Cyberattacks against control systems/OT and unintentional control system automation incidents continue to occur across multiple sectors worldwide. The fundamental issue is simple: If you cannot trust what you measure, then you cannot trust your situational awareness. Without trustworthy situational awareness, there can be no assurance of safety, reliability, resilience or cybersecurity.

Recent Iranian-linked cyberattacks against U.S. water utilities and other cyberattacks targeting commercial refrigeration systems demonstrate how manipulating control system settings, displays and alarms can create a dangerous gap between actual physical conditions and what operators believe is happening. These incidents reinforce a fundamental requirement: Independent verification of physical process conditions must be part of control system cybersecurity.

Operator displays are not always trustworthy

Misleading operator displays, whether caused by unintentional failures or malicious activity, are neither new nor confined to any single industry. The 2003 Northeast blackout was exacerbated by misleading operator displays at FirstEnergy's control center. Misleading operators about actual process conditions was an integral part of Stuxnet.

In November 2022, we published an article in IEEE Computer, “Using Machine Learning to Work Around the Operational and Cybersecurity Limitations of Legacy Process Sensors.” This article addressed the limitations of legacy instrumentation and the inability of SCADA system’s HMI displays to reliably identify certain sensor and equipment failures. The 2023–2024 Iran-linked attacks targeting Unitronics controllers should have raised similar concerns. Although the Unitronics incidents were widely discussed as cybersecurity compromises involving controller access and display defacement, the implications for control logic, alarm integrity and operator decision-making deserved greater attention than they received.

Nor have I seen any comparable emphasis in CISA or EPA warnings on the broader problem of operators making decisions based on potentially compromised displays. In April, a nuclear plant lost view of the process (displays froze and alarms were suppressed) so that the plant operators could not prevent a scram (forced outage). Recently a water utility experienced an incident in which SCADA displays froze while continuing to indicate normal conditions as a storage tank emptied. The incident ultimately resulted in a boil-water order. Such an event illustrates why an apparently normal display cannot, by itself, establish that a physical process is operating normally.

In July 2026, federal agencies updated their warnings about Iranian-affiliated actors targeting PLCs at U.S. critical infrastructure facilities. The July 22 advisory described attempts to download malicious PLC project files and manipulate data displayed through SCADA system HMIs. The reported activity caused operational disruption and financial losses, with some activity capable of allowing systems to enter unsafe conditions without notifying operators. Subsequent incidents in late July and early August brought renewed attention to attacks affecting U.S. water and wastewater utilities.

The same fundamental vulnerabilities were exploited in different sectors. Attacks against commercial refrigeration units started in September 2026 installed in various U.S. military commissaries, but there was no mention of displays being compromised. On October 12, cyberattacks disrupted refrigeration systems at hundreds of French supermarkets. According to Le Monde, attackers raised defrost-system temperatures and extended defrost cycles delaying alarm activation and intervention. The resulting overheating caused extensive product losses and equipment damage. Additional attacks targeting commercial refrigeration systems were reported throughout Europe.

These incidents illustrate a fundamental vulnerability: Attackers can manipulate control system settings and alarms to create a dangerous discrepancy between actual physical conditions and what operators believe is happening. The problem is not simply that a controller can be compromised. It is, rather, that the controller, its displays and its alarms may no longer provide a trustworthy representation of the physical process. Operators may fail to recognize abnormal conditions, respond too late or take inappropriate actions because the information guiding their decisions is misleading.

Manual operation is not enough without independent measurements

On October 18, Sinclair Koelemij published a blog entitled “Manual; Control,” inspired by a cyberattack on a Dutch supermarket chain. Koelemij questioned whether a modern process plant can fall back on manual operation following a cyberattack. This question applies to any facility that depends on control systems, not just modern process plants. Koelemij emphasized that operators responding to process disturbances must determine which measurements remain trustworthy and whether their commands are being executed correctly. This raises a critical question: How can operators safely control a process manually if they cannot independently establish what the process is actually doing? Simply selecting “manual” on an operator display does not provide independence if the same potentially compromised infrastructure carries both the process information and the control commands.

A credible manual fallback requires three essential capabilities:

• Trustworthy measurements: Operators must have an independent means of determining actual process conditions.
• Effective control authority: Operators must be able to issue commands and verify that the intended physical actions occur.
• Time and operational capability: The process must remain manageable long enough for the available operating team to intervene safely.

