News

When Rockwell automation released its latest global study on operational resilience in September 2026, the headline finding was stark: more than one-third of industrial organizations now view cybersecurity risk as a top obstacle to growth. The study, titled "Operational Resilience in the Age of Connectivity," surveyed over 400 industrial companies across manufacturing, oil and gas, mining, and process industries, revealing a fundamental tension between the push toward connected operations and the reality of expanding attack surfaces.

The timing of the study matters. Industrial automation has spent the past decade migrating from isolated control systems to interconnected architectures. Programmable logic controllers that once operated on proprietary networks now connect to enterprise systems, cloud platforms, and mobile applications. Distributed control systems that managed refineries and chemical plants from air-gapped workstations now integrate with business intelligence tools and remote monitoring services. This connectivity delivers operational benefits—real-time visibility, predictive maintenance, optimized production—but it also creates pathways for cyber threats to reach critical infrastructure.

The study found that 37 percent of respondents ranked cybersecurity among their top three growth obstacles, up from 24 percent in a similar survey conducted two years earlier. The increase was most pronounced in process industries where safety incidents can have catastrophic consequences. Oil and gas operators, chemical manufacturers, and power generation companies expressed particular concern about the convergence of information technology and operational technology, noting that traditional OT security practices—physical isolation, proprietary protocols, limited connectivity—no longer provide adequate protection in modern architectures.

What makes the finding significant is not just the percentage but the correlation with investment decisions. Companies that identified cybersecurity as a top obstacle reported delaying or scaling back digital transformation initiatives. They described hesitation in deploying edge computing, connecting legacy equipment to IIoT platforms, or implementing remote access solutions for mAIntenance and support. The concern was not about technology capability but about risk management: how to modernize operations without exposing critical processes to threats that could cause safety incidents, environmental releases, or production shutdowns.

The study identified several specific challenges. First, the skills gap in OT cybersecurity remains acute. Many industrial companies lack personnel who understand both control system operations and modern cybersecurity practices. IT security teams often lack familiarity with industrial protocols, safety instrumented systems, and the real-time requirements of process control. OT engineers, meanwhile, may not be comfortable with network segmentation, intrusion detection, or vulnerability management practices standard in IT environments.

Second, legacy equipment presents persistent vulnerabilities. Many industrial facilities operate control systems that are 15, 20, or even 30 years old. These systems were designed for reliability and safety, not cybersecurity. They run on operating systems that no longer receive security patches, use default passwords, and lack basic security features like encryption or authentication. Replacing legacy systems is expensive and operationally disruptive, but leaving them connected to modern networks creates unacceptable risk.

Third, supply chain security has emerged as a critical concern. Industrial control systems depend on components from dozens of vendors—PLCs from one supplier, HMIs from another, safety systems from a third, networking equipment from yet another. Each component represents a potential vulnerability. The study found that only 41 percent of respondents had formal processes for evaluating the cybersecurity posture of their automation suppliers, despite growing recognition that supply chain compromises can affect operational technology just as severely as information technology.

The study also highlighted the evolving nature of threats. Ransomware attacks targeting industrial operations have increased in frequency and sophistication. Threat actors have demonstrated the ability to move from IT networks to OT environments, potentially affecting safety systems and production processes. State-sponsored actors continue to target critical infrastructure, motivated by geopolitical objectives rather than financial gain. The consequences of successful attacks extend beyond data theft or financial loss to include safety incidents, environmental damage, and disruption of essential services.

Rockwell's response to these findings reflects broader industry trends. The company has invested heavily in cybersecurity capabilities, acquiring companies specializing in OT security and integrating security features into its automation platforms. Modern Allen-Bradley controllers include built-in security functions—user authentication, access control, audit logging, and encrypted communications. The company's FactoryTalk innovation platform incorporates security by design, with network segmentation, threat detection, and incident response capabilities.

However, technology alone cannot solve the problem. The study emphasized that organizational factors—culture, governance, trAIning—are equally important. Companies with mature cybersecurity programs reported better outcomes not because they had superior technology but because they had established clear accountability, regular training, incident response plans, and continuous improvement processes. Security was treated as an operational discipline, not an IT afterthought.

The study's findings have immediate implications for automation system design. Engineers specifying new control systems must consider cybersecurity requirements from the outset. Network architectures must incorporate segmentation between safety systems, basic process control, and enterprise connectivity. Access controls must be granular, with different permission levels for operators, maintenance personnel, and external support. Monitoring capabilities must provide visibility into network traffic, identifying anomalous behavior that might indicate compromise.

For Maxwell, who has spent over a decade designing control architectures for process industries, the study confirms what he observes in the field. "The question is no longer whether to connect control systems to broader networks," he notes. "The question is how to do it securely. That requires thinking about security at every layer—from the field devices and controllers to the network infrastructure and enterprise integration. It requires defense in depth, not perimeter security."

The study also addressed the regulatory landscape. Governments worldwide are increasing requirements for critical infrastructure cybersecurity. The European Union's NIS2 Directive imposes security obligations on essential service providers, including energy, water, and manufacturing. The United States has issued cybersecurity directives for pipeline operators and chemical facilities following high-profile incidents. Compliance with these requirements adds complexity and cost but also provides frameworks for systematic risk management.

Looking ahead, the study suggests that cybersecurity will remain a defining challenge for industrial automation. As operations become more connected, more automated, and more dependent on data, the attack surface will continue to expand. The companies that succeed will be those that treat cybersecurity as a core competency, integrating security considerations into every aspect of their operations—from system design and procurement to operations and maintenance.

The path forward requires collaboration across the industry. Automation suppliers must continue to build security into their products. System integrators must design architectures that balance connectivity and security. End users must invest in people, processes, and technology. And the industry as a whole must share threat intelligence, best practices, and lessons learned to raise the collective security posture.

The Rockwell study does not offer easy answers, but it provides a clear message: in an age of connectivity, cybersecurity is not optional. It is fundamental to operational resilience, business continuity, and the ability to realize the benefits of digital transformation. Companies that recognize this reality and act accordingly will be better positioned to navigate the challenges ahead.

Written by: Maxwell, an industrial automation specialist with over 15 years of experience in control system security and operational technology.