Control Room Cybersecurity in 2026: Addressing the Hidden Risks to Critical Operations
Control rooms play a vital role in industries where real-time information drives critical decisions. From energy and utilities to transportation and manufacturing, operators depend on accurate visual information, secure systems, and reliable communication to maintain safe and efficient operations. As these environments become increasingly connected, cybersecurity is no longer limited to protecting data and networks. It is also about ensuring that operators can trust the information they see and the systems they use to control essential processes.
In recognition of Cybersecurity Awareness Month, Barco spoke with Timo Kosig, Product Security Officer for Control Rooms, about the changing cybersecurity landscape, overlooked vulnerabilities, and the measures organizations can take to establish a secure and trusted operational environment.
Cybersecurity Threats Are Increasingly Focused on Operations
According to Kosig, one of the most significant changes in the cybersecurity landscape is the growing focus on operational disruption rather than data theft alone. Attackers are increasingly examining how industrial systems function, identifying the sources of commands, and exploring opportunities to influence physical processes.
Industrial environments have traditionally relied on network separation and restricted access to protect operational technology (OT). However, this approach is becoming less effective as control rooms connect with enterprise IT networks, remote services, cloud-based platforms, and third-party suppliers.
The assumption that an isolated network or air gap can provide complete protection is no longer realistic for many modern facilities. Each new connection introduces potential vulnerabilities that attackers could exploit.
Kosig emphasizes that cybersecurity must extend across the entire environment rather than remain concentrated at the network perimeter. Organizations need to secure devices, communications, identities, and software throughout their operational infrastructure.
Research cited in the interview also points to increasing ransomware activity targeting industrial organizations. As attackers become more capable of reaching OT environments, organizations must prepare for incidents that could affect not only information systems but also operational continuity.
Faster Vulnerability Exploitation Requires a Risk-Based Approach
Another major concern is the shrinking window between the public disclosure of a vulnerability and its exploitation. According to Kosig, attackers can begin targeting vulnerable devices within days of a security issue becoming public, sometimes before organizations have completed their patching processes.
This creates significant challenges for control room operators, who cannot always restart or update critical systems during active operations. Maintaining availability is essential, but postponing security updates indefinitely can leave systems exposed to known threats.
Kosig recommends replacing the assumption that systems cannot be updated with a structured, risk-based approach to maintenance. This includes establishing tested update procedures, maintaining sufficient redundancy to update systems one component at a time, and prioritizing vulnerabilities that are actively being exploited.
A carefully planned patching strategy enables organizations to balance operational availability with security requirements. Rather than relying on infrequent maintenance cycles, operators should establish processes that allow critical updates to be deployed promptly and safely.
The Visualization Layer Remains an Overlooked Vulnerability
While organizations frequently invest in firewalls and network protection, the visualization layer of a control room can receive less attention. Connections between controllers, image processors, and displays may be overlooked because they do not directly face the internet.
However, an attacker does not necessarily need direct internet access to compromise these components. Physical access, compromised devices, or inadequately protected connections can also introduce risks.
The visualization layer is particularly important because it presents information that operators use to make decisions. If a video wall displays inaccurate information, becomes unavailable, or is manipulated, operators may respond to an incorrect understanding of the situation.
For example, a disruption affecting the visualization system could prevent operators from seeing critical process information even when the underlying industrial equipment continues to function.
Kosig argues that organizations should protect the complete visualization chain rather than focus exclusively on traditional IT infrastructure. Ensuring the integrity and availability of the information displayed is an essential part of operational security.
Critical Industries Face Growing Supply-Chain Risks
Energy and utilities, transportation, manufacturing, and other interconnected industries face particular cybersecurity challenges because disruptions can have consequences beyond individual organizations.
Manufacturing operations depend on interconnected systems, while transportation and energy infrastructure require continuous visibility and reliable coordination. An incident affecting one supporting system can potentially disrupt several operational functions.
Kosig notes that ransomware-related disruptions do not always result from attackers directly manipulating industrial control systems. In some cases, incidents affecting enterprise infrastructure, virtualization platforms, or supporting services can force organizations to suspend operations as a precaution.
