Top 10 Cybersecurity Risks in Industrial Automation

By Dustin Guttadauro, Product Line Manager - Telecom & Fiber, Infinite Electronics

Key Takeaway 

•   Industrial automation environments face a distinct class of cyber risk: the devices are long-lived, the protocols are unauthenticated, and the consequences of a breach are physical — stopped production lines, damaged equipment, or safety incidents. 

•   The two highest-scored risks in this matrix — insecure remote access and unpatched PLCs — are preventable with controls that most IT security programs already recommend but OT teams rarely enforce at the same cadence. 

•   Physical-layer controls (shielded cabling, surge protection, locked enclosures) eliminate entire attack categories before any software patch is needed — an underrated starting point that most OT security frameworks mention but don't specify. 

•   Legacy protocols like Modbus and DNP3 have no native authentication. Isolating them at the network level — rather than trying to retrofit encryption — is the practical mitigation. 

•   This ranked risk matrix covers the 10 threats that plant engineers and OT security leads most commonly encounter across PLC, HMI, and SCADA environments, with a one-paragraph mitigation note for each. 

Why do industrial automation systems attract cyberattacks? 

Industrial automation systems – PLCs, HMIs, and SCADA servers – are high-value targets for a straightforward reason: attacking one can stop a factory, shut down a pipeline, or compromise a power grid. The potential impact is orders of magnitude larger than a typical corporate data breach. 

The attack surface is also larger than most organizations realize. A mid-size manufacturer might have hundreds of connected field devices, many running firmware from a decade ago, communicating over protocols that predate the concept of network security. The engineers who run these systems were trained to keep production running, not to think like adversaries.  

Industrial Automation Cybersecurity Risk Matrix 

Scores are based on documented ICS incident frequency (likelihood) and published operational and safety impact data from CISA ICS-CERT and Drago’s Year-In-Review reports (impact). Both axes run 1–5; risk score is the product. 

Legend: Critical = 20–25  |  High = 12–19  |  Medium = 6–11  |  Low = 1–5 

Risk 1 — Insecure Remote Access (Score: 25 / Critical) 

Insecure remote access is the single most commonly exploited vector in recent OT incidents — and the most preventable. Remote desktop tools, VNC, and vendor-supplied maintenance portals are regularly exposed to the internet with weak or shared credentials, no MFA, and no session logging. The 2021 Oldsmar water treatment attack used an open TeamViewer connection. The 2021 Colonial Pipeline ransomware event originated in a legacy VPN account with no MFA. Both were well-known attack patterns; neither was new. 

Mitigation: Enforce MFA on every remote access pathway. Use a dedicated jump server or bastion host — never allow direct RDP or VNC to OT devices from the internet. Log every session with automatic termination after inactivity. Audit vendor access monthly and revoke credentials when maintenance is complete. 

Risk 2 — Unpatched PLCs and Firmware (Score: 25 / Critical) 

Most PLCs in production today are running firmware that hasn't been updated in years. Some are running versions with publicly disclosed vulnerabilities that have had patches available for a long time. 

The challenge is real: OT patch cycles are slow because rebooting a PLC means stopping the process it controls. Testing a firmware update requires a staging environment that most manufacturers don't have. Vendors sometimes don't release patches for legacy hardware at all. The result is a large installed base of devices where known vulnerabilities stay open indefinitely. 

Mitigation: Maintain a live firmware inventory for every connected OT device. Subscribe to CISA ICS-CERT advisories for the specific makes and models you run. Where patching isn't feasible, compensate with network isolation — a vulnerable PLC that can only communicate with its designated controller is much harder to exploit than one reachable from the corporate network. 

Risk 3 — Default and Shared Credentials (Score: 20 / High) 

A significant portion of deployed PLCs, HMIs, and SCADA servers are still running default manufacturer credentials — admin/admin or the device model number as a password. 

This isn't carelessness — it's often a deliberate operational choice. A shared password on a control panel means any technician can log in quickly during a production emergency. The problem is that shared credentials are unsuitable: if something goes wrong, you can't tell who was logged in. And default credentials for most major OT vendors are publicly listed in product documentation — they're among the first things an attacker tries. 

Mitigation: Change all default credentials before devices go live. Implement individual accounts for every operator and maintenance engineer — shared accounts should have no place on OT systems. Use a privileged access management (PAM) tool to store and rotate OT credentials without exposing them to individual users. 

Risk 4 — Flat Network Architecture (Score: 20 / High) 

A flat OT network – where every device can talk to every other device – means a single compromised node can reach everything else. This is still the default architecture in many older facilities. 

