Industrial IoT 8 min read Published 16 June 2026

Industrial IoT security: connect your plant without exposing your PLCs

By Frank Guo · Technology & Product Leadership, addanode

TL;DR — "If we connect our machines, are we opening a door for hackers?" is the right question to ask — and the answer is no, if it's designed properly. The principles: read data read-only at the edge so the connection can't be used to change the process; never expose PLC ports to the internet — controllers stay on a protected OT network and the edge device only talks outward; segment OT from IT with a firewall (defence in depth); encrypt and authenticate every connection; enforce role-based access with a full audit log; and keep data ownership and a clear patching path. Done this way, connecting your plant improves visibility and security posture rather than weakening it. The danger isn't IoT itself — it's IoT bolted on without these basics.

The fear is legitimate — and addressable

Operational technology was historically "secure" by being isolated — air-gapped, proprietary, disconnected. Connecting it for visibility understandably raises the worry that you're creating a path for an attacker to reach the equipment that runs your plant. That worry is healthy. But the answer isn't to stay blind; it's to connect in a way that exposes data without exposing control. The security risk comes from doing it carelessly — putting a PLC on the public internet, or wiring an IoT box straight into the control network with write access — not from monitoring itself.

The core principle: get the data out, never let control in. A monitoring connection should be read-only and outbound-only — the edge device reads the machine and pushes data to the platform; nothing reaches back to the PLC.

How to connect securely

  1. Read-only at the edge. The edge device reads data from PLCs and sensors without write access, so even if it were compromised it couldn't change a setpoint or stop a pump.
  2. Never expose PLC ports. Controllers stay on a protected OT network. The edge device initiates an outbound connection to the platform; nothing untrusted initiates a connection in to the PLC.
  3. Segment the network. Put IoT/edge devices in their own segment with a firewall between OT and IT — defence in depth, so a problem in one zone doesn't reach the control layer.
  4. Encrypt and authenticate. Encrypted transport and authenticated, outbound-only connections from edge to platform; no plaintext, no anonymous access.
  5. Role-based access & audit log. Named users with least-privilege roles, and a full audit trail of who viewed or changed what.
  6. Own your data and your patch path. Keep data ownership (in-region cloud or on-prem) and a clear process for updating and patching edge devices over their life.

The security protocols that do the work

"Encrypt and authenticate" isn't hand-waving — it rests on specific, well-proven security protocols. The ones that matter on an industrial IoT deployment:

  • TLS (Transport Layer Security) — the standard that encrypts and authenticates data in transit from the edge gateway to the platform, and secures the dashboard in your browser (HTTPS). MQTT and REST both run over TLS.
  • OPC-UA security — the OPC-UA protocol carries its own signing and encryption with certificate-based authentication, so machine-to-machine data is protected end to end.
  • AES-128 on the radioLoRaWAN and similar low-power networks encrypt payloads with AES-128 using separate network and application session keys, so readings can't be intercepted or spoofed over the air.
  • VPN / mutual TLS for remote access — any remote support tunnels over an authenticated VPN or mutual-TLS channel, never an open inbound port.

The point isn't the acronyms; it's that a credible IoT solution uses modern, audited security protocols at every layer — radio, transport and application — rather than shipping data in the clear. Ask a vendor which protocols secure each hop; a vague answer is a red flag.

Why connected can be more secure

Done right, monitoring improves your security posture rather than degrading it. Continuous visibility means you notice anomalies — unexpected access, abnormal device behaviour — that an isolated, unmonitored plant would miss entirely. Centralised, role-based access with an audit log is more controllable than a dozen engineers sharing a SCADA password. And edge buffering means a network problem degrades gracefully (data queues locally) rather than failing open. "Air-gapped" often really means "unmonitored and unpatched" — which isn't as secure as it sounds.

