For more than two decades, I have built and analyzed a control system automation incident data repository documenting events across multiple critical infrastructure sectors. The incidents span electric power, water and wastewater, manufacturing, transportation, oil and gas, nuclear power, space, and other industries. Some were malicious. Many were not. What they shared was an impact on the physical process: lost production, damaged equipment, environmental releases, injuries or deaths. Collectively, this cross-sector evidence provides an engineering basis for understanding automation risk that extends beyond the boundaries of conventional network cybersecurity.

The ACS incident data repository was created to answer three fundamental questions:

1. What causes operational disruptions and physical harm in automation environments?
2. How frequently do these incidents occur?
3. Do similar incidents occur across different critical infrastructure sectors?

The answers extend beyond network cybersecurity. Equipment failures, software defects, design and configuration errors, maintenance activities, communication problems, sensor failures, human actions, and malicious attacks can all affect how an industrial process behaves. Understanding automation risk requires examining the entire control system and its interaction with the physical process not just networks.

That distinction matters. Network security technologies are essential, but they cannot address every failure that can produce cyber-physical consequences. The incident evidence repeatedly points to problems originating at Purdue Reference Model Levels 0 and 1, involving sensors, actuators, control logic, calibration, setpoints and the communications on which these functions depend. Such events may be classified as equipment failures or operational errors, even when compromised, corrupted or otherwise untrustworthy electronic information contributed to the outcome. Recognizing these events requires engineering-led investigation of the process, not network data alone.

Get your subscription to Control's tri-weekly newsletter.

Organizations cannot effectively manage these risks if they examine only packets and IP networks while overlooking the physical process. Engineering and cybersecurity personnel must be able to recognize the same event, preserve the appropriate evidence, identify the actual root cause and understand the physical consequences. Bridging this gap between engineering and cybersecurity has been a central theme of my research, presentations, consulting work and the Unfettered Blog for many years.

The repository and its associated body of work now have a dedicated home.

The new Applied Control Solutions website brings together resources on automation incidents, the differences between automation safety and network cybersecurity, sector-specific research, publications, presentations and education. It also provides information about the ACS Incident Identification Workshop and the long-term incident report.

The objective is not to create another cybersecurity website. It is to make the engineering lessons from real-world incidents more accessible and actionable. Engineers, operators, asset owners, reliability and safety professionals, insurers, policymakers, researchers, and cybersecurity practitioners need a common understanding of how electronic communications can affect physical processes—even when there is no cyberattack.

The mission remains unchanged: prevent injuries, deaths and equipment damage caused by automation behaving unsafely, regardless of whether the initiating event is malicious or unintentional.

The Unfettered Blog will continue to challenge assumptions and address overlooked control system issues. The ACS website will provide a permanent home for the incident data resources and practical engineering lessons developed from this work.

I invite you to visit the website, explore the resources and join the discussion.