简体中文
Industrial cybersecurity: machine safety also depends on security
An industrial machine is no longer an isolated system. PLCs, HMIs, controllers, industrial networks, software and connected devices communicate with one another and, in many cases, with corporate infrastructure and external services. The connection between Information Technology (IT) and Operational Technology (OT) has made plants more integrated and flexible, but it has also expanded the surface area that needs to be protected.
Unauthorised access, the alteration of a configuration, or the compromise of a device or software can interfere with a machine’s operation, interrupt a production process or alter conditions relevant to safety. Industrial cybersecurity therefore also concerns the protection of machine operation, in addition to that of data and digital infrastructure.
Functional safety and cybersecurity remain distinct disciplines, with specific objectives and methodologies, but in a connected system they can interact directly. A cyber threat can, in fact, compromise elements on which process control and certain safety functions depend. Understanding this relationship is therefore essential for designing adequately protected machines and plants.
Industrial cybersecurity: the boundary between IT and OT
To understand the specific characteristics of cybersecurity in the manufacturing sector, it is necessary to distinguish between IT and OT.
Information Technology (IT) encompasses the systems used to process, transmit and store information: servers, computers, applications, databases and corporate infrastructure. Operational Technology (OT), on the other hand, encompasses the technologies that control or monitor physical processes, such as PLCs, HMIs, supervisory systems, controllers, sensors, actuators and industrial networks.
The difference lies not only in the technologies used, but also in the priorities under which the systems are managed. In the IT sphere, the confidentiality, integrity and availability of information are of particular importance; in the OT sphere, system availability and process continuity may take precedence, as an interruption or an unforeseen change can have direct consequences on the physical environment being controlled.
Even a seemingly routine task such as a software update must therefore be assessed differently. In an IT environment, it can be scheduled as a standard maintenance task, whilst on a production line it must take into account operational continuity, compatibility with other systems and any potential implications for machine safety.
The convergence of IT and OT therefore requires a specific approach, in which cybersecurity, functional safety, reliability and operational continuity are assessed within the same framework.
Threats affecting industrial environments
Attacks targeting industrial organisations can take various forms: ransomware, credential compromise, exploitation of software vulnerabilities, unauthorised access, malware and supply chain attacks are some of the scenarios considered in risk management.
The consequences can affect both information and the production process. A ransomware attack can render the systems necessary for production unavailable; the exploitation of a vulnerability can allow an attacker to gain access to a device or network; and the unauthorised modification of a configuration can alter a system’s behaviour.
The ENISA Threat Landscape 2025 report, based on an analysis of 4,875 incidents observed between July 2024 and June 2025, identifies the manufacturing sector as one of the hardest hit and cites cybercrime as the main category of threat detected in the sector.
Protecting the OT environment therefore requires cyber risk to be considered throughout the entire lifecycle of the machine and its components.
Cyber Resilience Act: cybersecurity becomes part of the product lifecycle
The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, introduces cybersecurity requirements for products containing digital components placed on the European Union market. Its scope therefore covers the product and its lifecycle, from design and development through to marketing, maintenance and vulnerability management.
The Regulation requires manufacturers to design and develop products taking cybersecurity risks into account and to adopt measures appropriate to their nature and the level of risk. The aspects covered include vulnerability management, security updates, documentation and reporting obligations.
The CRA came into force in December 2024, whilst the obligations relating to the reporting of actively exploited vulnerabilities and serious incidents affecting the security of products with digital components have been applicable since 11 September 2026. Most of the Regulation’s requirements will apply from 11 December 2027.
For manufacturers of components intended for industrial automation, this framework provides a clear reference for design, vulnerability management and the maintenance of product security over time.
The manufacturer’s responsibility is, in fact, linked to the entire life cycle of the product: safety must be addressed during development and supported by appropriate processes even after the product has been placed on the market.
