A SCADA is the system that supervises and remotely controls industrial installations: it collects measurements from controllers, displays alarms and sends set points. Its security is a physical issue, not just an IT one, since an attack can stop production, damage equipment or put people in danger. Documented attacks most often go through default passwords, equipment exposed to the internet or the office network, and the IEC 62443 standard is the reference for protection.
SCADA: definition and components
SCADA stands for supervisory control and data acquisition. The first systems appeared in the 1960s: for the first time, a valve could be operated from a control centre rather than on site. They are found in plants, water networks, power generation and distribution, gas and oil pipelines and district heating networks. A SCADA brings together:
- a human-machine interface (HMI), which presents data to the operator and lets them issue commands;
- a supervisory system, which acquires data and sends set points;
- programmable logic controllers (PLCs) and remote terminal units (RTUs), which control the field;
- a communication infrastructure between supervision and the field;
- a database and often a historian of measurements.
SCADA does not replace the operator: it is mainly used for monitoring and alarms, with decisions remaining human. It differs from MES, which tracks production orders, quality and traceability (see our guide MES software). The reference guide from the US NIST classifies SCADA, like distributed control systems (DCS) and PLCs, as operational technology (OT), meaning systems that act on the physical environment.
Why a SCADA is vulnerable
ANSSI, the French national cybersecurity agency, sums up the problem: industrial systems control processes that have a direct physical effect, some use IT technologies without having been designed for the threats they bring, and IT security solutions are not always suited to them. The weaknesses that recur in documented attacks:
- default passwords, left in place on controllers and supervisory software;
- equipment exposed directly to the internet, on its original communication ports;
- entry through the office network: a phishing email opens access to the corporate network, then to the SCADA;
- old controllers, with poorly documented or poorly maintained protocols, and obsolete operating systems;
- poorly protected physical access, such as keys left in a position that allows equipment to be modified.
The convergence of IT and the shop floor multiplies these entry points. The architecture of plant networks is covered in our guide Industrial 5G and industrial networks.
Known attacks on control systems
Four public cases show how these weaknesses are exploited:
- Stuxnet (discovered in June 2010, with traces going back to June 2009): the first known worm to spy on and reprogram industrial systems. It targeted Siemens controllers and their supervisory software, used default passwords and hit around 45,000 systems, 30,000 of them in Iran.
- The Ukrainian power grid (23 December 2015): after phishing emails on the corporate network, the attackers took control of the SCADA of three distribution companies, switched substations off remotely and destroyed equipment and files. Around 230,000 people lost power for one to six hours.
- Triton (2017): at a petrochemical site in Saudi Arabia, malware targeted the safety instrumented system, the one that brings the installation to a safe state in case of danger. It caused two shutdowns, in June and August 2017. Physical keys had been left in a position that allowed access to the system.
- Unitronics controllers (November 2023): Iran-linked attackers took control of internet-exposed controllers, protected by the default password or no password at all, at water treatment facilities in the United States; these controllers are also used in energy and food production. The US authorities' advisory calls for replacing default passwords, disconnecting controllers from the internet and enforcing multi-factor authentication.
IEC 62443: the reference standard
The IEC 62443 series of international standards covers the security of industrial automation and control systems. Developed from the work of the ISA99 committee of the International Society of Automation, it splits responsibilities between three roles: the asset owner, the integrator and the manufacturer. Two concepts structure it:
- zones and conduits: the system is divided into zones grouping equipment with common security requirements; conduits are the controlled links between two zones;
- security levels, set for each zone by risk analysis, from SL 1 (accidental error or misuse) to SL 4 (intentional attack with extensive resources and in-depth knowledge of industrial systems).
This division provides defence in depth: an intrusion into one zone does not give access to the others. In France, ANSSI also publishes a classification method for industrial systems and a guide of detailed measures, updated in 2025.
Protecting a SCADA: the measures
The measures that directly address the attacks described above:
1. Take an inventory of controllers, supervisory workstations, HMIs, links and remote access: you cannot protect what you do not know.
2. Change all default passwords, on controllers and software alike.
3. Expose nothing directly to the internet; route remote access and remote maintenance through a single, controlled entry point with multi-factor authentication.
4. Separate the shop-floor network from the office network and divide the shop floor into zones, with flows authorised one by one between them.
5. Monitor the industrial network to spot unusual exchanges, and log changes to controllers.
6. Back up controller programs and configurations, and test their restoration.
7. Plan updates with production, and protect by other means what cannot be updated.
8. Protect physical access to cabinets, keys and equipment ports.
9. Train shop-floor and maintenance teams, as many attacks start with an email or a USB stick.
What manufacturers said at Tech for Industry Show
At Tech for Industry Show 2026, at Paris Expo Porte de Versailles:
- Velotic, a publisher of supervisory and MES software, showed an AI analysis layer placed on top of the SCADA, without replacing it: during an incident, a SCADA can generate dozens or even hundreds of alarms per minute, and the tool groups them and finds correlations between them. The speaker also warned about data poisoning: falsified production measurements can steer the decisions of an AI system, which makes data quality a security issue. Read the article
- Exotec detailed the resilience of its robotic warehouses: a backup system that takes over automatically if the main system fails, continuous monitoring from three control centres in France, the United States and Japan, and real-time backup of inventory status to restore the warehouse as it was just before an incident. Read the article
Velotic's talk can be watched again as a replay: Operationalizing AI in the production environment.
SCADA security and regulation
The technical protection of a SCADA also meets legal obligations. The European NIS2 Directive requires manufacturers in scope to take risk management measures across all their systems, shop floors included, and to report significant incidents within 24 hours. Who is covered, which obligations and where the French law stands: see our guide NIS2 and manufacturing.
Frequently asked questions
What does SCADA mean?
Supervisory control and data acquisition: the system that supervises and remotely controls industrial installations.
What is the difference between a SCADA and a PLC?
The PLC directly controls a machine or process in the field. The SCADA supervises a set of PLCs: it collects their data, displays alarms and sends the operator's set points.
What is the difference between SCADA and MES?
SCADA supervises machines and their alarms in real time. MES tracks production orders, quality and traceability.
What is industrial cybersecurity?
The protection of systems that control physical processes (PLCs, SCADA, safety systems), where an attack can affect people, equipment or the environment, not just data.
Which standard is used to secure a SCADA?
The IEC 62443 series, which divides the system into zones and conduits and sets a security level for each zone. In France, ANSSI also publishes a classification method for industrial systems.
What is the first measure to take?
Take an inventory of equipment and access, then change default passwords and remove from the internet anything directly exposed to it: these are the weaknesses exploited in several known attacks.