Where these conditions are absent, establishing a viable manual fallback requires coordinated changes to the installation, its operating envelope and its operating organization.

Get your subscription to Control's tri-weekly newsletter.

Because of the Iranian water industry cyberattacks, CISA has recommended manual controls as a cybersecurity measure for critical infrastructure, particularly in the water sector. Maintaining the ability to operate equipment manually can be important for sustaining or restoring operations during a cyber incident. However, manual operation alone does not resolve the underlying trust problem if operators continue to rely on potentially compromised process measurements, displays and alarms.

The missing element is independence between the information used to assess actual process conditions and the control-system infrastructure that presents that information to operators. Manual operation is a meaningful resilience measure only when operators can establish what is happening physically and determine whether their actions are producing the intended results.

The problem extends beyond malicious cyberattacks

Independent verification is necessary not only to address malicious cyberattacks but also to detect unintentional failures. A failed sensor, malfunctioning automation, frozen operator display or compromised controller can produce the same operational problem: operators lose the ability to distinguish actual process conditions from misleading information. Control systems may continue executing their programmed logic even when the measurements driving that logic are wrong. A PLC can operate exactly as designed while producing an unsafe result because it is acting on erroneous sensor data.

Similarly, a display can continue presenting apparently normal values even when the underlying measurements are stale, corrupted or no longer representative of physical reality. Consequently, neither the apparent normality of an operator display nor the correct execution of programmed control logic guarantees that a physical process is operating safely.

This is an important distinction between IT and OT network security and control system cybersecurity. Network monitoring can identify suspicious connections, unauthorized access, and other indicators of compromise. Those capabilities are necessary, but they do not independently establish whether a pump is delivering the expected flow, whether a tank contains the indicated volume, whether a freezer is maintaining the required temperature or whether a protective function will respond appropriately to actual process conditions. Cybersecurity must address not only whether communications and controllers can be trusted, but also whether the physical information on which control decisions depend is trustworthy.

Independent process monitoring can close the trust gap

The technology developed by Immutable Situational Awareness LLC addresses this independence problem by independently monitoring the “physics” of the process sensors rather than relying exclusively on the control system's own measurements, communications and operator displays. By comparing independently derived “ground truth” information about physical conditions with the information presented by SCADA displays, it can identify discrepancies that could otherwise remain undetected. This independent perspective is intended to help identify malicious or unintentional process abnormalities, including conditions that conventional monitoring may miss or compromised displays may conceal. The technology has been demonstrated for more than eight years at a highly critical U.S. government industrial facility.

Independent process monitoring is not a substitute for secure controllers, protected communications, properly configured alarms or sound engineering practices. Rather, it provides a complementary layer of assurance: an independent means of evaluating whether the physical process agrees with the information operators are being given. That distinction is especially important during a cyber incident. If conventional displays indicate normal conditions while independent monitoring indicates otherwise, operators have a reason to investigate before trusting the control system's representation of the process.

In response to the troubling incidents occurring across multiple sectors worldwide, Immutable Situational Awareness LLC is seeking critical-infrastructure end users interested in evaluating the technology under normal operating conditions and through controlled scenarios involving compromised or malfunctioning control systems, process measurements and operator displays. The objective is to demonstrate how independent process monitoring can strengthen situational awareness, support manual fallback strategies, and improve the safety, reliability, resilience and cybersecurity of critical infrastructure.

Closing the gap

Russia, China and Iran understand the operational advantages of exploiting the gap between actual physical conditions and what operators believe is happening. Cyber defenders, control system engineers, and reliability and safety professionals must understand and address this vulnerability as well.

The Iranian-linked attacks against U.S. water utilities demonstrate the risks of manipulating PLCs and operator displays. The supermarket refrigeration attacks demonstrate how changing control settings and delaying alarms can allow abnormal physical conditions to persist while intervention is delayed. Different industries, different equipment and different consequences, but the same underlying problem: The information available to operators can diverge from physical reality.

Securing networks and controllers is essential, but it is not enough if no independent means exists to establish whether the process itself is behaving as expected. Manual fallback strategies are similarly incomplete when operators cannot trust their measurements or verify the physical effects of their commands. You cannot trust a control system simply because its displays indicate normal conditions. You must independently establish whether those conditions are real.