The article
In late November 2023, operators at US water facilities found a hacker's message on the screens of their controllers. The US Cybersecurity and Infrastructure Security Agency (CISA) later counted at least 75 compromised devices, at least 34 of them in US water and wastewater. No clever exploit was needed: the controllers were reachable from the internet, with a default password or none. The advisory also describes the attackers erasing a controller's program and loading their own.
That is the job of industrial cyber security services in one example: find the doors between the plant and the outside world, close them without stopping production, and make sure the plant can come back if someone gets through anyway. Below is how we do it, what it takes from your engineers and a self-check you can run this week.
I have been building software for 18 years. Since 2017 my team of 70+ specialists - engineers, designers, QA, DevOps and managers - has delivered 150+ projects. We look at a plant network the way we look at software: what talks to what, who can change what, and how you get back to a known good state.
Industrial cyber security services: the short version
| What | How it works |
|---|---|
| What we cover | An inventory of controllers, HMIs and plant networks; zones and firewalls between office IT and the plant; secure remote access; passive monitoring of plant traffic; backups of controller programs and settings; a recovery plan your engineers have practiced |
| How changes happen | In agreed maintenance windows, tested with your team |
| What we follow | IEC 62443 for zones, conduits and access rules |
| If you are not sure where to start | An assessment and a roadmap for your sites: OT cybersecurity consulting |
| Price | Estimated before work starts; the first call and the rough estimate are free |
Why this page talks about maintenance windows
Before writing this, I read the five pages Google showed for this search in October 2026: a product page, a download page and three company pages. None of them mentions IEC 62443, maintenance windows, how equipment vendors connect or backups of controller programs, and none shows a price. Five pages are a small sample. But those four topics decide whether a security project protects your line or stops it, so they are the center of this page.
Why a plant is not an office with older computers
In an office, a hacked laptop is a cost. On a plant floor, a controller that misbehaves can stop a line, spoil a batch or put people at risk. That changes the order of everything:
- Availability and safety come first. A fix that needs a restart waits for the window when the line is down anyway.
- Systems are older and harder to patch. A controller can run for many years, and its vendor may not support a new update on it.
- Looking can be risky. An active network scan that office equipment ignores can disturb an older controller.
That is why cybersecurity services for OT begin by listening, not by scanning. Good OT security work earns the engineers' trust first, because nothing on the floor changes without them.
What OT cybersecurity services cover at your plant
- An inventory of controllers, HMIs, switches and the links between them, with firmware versions and owners. Nobody protects a device that is not on the list.
- Zones and firewalls between office IT and the plant, designed as IEC 62443 zones and conduits: each zone talks to the others only through a controlled path, so ransomware that lands on an office laptop should stop at the plant's edge.
- Secure remote access for equipment vendors and your own staff: one controlled way in, two-factor sign-in, every session logged. CISA's advice after the 2023 attacks named the same basics: replace default passwords, take controllers off the public internet and require multifactor authentication for access to the OT network.
- Monitoring of plant traffic, passive by default. A copy of the traffic is watched and nothing is sent to the devices; a new device or a program download outside a window raises an alert.
- Backups of controller programs and settings, kept off the plant network. When attackers erase a controller's program, a plant with a current copy loads it back.
- A recovery plan your engineers have practiced: which line comes back first, from which copies, and who decides.
How OT cybersecurity implementation goes
Our OT cybersecurity implementation services follow four steps, and only the third one touches the plant.
- Assess. Passive discovery of the network and interviews with your engineers. From you: network drawings if they exist, and time with the people who know each line.
- Design. Zones, conduits and access rules following IEC 62443, reviewed with your engineers before anything changes.
- Implement. Changes go into the maintenance windows you already plan and are tested with your team. Nothing touches production without your engineers.
- Manage. Monitoring, updates and reviews over time. This is what OT cybersecurity management services are for: the plant changes, new equipment arrives, vendors come and go, and the protection has to keep up.
What people call OT cybersecurity resiliency services comes down to two things: one compromised zone does not stop the whole plant, and a stopped line comes back from tested copies, in an order everyone has practiced.
A self-check for the plant manager
Forward this table to whoever runs your plant network. Each question can be answered this week, without buying anything.
| Question | How to check | Why it matters |
|---|---|---|
| Can anyone reach a controller or an HMI from the internet? | Ask IT for every rule that lets outside traffic into the plant network | The 2023 water attacks began with controllers open to the internet |
| Does any device still use its default password? | Go through the inventory, device by device | Default passwords are printed in manuals |
| How do equipment vendors connect for support? | Ask each vendor, and look for remote desktop tools left running | An always-open path is a door nobody watches |
| Is there a current list of controllers, HMIs and switches? | Ask for it, with firmware versions and owners | Nobody patches what is not on the list |
| Can an office computer talk directly to a controller? | Check the firewall rules between the office and the plant | Ransomware in the office should stop at the plant's edge |
| When were controller programs last backed up, and where are the copies? | Ask for the date; keep copies off the plant network | The 2023 attackers erased programs |
| Who would notice a new device or a program change at night? | Ask who receives plant network alerts | Without monitoring, you learn from a stopped line |
| When did your engineers last practice a recovery? | The date of the last drill | A plan nobody has tried fails when it is needed |
If several answers are "we don't know", start with an assessment, not with new equipment.
Who decides on the plant floor
Your engineers and your equipment vendors stay in charge of the process. We propose, they approve, and a change goes in when the line allows it. If a security change does not fit the process, we find another way to get the same protection: a separate zone, tighter access or closer watching. Findings on the office side of the boundary - servers, accounts, software - our engineers fix as cybersecurity remediation, without waiting for a window.
If something is already wrong at a plant, that is incident response. There too, the first decisions about what to isolate are made with your engineers, because safety and the process come first. Plant network alerts can be watched as part of our security monitoring, and the risks behind your roadmap can be rated in a cybersecurity risk assessment.
What the price depends on
Industrial OT cybersecurity services are estimated before work starts, and the first call and the rough estimate are free. The estimate follows:
- How many sites, lines and devices you have, and how many vendors and generations of equipment.
- Whether remote access exists today, and how many vendors use it.
- Whether monitoring is in scope, and who answers its alerts: your team, or ours as part of managed security.
- How often maintenance windows come, since changes wait for them.
Where to start
Tell us about your plant: the sites, the equipment and how vendors connect today. We reply with where we would start and a rough estimate, free. If you want the whole picture first, our industrial cyber security services begin with an assessment, and the rest of what we do is on the cybersecurity page.