The consequence is that lateral movement, once an attacker has a foothold, is trivial. The WannaCry ransomware outbreak in 2017 spread across flat networks at manufacturing facilities (including Renault and Nissan plants) because there was nothing between devices to slow it down. The malware targeted Windows systems used for HMI operation — a common configuration that flat networks make impossible to isolate quickly. 

Mitigation: Segment OT networks into zones with defined conduits between them, following the IEC 62443 zone-and-conduit model. Industrial firewalls and DMZs between the IT and OT layers are the baseline. Micro segmentation at the device level is the goal for high-security environments. Start with the highest-consequence systems — safety instrumented systems and critical process controllers — and work outward. 

Risk 5 — Legacy Protocol Exploitation (Score: 16 / High) 

Modbus, DNP3, Ethernet/IP, and PROFINET dominate OT networks. None of them were designed with authentication or encryption. A device speaking Modbus will execute any command sent to it from any source on its network segment — no credentials required. 

This is not a new problem, and it's not easily fixable with software patches because the protocols themselves are the issue. Retrofitting encryption onto Modbus breaks compatibility with the installed base of equipment that speaks it. The practical attack: an adversary who gains access to the OT network segment can query PLCs, read sensor values, and issue control commands using standard, freely available tools. 

Mitigation: Isolation is more reliable than attempting to encrypt legacy protocols. Use OT-aware intrusion detection systems — Dragos, Claroty, and Nozomi Networks all understand these protocols at the packet level and can alert on anomalous commands. Deep packet inspection at zone boundaries catches command injection before it reaches the device. 

Risk 6 — USB-Borne Malware (Score: 16 / High) 

USB removable media remains one of the most reliable vectors for introducing malware into air-gapped or tightly segmented OT environments. 

Stuxnet, the most sophisticated ICS attack ever documented, required USB media to reach the air-gapped Iranian nuclear centrifuge network. More recently, the Industroyer2 malware — used in the 2022 attack on Ukrainian power infrastructure — was introduced to OT systems via workstations that had removable media access. The pattern repeats because it's effective: engineers routinely use USB drives to transfer configuration files, firmware updates, and diagnostic data between systems. 

Mitigation: Disable USB ports on all OT workstations and HMIs that don't require them — this can be enforced at the BIOS level or via endpoint policy. For systems that genuinely need removable media access, implement a dedicated malware scanning kiosk that USB drives must pass through before being used on OT systems. Document every USB transfer. 

Risk 7 — Supply Chain Compromise (Score: 15 / High) 

The industrial automation supply chain — hardware vendors, software suppliers, integrators, and OEM maintenance providers — introduces risk that's harder to see and harder to control than most internal threats. 

The Solar Winds attack in 2020 demonstrated the scale of supply chain exposure: malicious code inserted into a trusted software update reached thousands of organizations before detection. In OT environments, the equivalent is a firmware update from a trusted vendor that contains compromised code or an integrator who installs a backdoor during commissioning. CISA has documented multiple cases of ICS hardware received from suppliers with malware pre-installed. 

Mitigation: Require vendors to provide a software bill of materials (SBOM) for firmware and software components. Verify cryptographic signatures on all updates before applying them. Treat third-party integrators with the same network access controls you'd apply to potentially hostile external parties – limited scope, logged sessions, and access revoked immediately after work is complete. 

Risk 8 — Physical Layer Interference and Attack (Score: 12 / Medium) 

Physical infrastructure vulnerabilities are the OT security risks most often omitted from software-focused security frameworks — but they're consistently present in production environments. 

Electromagnetic interference from motors, variable frequency drives, welding equipment, and industrial power systems induces noise on unshielded Ethernet cables, causing packet loss, CRC errors, and intermittent connectivity. In a security context, unexplained network disruptions are hard to distinguish from a cyberattack — and they can trigger fail-safe conditions with their own operational consequences. More directly: an open Ethernet port on a factory floor HMI is an unauthenticated network access point for anyone with physical proximity. Voltage transients from lightning or switching equipment can damage connected switches and create conditions that disrupt communications or corrupt data. 

Mitigation: Start with the physical infrastructure.Shielded Ethernet cables(STP or FTP construction) reduce EMI-induced errors in high-noise environments. Ethernet surge protectors installed at every field device entry point absorb transient voltage events before they reach network equipment.Secure industrial enclosures with locked access panels eliminate walk-up network port access. These are infrastructure decisions that need to be made before running the first cable — retrofitting them is far more expensive than specifying them correctly from the start. 

