative AI to create more convincing phishing messages aimed at operators. At least one tracked threat group has also used fake recruiter profiles on professional networking sites to gain initial access before targeting the network. AI has not reduced the need for OT expertise; it has expanded the range of skills that expertise must include.

Industrial Cybersecurity Solutions

When asked about the benefits of new industrial cybersecurity solutions, Edke said that the most practical benefit is better triage. A widely cited annual OT threat report found that only about three percent of tracked vulnerabilities in industrial environments require immediate patching, while roughly 71 percent can be managed through compensating controls such as segmentation or monitoring. Solutions that make this distinction automatically—rather than forcing engineers to sort through a CVE spreadsheet without context on how a controller is deployed—help stretched teams focus on the risks that matter most.

“For smart manufacturing networks—where PLCs, robotics cells, and MES platforms stream data to cloud analytics systems and historians—encrypted and identity-verified pipelines make that connectivity safer. They allow teams to capture benefits such as predictive maintenance and cross-site benchmarking without turning a cloud connection into a shortcut into the plant,” Edke said.

Another key benefit is faster detection of process-level tampering. Because many OT investigations still begin with an unexplained operational anomaly instead of a security alert, closing that gap helps teams catch manipulation before it becomes a quality defect, downtime event, or safety issue.

Industrial cybersecurity has become the clearest point of joint concern and collaboration for both IT and OT professionals.

State-of-the-art Cybersecurity

Edke said that today’s OT security technologies stand out because they understand how plants operate instead of simply adapting IT tools for the factory floor. Deep packet inspection built for protocols such as Modbus, DNP3, PROFINET, and EtherNet/IP examines function codes and register values within each command. This context helps distinguish an authorized setpoint change during a shift from the same command sent at 2 a.m. by an unfamiliar workstation. Increasingly, this protocol-aware monitoring is paired with switch-level microsegmentation. This prevents, for example, a compromised packaging-line HMI from reaching PLCs that control a batch reactor several cells away, without requiring complete redesign of the physical network.

In practice, a sensor can learn a control loop’s normal behavior over several weeks, then immediately flag a command that falls outside that pattern—whether caused by malware, an incorrect change, or a failing sensor. Because this monitoring does not alter the PLC’s logic or firmware, it is especially valuable for legacy equipment that cannot be easily patched or taken offline for testing.

Engineering Challenges

Edke said that the most common concern in plant discussions is not a single threat, but the challenge of securing legacy equipment.
“Control systems installed 15 or 20 years ago were not designed to be patched, segmented, or fully inventoried, yet replacing them may be impractical when production cannot stop. Recent manufacturing surveys rank cybersecurity as the second-highest external risk to production, and about one-third of manufacturers consider stronger IT/OT security architecture essential over the next five years. Even so, retrofits remain costly and maintenance windows limited,” Edke said.

“Cloud-connected analytics and historians introduce another concern: unclear responsibility for encrypting process data and controlling access between plant operators and cloud providers. Many legacy devices also cannot support the encryption required for cloud connectivity without a secure gateway. The industrywide skills shortage is further compounding both these issues. Nearly half of manufacturers now consider cybersecurity expertise extremely important when hiring for automation roles, yet many candidates are trained in process control and safety, but not in network and cloud security,” he added.

Al Presher, Editor, Industrial Ethernet