For control rooms, losing access to reliable operational information can itself become a serious incident.
Supply-chain security is another growing concern. System integrators, equipment manufacturers, and external service providers can introduce vulnerabilities that affect multiple customers. Organizations must therefore consider the security of third-party components and connections when assessing their overall risk.
Generative AI Is Making Cyberattacks More Convincing
Generative artificial intelligence is changing how attackers conduct familiar techniques, including phishing, impersonation, and social engineering. Rather than introducing entirely new methods, AI can make existing attacks faster, cheaper, and more convincing.
Phishing messages can now be written in natural language across multiple languages, making grammatical errors less useful as warning signs. Voice cloning and deepfake technology can also make fraudulent requests appear to come from executives or trusted colleagues.
These developments increase the importance of independent verification. Organizations should establish call-back procedures for sensitive requests, require separate approvals for high-risk actions, and adopt phishing-resistant multifactor authentication wherever practical.
AI can also assist attackers in identifying vulnerabilities and developing exploits more quickly. Security teams must therefore combine effective technical defenses with procedures that make manipulation and unauthorized access more difficult.
Using AI to Strengthen Cybersecurity Defenses
Although AI introduces new risks, it can also help defenders manage increasingly complex security environments. AI-assisted tools can analyze large volumes of logs and alerts, identify suspicious patterns, and help security teams prioritize potential incidents.
Kosig recommends integrating control room logs into the organization’s broader Security Operations Center (SOC). This allows security professionals to monitor control room activity alongside other enterprise systems and investigate unusual events more effectively.
However, AI should operate within clearly defined limits, especially in environments where automated decisions could affect physical operations. AI systems can produce inconsistent or unpredictable results, making unrestricted autonomy inappropriate for certain critical tasks.
AI can support threat detection, provide recommendations, and help prioritize responses, but decisions with potential operational consequences should remain under appropriate human oversight.
Establishing Trust Across the Visualization Chain
Protecting the accuracy of information displayed in a control room requires security throughout the visualization chain, from the original information source to the final display.
Kosig explains that Barco CTRL incorporates several security measures designed to establish this trust. These include device authentication using factory-installed certificates, encrypted communications using Transport Layer Security (TLS), signed firmware, and secure boot mechanisms intended to help prevent unauthorized software modifications.
The platform also records system activities, enabling organizations to review events and investigate potential security incidents.
Together, these controls help establish a chain of trust in which devices can be authenticated, communications protected, software integrity supported, and actions traced.
The objective is straightforward: operators must be able to rely on the information presented to them when making important decisions.
Secure Deployment Is Just as Important as Secure Technology
Even products designed with strong security features can become vulnerable when deployed incorrectly. Kosig identifies insecure configurations as one of the recurring problems observed in customer environments.
Examples include using unencrypted LDAP connections instead of LDAPS, sharing user accounts, failing to forward audit logs to the SOC, and leaving available security updates uninstalled.
Barco CTRL is designed with security controls enabled by default, but those protections can still be weakened through deployment choices or configuration changes.
Organizations should therefore establish clear implementation standards, use individual accounts, enforce secure authentication, maintain audit logging, and regularly review system configurations.
Secure-by-default technology delivers its full value only when organizations preserve those protections throughout deployment and ongoing maintenance.
The Priority for CISOs in 2026
Kosig recommends that chief information security officers treat control rooms as monitored components of the wider enterprise rather than isolated operational environments.
Three measures are particularly important: integrating control rooms with the organization’s identity provider, implementing multifactor authentication, and forwarding audit logs to the SOC.
These steps improve visibility, strengthen access controls, and help security teams identify suspicious activity involving legitimate accounts.
As control rooms become more connected, organizations must ensure that operational requirements do not result in cybersecurity blind spots. Protecting critical infrastructure requires a coordinated approach that combines secure technology, responsible deployment, continuous monitoring, and human oversight.
This interview is the first part of a two-part series with Timo Kosig. The second installment will explore emerging cybersecurity developments and the technologies and practices expected to shape the future of control room security.
Source Link: https://www.barco.com/