Risk 9 — Insider Threats (Score: 12 / Medium) 

Insider threats in OT environments take two forms: malicious insiders who deliberately cause harm, and inadvertent insiders who introduce risk through mistakes — misconfigurations, accidental deletions, or unintentional malware introductions. The inadvertent category is more common and often more consequential. An engineer who connects a personal laptop to the OT network to run a diagnostic tool, an operator who bypasses a firewall rule to make a machine accessible remotely, and a technician who loads unverified firmware from an unofficial source — these are all insider risk events that show up in incident reports without any malicious intent. In OT environments, where systems are complex and documentation is often incomplete, well-intentioned workarounds create persistent vulnerabilities. 

Mitigation: Implement least-privilege access controls so no single user has unnecessary access to systems outside their role. Log all configuration changes with user attribution — OT systems that don't support audit logging should be treated as a security gap. For high-risk roles, consider privileged access management solutions that proxy access and maintain session recordings. 

Risk 10 — Inadequate Physical Access Controls (Score: 12 / Medium) 

Physical access to OT equipment is network access, and in many facilities, it's inadequately controlled. 

A control panel with an unlocked door, an HMI in an accessible area of a factory floor, and a network switch mounted in an open rack near a loading dock — each of these is a point where an adversary with physical proximity can plug in, reboot, or manipulate equipment without any credentials. Physical access bypasses most software security controls entirely. The first step in several documented OT incidents involved an attacker or insider with physical access to equipment that should have been in a locked enclosure. 

Mitigation: Every OT device that houses a network port should be in asecure industrial enclosure with controlled access. Access logs — who opened the enclosure, when — are as important for OT security as network access logs. For high-consequence areas, use electronic access controls with individual key assignment rather than physical keys that can be copied. Combine with camera coverage at entry points for post-incident investigation capability. 

Why physical-layer hardening should come first 

Software patches and network segmentation are essential — but they sit on top of a physical infrastructure that either supports security or undermines it. A patched PLC with an unshielded cable running through a motor drive is still a reliability risk. A segmented network with an unlocked enclosure on the factory floor is still a physical access vulnerability. 

Physical-layer controls also eliminate risk categories entirely, rather than just reducing them. An Ethernet surge protector doesn't mitigate voltage transient risk — it removes it. A locked, rated enclosure doesn't reduce walk-up network access risk — it eliminates it. This is qualitatively different from software mitigations, which reduce the probability of exploitation but leave the vulnerability present. 

The practical argument is sequencing: get the physical infrastructure right before layering software security on top of it. A security program built on faulty physical foundations will have gaps that policy and software can't close. 

Frequently Asked Questions 

Q1: What are the most common cybersecurity threats in industrial automation? 

A: The most frequently exploited threats in documented ICS incidents are insecure remote access, unpatched firmware on PLCs and HMIs, and flat network architectures that allow lateral movement. These three account for the majority of confirmed OT security incidents tracked by CISA and Dragos. Legacy protocol exploitation — particularly unauthenticated Modbus and DNP3 traffic — is a consistent secondary vector once an attacker has network access. 

 Q2: What is the difference between ICS security and SCADA security? 

A: ICS (Industrial Control Systems) is the broad category that includes SCADA, DCS (Distributed Control Systems), and PLC-based automation. SCADA specifically refers to supervisory control and data acquisition systems — typically the software layer that collects data from field devices and presents it to operators. SCADA security is a subset of ICS security. In practice, the terms are often used interchangeably, but SCADA-specific risks tend to concentrate at the human-machine interface and historian layers, while ICS risks extend to the field device and network levels. 

 Q3: How do I assess cybersecurity risk in an OT environment? 

A: Start with an asset inventory — you cannot assess risk on assets you don't know exist. Use passive network monitoring tools (Claroty, Nozomi, or Dragos) that can identify OT devices without disrupting communications. Score each asset by its consequence of compromise (process criticality, safety impact) and its exposure (network reachability, patch status, credential quality). Use a risk matrix like the one in this article to prioritise remediation. External OT security assessments from firms specialising in ICS — not general IT security consultancies — will surface vulnerabilities that internal teams miss. 

Q4: Do physical layer controls count as cybersecurity? 

A: Yes. Physical access controls, cable shielding, surge protection, and secure enclosures are part of a complete OT security posture — IEC 62443 explicitly includes physical security as a requirement at higher security levels. More practically, a network port accessible to anyone who walks up to it is a cybersecurity vulnerability, regardless of whether the attack vector is digital or physical. The distinction between physical and cyber security is less useful in OT environments than in corporate IT.