August 31, 2026
Tank gauges in June. S7 controllers in August. Same failure: implicit trust on the wire.
Plant operators still make this argument: attackers do not understand their proprietary protocols.
That argument has a track record. The track record is bad.
TRITON targeted TriStation. TriStation is the proprietary protocol for Schneider Electric Triconex safety instrumented systems (SIS). Attackers reverse-engineered TriStation and wrote code that spoke the protocol. TRITON was designed to disable the SIS during a process attack. Safety systems protect workers when process control fails. TRITON was designed to remove that protection.
Stuxnet did the same to Siemens S7 programmable logic controllers (PLCs). Attackers reverse-engineered the S7 communication protocol. Stuxnet manipulated centrifuges while reporting normal operation to plant operators. The proprietary protocol was not a barrier. It was a delay.
Marco Ayala, an ISA Fellow and process control security specialist, has documented this problem for the chemical manufacturing sector. His analysis on Automation.com covers five cybersecurity myths that keep the obscurity argument alive. Ayala's central point applies across every industry that runs industrial control. Obscurity is not a security boundary. Obscurity is time.
OT (operational technology) security frameworks rely on zones. The Purdue Model and IEC 62443 (the international industrial cybersecurity standard) both define segmentation by zone and conduit. The model is sound. The assumption underneath the model is not always true.
Both frameworks assume that assets in a zone are separable from assets in other zones. A monolithic distributed control system (DCS) is not separable by design. Control functions, historian databases, safety systems, and engineering workstations share hardware, buses, and network paths. The DCS was designed for reliability across those shared resources, not for security between them.
Field devices (sensors, actuators, and instruments) sit at the base of the hierarchy. The control layer sits above them and talks to them. Zones are enforced at the control layer. That is what needs to be separated, and that is what a monolithic DCS cannot do.
On a diagram, zones look real. At the control level, the boundary does not exist.
Segmentation is the right answer to lateral movement. Separation is the prerequisite. You cannot enforce a zone boundary that does not exist. You cannot monitor traffic across a gap that was never enforced. Segmentation without separability is a diagram. It is not a defense.
Two CISA advisories made the problem concrete in 2026. Both describe the same failure mode at different layers.
June. In June 2026, CISA and partners published a hardening advisory on automatic tank gauge (ATG) systems. ATGs measure fuel levels and pressure at storage facilities. Many ATG units were connected directly to the public internet. CISA documented active exploitation of those units. Attackers did not need a zero-day exploit. Attackers needed only a path to the device, and the device had one.
August. CISA Advisory AA26-231A, published 19 August 2026, identified an active threat to internet-exposed Siemens S7 Series PLCs. Attackers scan the public internet for devices using S7comm on TCP port 102. Scripts available on the public internet can read and write PLC memory directly.
CISA stated: “This is not a theoretical risk—it is an active threat.”
Targeting is broader than Siemens S7 systems. All owners of internet-exposed PLCs should act. First actions are to inventory exposed devices, apply available patches, and remove PLCs from the public internet.
The failure mode is the same in both advisories. A control device sat on the public internet. Implicit trust on the wire did the rest.
Ayala's analysis on Automation.com identifies three assumptions that compound both problems.
Zones work when the control layer is separable. Open Process Automation (O-PAS), the standard published by The Open Group, defines how control functions run as separable, interoperable components. Separation is designed into the architecture. Zone boundaries exist at the control layer, not only on a diagram.
The European Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, sends a regulatory signal: cybersecurity by design is the expected standard for products with digital elements. The CRA applies to PLCs and field devices sold into the EU market. Products must meet those requirements from December 2027 and also report breaches and threats by September 2026. For proprietary DCS’s, the gap between the diagram and the control layer does not meet that standard.
Most current architectures do not start from separability at the control level. That gap is where attackers operate.
A control layer you cannot separate is a control layer you cannot protect. That is where the work starts and why security by design matters. That’s why O-PAS is the path forward.
