From Signals to Shutdowns: Tags, Transmitters, and Trips in Cyber-Physical Systems

Cyber-Physical Systems (CPS) rely on the interaction between industrial control systems, field instrumentation, protection functions, and physical processes to operate critical infrastructure safely and reliably. While most OT security programs focus on network visibility and protocol analysis, they often provide limited insight into the engineering and process context that determines whether a cyber event can lead to operational or safety consequences. This session examines how industrial telemetry—including instrumentation tags, process variables, transmitter data, control logic, alarms, and protection trips—can be leveraged to improve the detection and investigation of cyber-physical threats. Through practical examples, we will explore how correlating engineering and process signals with cybersecurity events helps identify configuration drift, process anomalies, unauthorized engineering changes, and conditions that may impact operational integrity. Attendees will gain a deeper understanding of why network monitoring alone is insufficient for defending modern Cyber-Physical Systems, and how integrating engineering context into security operations enables more accurate risk assessment, faster investigations, and stronger operational resilience across power, manufacturing, and other critical infrastructure sectors.