NIS2: cybersecurity becomes part of corporate risk management
The scope of the NIS2 Directive (EU) 2022/2555 differs from that of the CRA, as it primarily concerns the resilience of organisations operating in sectors deemed critical or important, rather than setting requirements for individual products.
The Directive covers a number of sectors, including energy, transport, healthcare, digital infrastructure and certain manufacturing activities. The actual scope of application depends on the criteria set out in the Directive and its transposition into national law.
Affected entities must take appropriate and proportionate measures to manage cybersecurity risks, taking into account aspects such as incident management, supply chain security, vulnerability management, security in the development and maintenance of systems, the use of encryption, access control and business continuity.
The Directive also sets out specific obligations regarding the reporting of significant incidents, requiring an initial report within 24 hours of becoming aware of the incident, a notification within 72 hours and a final report within one month.
The CRA and NIS2 therefore operate at different levels: the CRA focuses on the security of products containing digital elements, whilst NIS2 concerns the ability of the organisations concerned to manage and mitigate cyber risk. Within the industrial automation supply chain, these two areas may intersect in the selection of suppliers, supply chain management and the assessment of components used in machinery and plant.
Machinery Regulation (EU) 2023/1230: a new framework for machinery safety
Regulation (EU) 2023/1230 on machinery will replace Directive 2006/42/EC and will apply from 20 January 2027.
The transition from a directive to a regulation updates the European regulatory framework, taking into account technological developments in the machinery sector, including the widespread use of software, connectivity and digital systems.
Among the elements introduced by the Regulation is the protection of machinery against accidental or intentional corruption of software and data relevant to compliance with health and safety requirements. The text requires that hardware components which transmit signals or data and which are relevant to compliance with safety requirements be protected against corruption; software and data critical to the machinery’s compliance must also be identified and adequately protected.
The issue of cybersecurity thus becomes an integral part of the framework for machinery safety, without transforming the Machinery Regulation into a general piece of legislation on cybersecurity: its objective remains the safety of machinery and related products, but the text recognises that software, data and digital systems can affect the machine’s compliance and safety.
A further aspect concerns substantial modifications. The regulation also covers modifications carried out by digital means where a modification not intended by the manufacturer creates a new hazard or increases an existing risk and requires new protective measures.
For manufacturers, this means paying attention not only to the initial design, but also to the way in which software and digital systems are modified throughout the machine’s life cycle.
The ReeR Approach: Security by Design
In this context, ReeR has integrated cybersecurity into its development process using a ‘Security by Design’ approach, taking security aspects into account right from the stages prior to product development.
The Secure Development Lifecycle adopted by ReeR comprises activities dedicated to defining security requirements, threat analysis, design, verification and validation, and post-release vulnerability management.
Cybersecurity is therefore addressed as part of the development process rather than as a feature added to the product at the end of the design phase. This approach follows the principles of IEC 62443, the series of international standards dedicated to the cybersecurity of industrial control and automation systems.
IEC 62443-4-1: ReeR’s process verified by TÜV SÜD
ReeR’s approach has been independently verified through IEC 62443-4-1 certification issued by TÜV SÜD.
IEC 62443-4-1 sets out the requirements for a Secure Product Development Lifecycle and addresses cybersecurity across the various stages of the product development cycle. The certification obtained by ReeR therefore relates specifically to the secure development process, rather than being a generic certification applicable indiscriminately to all the company’s products.
The TÜV SÜD audit assessed the process adopted by ReeR against the standard’s requirements, providing an independent evaluation of the framework through which the company addresses cybersecurity in the development of its products.
For a manufacturer of devices intended for industrial automation and safety, this means having a process in which risk identification, the implementation of security measures, the verification of results and the management of vulnerabilities form an integral part of product development.
Certified ‘Security by Design’ therefore means addressing product security right from the process through which it is designed and developed..
