Control room cybersecurity in 2026: the blind spots that still put operations at risk

The control room is where information turns into action. That makes its security about more than protecting systems and data: operators also need to be able to trust what they see, access and control. Because October is Cybersecurity Awareness Month, we spoke with Barco Product Security Officer Timo Kosig about the security risks facing today’s control rooms, the vulnerabilities organizations still overlook and what it takes to build a trusted operational environment.

Timo, what has changed most in the cybersecurity threat landscape over the past year?

The biggest change is that attackers are increasingly looking beyond data and focusing on operations.

A year ago, many industrial intrusions were mainly about reconnaissance. Today, we see threat groups mapping how control systems work, identifying where commands originate and understanding how they could influence physical processes.

The number of ransomware groups with the ability to reach operational technology environments has also grown considerably. Research published in 2026 found a 49% year-on-year increase in ransomware groups targeting industrial organizations.

At the same time, the network itself has changed. The idea that an air gap will protect the control room is no longer realistic. Control room environments are connected to enterprise IT, distributed across locations and increasingly dependent on remote services and external suppliers.

Security therefore has to travel with every connection. It can no longer sit only at the perimeter.

How quickly do organizations need to respond when a new vulnerability is discovered?

Exploitation time is now measured in days rather than months. Vulnerabilities in edge devices can be exploited shortly after they become public, sometimes before organizations have had time to deploy the available patch.

If you patch once a year, a known vulnerability may remain open in your environment for most of that year.

I understand why control room operators cannot simply reboot critical systems during peak operations. But “we cannot update” needs to become “we update according to risk.”

That requires a tested update process, sufficient redundancy to update systems one node at a time and the ability to act quickly when a vulnerability is actively being exploited. It is about focusing your limited time and resources where they make the greatest difference.

Is the visualization layer itself becoming a target?

The visualization layer is still underestimated.

Organizations often invest heavily in defending their firewalls but pay less attention to the connections between controllers, image processors and displays. Because those connections do not necessarily face the internet, they may have limited protection.

However, an attacker does not always need to arrive through the internet. Someone with physical access, or access to a poorly protected device connected to the visualization chain, may also create a risk.

In a control room, the video wall is where information becomes visible and decisions are made. If the image is incorrect, manipulated or unavailable, the resulting decision may also be wrong.

I do not need to see widespread attacks against video walls before treating them as a credible target. The potential operational impact is reason enough to protect them.

Which sectors concern you most?

Energy and utilities, transportation, manufacturing and everything that depends on these sectors.

Industrial ransomware activity increased again during the second quarter of 2026. Manufacturing represented 65% of the industrial incidents identified in the analysis. Transportation and logistics ranked third.

What concerns me is how easily an incident can spread.

Ransomware does not necessarily need to manipulate the control system directly to interrupt operations. In the second quarter of 2026, the operational disruption observed in industrial environments largely resulted from the encryption of enterprise and virtualization systems or from precautionary shutdowns, rather than direct manipulation of industrial control systems.

When the systems supporting OT become unavailable, operators may lose their visibility over the process. For a control room, losing that view is already an operational incident.

The number of attacks against system integrators and equipment manufacturers also makes this a supply-chain issue. A vulnerability at one supplier can potentially affect many operators.

How is generative AI changing the way attackers operate?

Generative AI is making many attacks cheaper, faster and more convincing. It does not necessarily create completely new attack techniques, but it allows attackers to execute existing techniques at greater speed and scale.

Phishing messages can now sound natural in almost any language. Voice phishing and deepfakes also make scenarios such as “the CEO called and needs this urgently” much more difficult to identify.

You can no longer rely on bad grammar to expose a phishing attempt.

That means verification needs to become part of the process. Examples include call-back procedures, independent approval for sensitive requests and phishing-resistant multifactor authentication.

AI can also help attackers move from a published vulnerability to a working exploit more quickly. Organizations therefore need both fast technical responses and processes that make social engineering more difficult.

Can AI also help control room defenders?

Absolutely. On the defensive side, AI can be very effective at examining large volumes of log events and alerts, finding patterns and helping security teams focus on the events that matter.

That is one reason why control room logs should be sent to the customer’s Security Operations Center. The control room should be visible within the wider enterprise security environment.

However, I would only give AI autonomy within clearly defined guardrails. Any decision with a potential operational impact should still be made or confirmed by an operator.

AI is also not fully deterministic. The same input does not always lead to exactly the same output. In an environment where results must be predictable and reproducible, that matters.

AI can inform, prioritise and recommend, but the operator remains accountable.

What does it take to protect “the truth on the video wall”?

If you cannot trust the pixel, you cannot trust the decision.

Protecting that pixel requires integrity across the entire visualization chain. Every device needs to be genuine, every connection needs to be protected and each action needs to be traceable.

In Barco CTRL, only authenticated devices with factory-installed certificates can join the system. Components authenticate each other, while connections are encrypted using TLS. Signed firmware and secure boot help prevent software from being replaced without authorization.

Actions are also logged, allowing the organization to investigate what happened afterwards.

The objective is to create one continuous chain of trust, from the information source all the way to the LED pixel.

What security mistake do you encounter most often at customer sites?

Leaving a secure product insecure through the way it is deployed.

That could mean using plain LDAP instead of LDAPS because it was quicker to configure, relying on shared user accounts, failing to send logs to the SOC or leaving available security updates unused.

We deliver Barco CTRL with its security controls enabled. That shifts the challenge away from fixing insecure default settings and towards deploying the system correctly.

However, secure settings can still be switched off. That is where we continue to see gaps. Secure-by-default technology only achieves its purpose when the deployment respects those defaults.

If a CISO (Chief Information Security Officer) could take only one action this year, what should it be?

Treat the control room as a monitored part of the enterprise rather than as a separate silo next to IT.

Connect it to the organization’s identity provider, use multifactor authentication and send its audit logs to the Security Operations Center (SOC).

You cannot defend what you cannot see. Many of the incidents that concern me begin with a valid account being misused. Strong identity controls and continuous visibility are therefore two of the most valuable improvements an organization can make.

The control room may have different operational requirements from the rest of the enterprise, but it should never be invisible to the people responsible for protecting that enterprise.

This is the first of a two-part interview with Timo. Come again next week to read the second installment, in which we focus on what comes next for cybersecurity.