“Air-gapped” often means unmonitored and unpatched Isolation is not the same thing as security. A read-only edge device that initiates its own outbound connection cannot change a setpoint even if it were compromised, and it adds the two things an unmonitored plant lacks: visibility of anomalies while they are happening, and a named, least-privilege access record instead of a shared password. An air-gapped plant A read-only, outbound-only connection Who can change a setpoint Anybody with the SCADA password — and a dozen engineers share it Nobody through this path: the edge device has read access only What initiates the connection Whatever happens to be plugged in that day The edge device, outbound. Nothing untrusted initiates a connection inward What happens to an anomaly Nobody is watching, so it is noticed late or never Unexpected access and abnormal device behaviour surface while they are happening What the access record is Recollection Named users, least privilege, and an audit trail of who viewed or changed what What a network problem does Nothing — there is no network Data queues locally, so it degrades gracefully instead of failing open What it means in practice Frequently: unmonitored, and unpatched A stated patch path for the life of the device
“Air-gapped” often means unmonitored and unpatched Isolation is not security: a read-only outbound link cannot change a setpoint. Who can change a setpoint Air-gapped Anybody with the SCADA password — and a dozen engineers share it Read-only, outbound-only Nobody through this path: the edge device has read access only What initiates the connection Air-gapped Whatever happens to be plugged in that day Read-only, outbound-only The edge device, outbound. Nothing untrusted initiates a connection inward What happens to an anomaly Air-gapped Nobody is watching, so it is noticed late or never Read-only, outbound-only Unexpected access and abnormal device behaviour surface while they are happening What the access record is Air-gapped Recollection Read-only, outbound-only Named users, least privilege, and an audit trail of who viewed or changed what What a network problem does Air-gapped Nothing — there is no network Read-only, outbound-only Data queues locally, so it degrades gracefully instead of failing open What it means in practice Air-gapped Frequently: unmonitored, and unpatched Read-only, outbound-only A stated patch path for the life of the device
The comparison the section above rests on. Isolation is not the same thing as security — a read-only outbound link cannot change a setpoint even if it were compromised, and it supplies the visibility and the access record that an unmonitored plant has neither of.

Questions to put to any vendor

  • Is the connection to our PLCs read-only, and is it outbound-only?
  • Are any PLC or device ports exposed to the internet? (The answer must be no.)
  • How is OT segmented from IT, and where does the firewall sit?
  • Is transport encrypted, and access authenticated and role-based with an audit log?
  • Who owns the data, where is it hosted, and can we run it on-premise?
  • What's the patching and update process for the edge devices?

These principles are built into the in-house addaNet platform: read-only edge access, no exposed PLC ports, network segmentation, encrypted transport, role-based access with audit logging, and your choice of in-region cloud or fully on-premise hosting with full data ownership and export. Connecting your plant should make it more visible and more controllable — not more exposed. For the wider picture, see our guide to Industrial IoT in South Africa and the protocol-level view in OPC-UA vs Modbus vs MQTT.

Frequently asked questions

Does connecting our PLCs to IoT create a security risk?

Only if it's done carelessly. The safe pattern is read-only, outbound-only access at the edge with no PLC ports exposed to the internet, OT segmented from IT by a firewall, and encrypted, authenticated connections. Done this way, you expose data without exposing control — and gain visibility you didn't have before.

Can the platform change settings on our equipment?

For monitoring it shouldn't, and by default it doesn't. The edge device reads data without write access, so the connection can't be used to alter setpoints or stop equipment. Any control function is a separate, deliberate design decision kept in the proper control system — not a side effect of monitoring.

Isn't an air-gapped plant more secure?

Often less than it appears. "Air-gapped" frequently means unmonitored and unpatched, with shared passwords and no audit trail. A properly connected system gives continuous visibility of anomalies, role-based access with logging, and a managed patch path — which can be a stronger security posture than isolation.

Where is our data, and do we own it?

You should own it outright. A good platform offers in-region cloud or fully on-premise hosting, encrypted transport, and export to CSV, SQL or your data lake at any time — with no lock-in or data-release fees. Data ownership and hosting location should be your decision, not the vendor's.

What should we ask a vendor about security?

Whether the PLC connection is read-only and outbound-only, whether any device ports are exposed to the internet (must be no), how OT is segmented from IT, whether transport is encrypted and access is role-based with an audit log, who owns and hosts the data, and what the edge-device patching process is.

Worried about the security of connecting up?

Tell us your concern and your environment. We'll walk you through exactly how we read your equipment read-only, keep your PLCs off the internet, and give you visibility without exposure.