From design to vulnerability management
A product’s security does not end with its release. A vulnerability may also be identified during the device’s operational life and therefore requires procedures to enable the receipt, analysis, assessment and management of reports from external sources.
ReeR has established a dedicated procedure for reporting vulnerabilities in its products, providing a channel through which researchers, customers and other parties can report potential security issues.
The procedure enables the necessary information to be submitted for vulnerability analysis and provides for structured management by the relevant team, from the initial assessment through to any mitigation and communication activities.
Responsible vulnerability management thus completes the process begun during the design phase, enabling security measures to be taken even when new information emerges after the product has been released onto the market..
From process security to product security
The ‘Security by Design’ approach is applied in ReeR’s solutions, which incorporate cybersecurity features and functionalities in line with their architecture and intended use.
The technologies adopted in specific solutions include Secure Boot mechanisms, secure user and credential management, secure communications, update management, event logging and configuration protection. The availability and implementation methods of these features depend on the specific product family.
Secure Boot
The integrity and authenticity of the firmware are verified during boot-up, ensuring that only authenticated and trusted firmware is executed.
Secure user management
Dedicated features allow you to manage users and set up more robust password policies, helping to protect access to the device’s functions.
Secure communications
The use of TLS 1.3 helps to secure communications on supported interfaces.
Update management
The firmware can be updated using specific procedures, with particular attention paid to security updates.
Log management
Event logging helps to improve the traceability of the device’s activities and operating conditions.
Configuration protection
Stored configurations can be protected using dedicated security mechanisms, thereby reducing the risk of unauthorised access or alterations.
In the MOSAIC platform solutions, for example, security features are incorporated into all devices, with different characteristics depending on the product.
Connected solutions such as SafeReady are also developed with due regard to the requirements arising from the digitalisation of industrial applications and the protection of communications and system integrity.
The choice of component must, of course, be made in relation to the machine’s architecture, the risk analysis and the requirements applicable to the specific application. A device with cybersecurity features is, in fact, one element of the overall architecture, not a substitute for the other measures necessary to protect a machine or plant.
Cybersecurity is a shared responsibility
Protecting an OT environment requires a strategy that brings together hardware and software components, network architecture, access control, updates, monitoring, vulnerability management and organisational procedures.
The device manufacturer is responsible for the specifications and management of its product; the machine manufacturer must integrate it into an architecture consistent with the risk analysis; the system integrator must consider the interactions between systems and networks; the end user must manage infrastructure, access, updates and operational procedures correctly.
Industrial cybersecurity therefore arises from the combination of these layers of protection.
For this reason, when assessing a component intended for a connected machine, it is useful to consider not only its functional performance, but also the development process, the security measures in place, vulnerability management and the support provided throughout the product’s lifecycle.
ReeR Academy: training in industrial cybersecurity
Regulatory and technological developments require skills that enable professionals to correctly interpret requirements and translate them into design decisions.
Through ReeR Academy, ReeR provides technical guides, webinars, workshops, in-person events and training content tailored to professionals in the fields of security and industrial automation.
The programmes cover topics related to functional safety, machine design, regulations and cybersecurity, with in-depth sessions also dedicated to NIS2, the Cyber Resilience Act and new requirements for machine manufacturers.
The events are free of charge and aimed at machine manufacturers, designers, system integrators, technicians and end-users.
This training thus complements the work carried out at a technological level: recognising risks, understanding the regulatory framework and knowing how to apply the requirements correctly are essential for designing adequately protected industrial systems.
ReeR solutions for industrial safety
Discover ReeR’s solutions for industrial safety applications, developed through a process that also incorporates the cybersecurity aspects relevant to the characteristics of each individual product.
SAFEREADY Safety Light Curtain
SAFEGATE Safety Light Curtain
MOSAIC Safety Controllers
Do you have a project and want to explore the cybersecurity aspects in more detail?
The ReeR team is on hand to discuss the requirements of your application in detail and assess the solutions best suited to your machine’s design.
