Automation incidents
Automation incidents rarely look like incidents.
Process, not packets.
Automation incidents are control system failures where the electronic communication from a computer or digital device is involved. ACS data shows that across all critical infrastructure sectors, these incidents account for far more deaths, damage, and financial loss than cyberattacks, yet they are rarely identified or addressed systematically.
IT and OT networks are about the data. Control systems are about the process, where safety, reliability, and availability must be considered. Cyber security alone is not enough.
The word itself adds to the confusion: “cyber” originally meant “under the control of and communication with computers.” More recently it implies cyberattacks, and that shift is why so many control system incidents are mislabeled.
Where they start.
These issues include out-of-calibration, inoperable sensors, misconfigured valves, and operator-interface blind spots.
- 01Sensors
- 02Actuators
- 03Calibration
- 04Control logic
- 05Communications
- 06Process behavior
The difference
Not every control system event involving computers is a cyber incident.
Cyberattacks are real. They are not the whole control‑system risk picture.
Telling the difference decides who investigates, and what evidence is kept.
Automation incident
- What it is
- Sensors, actuators, control logic, calibration and setpoints: engineering causes that change how the physical process behaves.
- Usually seen as
- Equipment failures, unexplained downtime, recurring process problems.
- Needs
- Engineering-led investigation.
Network cybersecurity incident
- What it is
- Malware, ransomware, credentials and remote access: unauthorized or malicious activity through networks.
- Usually seen as
- Alerts from network monitoring and security tools.
- Needs
- Cyber incident response.
Two decades of incident tracking.
ACS research highlights the scale of the problem, much of it originating at Level 0 and Level 1, below the IP network layer.
- 17M+
- control system incidents to date
- 30,000+
- deaths linked to control system incidents worldwide
- $100B+
- in direct impacts, with multiple bankruptcies
- 2M+
- control system devices connected directly to the internet
In a 2022 survey of 200 executives, respondents reported that control system incidents had caused:
- 14%
- damage to equipment
- 10%
- environmental damage
- 7%
- injury or death of employees
- 6%
- injury or death of the general public
What automation incidents looked like at real facilities.
Urban Utility and the Hidden Risk of Non-IP ICS Failures
How a utility's plant shutdown exposed the engineering-based, non-IP control-system failures that conventional cybersecurity programs overlook.
Identifying Automation Incidents Behind a 3% Productivity Opportunity at a Major Industrial Facility
How inoperable and uncalibrated sensors, improperly ranged instruments and controller tuning errors added up to a 3% production opportunity at a $1B industrial facility.
When Digital Communications Became Safety-Critical: How a Network Switch Failure Affected Control System Logic and Operator Situational Awareness
A replacement network switch installed with Rapid Spanning Tree Protocol disabled created a network loop and data storm that closed the turbine control valves at 100% power, scramming Hatch Unit 1 with no cyberattack involved.
Put this to work with the ACS Annual Service.
Incidents like these are rarely one-offs, and they are rarely recognized for what they are. The ACS Annual Service helps your organization identify the automation incidents it may have missed, compare its experience with sector patterns, and stay current on significant events, drawing on more than 20 years of incident tracking and direct access to Joe Weiss.
