Glossary
The language of
cyber-physical security.
Clear definitions for the terms security and operations teams use to discuss exposure, consequence, and continuity across critical infrastructure.
Cyber-Physical Security
The foundation: protecting systems where computation meets physical process, and why OT risk is measured in operations, not data.
Cyber-Physical Security (CPS)
The discipline of protecting systems where computation controls physical processes. It unifies IT cybersecurity with the safety and reliability concerns of operational technology.
Cyber-Physical Risk
The probability and consequence of a cyber event affecting a physical process, measured in operational terms such as downtime, safety, and service disruption rather than data loss alone.
Operational Impact
The real-world effect a security event has on production or service delivery, e.g. a halted line, a tripped breaker, or a delayed train, expressed in terms the business and operators care about.
Operational Resilience
The ability of an organization to withstand, absorb, and recover from cyber-physical incidents while continuing to deliver its critical functions at an acceptable level.
Critical Infrastructure
Assets and systems so vital that their incapacitation would compromise security, the economy, public health, or safety, e.g. power grids, water, rail, and heavy industry.
OT & Industrial Security
The building blocks of industrial control, from the field device up to the supervisory system, and the protocols that connect them.
Operational Technology (OT)
Hardware and software that monitors and controls physical equipment, from sensors and controllers to entire production lines, distinct from enterprise IT in that availability and safety dominate.
Industrial Control System (ICS)
The umbrella term for control systems used in industrial production, encompassing SCADA, DCS, and smaller control loops that run physical processes.
SCADA
Supervisory Control and Data Acquisition, systems that gather data from geographically distributed field sites and issue supervisory commands, common in utilities and pipelines.
Programmable Logic Controller (PLC)
A ruggedized computer that executes deterministic control logic directly on machines and processes in real time.
Remote Terminal Unit (RTU)
A field device that interfaces with sensors and actuators and reports telemetry back to a SCADA master, often over long-distance links.
Human-Machine Interface (HMI)
The operator's screen for monitoring process state and issuing commands, the human-facing edge of the control system.
Industrial Networks
The communication fabrics connecting controllers, field devices, and supervisory systems, typically built on deterministic protocols (Modbus, DNP3, OPC UA) and isolated from office IT.
Cyber-Physical Exposure Management
Finding and contextualizing everything an adversary could use, then ranking it by what actually threatens operations.
Exposure Management
The continuous practice of identifying, contextualizing, and reducing everything in an environment that an adversary could use, across assets, vulnerabilities, configurations, and identities.
Vulnerability
A weakness in a system or process that could be exploited to compromise the confidentiality, integrity, or availability of an operational asset.
CVE
Common Vulnerabilities and Exposures, the standardized catalog of publicly disclosed software flaws, each assigned a unique identifier.
Misconfiguration
An insecure setting or deployment choice (open ports, default credentials, overly permissive rules) that creates risk even without a software flaw.
Attack Path
A chained sequence of exposures and moves an adversary could take to reach and affect a critical asset, the connective tissue between a single flaw and real-world consequence.
Risk Prioritization
Ranking exposures by their actual operational consequence and exploitability, not just CVSS, so teams fix what matters first.
Operational Risk & Resilience
How cyber events translate into stopped processes and harm, and what it takes to keep the critical function running.
Downtime
Unplanned production or service interruption, the primary cost metric in OT and the yardstick by which cyber risk is felt.
Safety Impact
The potential for a cyber event to cause physical harm to people or the environment, the category that separates OT risk from IT risk.
Service Continuity
The ability to keep delivering the essential service through and after a disruption, the operational analogue of resilience.
Asset Criticality
A ranking of how much an asset's failure would matter to operations, used to weight security effort toward what the business cannot lose.
Blast Radius
The scope of impact a compromise would have if it propagated, how far damage spreads from a single exposed asset through connected systems.
Single Point of Failure
A single component or path whose failure brings down a process, a prime target for both reliability and security improvement.
OT Network Visibility & Segmentation
Seeing what's on the network without breaking it, then drawing the boundaries that contain an incident.
Asset Discovery
The process of identifying every device on an OT network, its type, vendor, firmware, and connections, the prerequisite for any exposure program.
Passive Monitoring
Observing network traffic without injecting probes or packets, essential in OT where active scanning can crash fragile controllers.
Network Mapping
Building a living picture of which assets talk to which, the topology that lets you reason about containment and blast radius.
Zones and Conduits
The IEC 62443 model of grouping assets by trust and risk (zones) and strictly controlling the paths between them (conduits).
Virtual Segmentation
Enforcing logical boundaries between groups of assets using switches, firewalls, or software-defined controls without rewiring.
Air Gapping
Physical isolation of a network from all external connectivity, a traditional but increasingly incomplete assumption in modern connected OT.
AI-Powered Security Operations
Where agentic AI turns raw exposure into explained, prioritized, and actionable defense before an incident happens.
Agentic AI
AI systems that can take autonomous, goal-directed actions, plan, and use tools to achieve security outcomes rather than only answering queries.
Automated Triage
Sorting and prioritizing incoming findings and alerts by consequence and context so analysts focus on what matters without manual review.
Investigation
The structured pursuit of what happened, how, and what it means for operations, reconstructing an exposure or incident end to end.
Risk Explanation
Translating technical exposure into the operational and business language leaders need to decide and act.
Remediation Guidance
Specific, safe-for-OT steps to close an exposure, including the order of operations and what to avoid in a live process environment.
Preemptive Security
Acting on risk before it is exploited, closing exposures and hardening assets based on predicted paths rather than after an incident.
OT Security Standards & Compliance
The frameworks and mandates that define expected cyber posture for critical infrastructure and industrial operators.
IEC 62443
The leading international series of standards for industrial automation and control systems security, covering zones/conduits, security levels, and supplier requirements.
CLC/TS 50701
The CENELEC technical specification for cybersecurity in railway systems, harmonizing IT/OT security practice with rail RAMS and safety lifecycles.
NIST CSF
The NIST Cybersecurity Framework, a risk-based structure of functions (Identify, Protect, Detect, Respond, Recover) adopted widely across critical infrastructure.
NIS2 Directive
The EU's strengthened network and information security directive, extending cyber risk obligations to essential and important entities including energy, transport, and manufacturing.
TSA Security Directives
U.S. Transportation Security Administration mandates imposing specific cyber requirements on pipeline, rail, and surface transport operators.
Defense in Depth
Layering multiple, independent security controls so that the failure of any one does not expose the critical asset, the foundational posture of OT security.