--- title: "HMI security: protecting human-machine interfaces from cyber threats" description: Learn how to protect HMI workstations from ransomware, unauthorized access and lateral movement with practical hardening, backup and recovery guidance. canonical_url: https://www.acronis.com/en/blog/posts/hmi-security-protecting-human-machine-interfaces-from-cyber-threats/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # HMI security: protecting human-machine interfaces from cyber threats Learn how to protect HMI workstations from ransomware, unauthorized access and lateral movement with practical hardening, backup and recovery guidance. [Try now](https://www.acronis.com/en/products/cyber-protect-ot/trial/) [![Image 2: Subramani Rao](https://staticfiles.acronis.com/images/content/2e59a1554a5410544453069333301fb1.png)](https://www.acronis.com/en/blog/authors/subramani-rao/ "Subramani Rao") [Subramani Rao,](https://www.acronis.com/en/blog/authors/subramani-rao/)Senior Manager, Cybersecurity Solutions Strategy 7 min read Last updated 24 September 2026 HMI security protects the operator-facing system against unauthorized access, credential misuse, malware, lateral movement and tampering while preserving safe visibility and operational continuity. In PC-based deployments, the OEM-managed application and the Windows or Linux workstation beneath it require separate controls. This guide is for OT and automation engineers, [SCADA administrators](https://www.acronis.com/en/blog/posts/scada-security-guide/) and plant leaders responsible for HMI availability. These workstations are often long-lived, connectivity-restricted and difficult to change. Failure or compromise can remove visibility and interrupt production. **Quick definition: HMI security**HMI security combines OEM application controls with host-level identity, hardening, monitoring, backup and recovery. Controls differ for PC-based, embedded and browser-based HMIs. **Key takeaways**The OEM application and the underlying workstation are separate security and recovery layers.A compromised host can remove visibility or provide a route deeper into OT without infecting a PLC.Host images and OEM project backups are complementary, not interchangeable.Protection must combine prevention with tested recovery and validated return to service. ## What is an HMI and why does HMI security matter? An HMI is the hardware or software through which an operator interacts with a controller. In PC-based architectures, it is also an operating-system host with accounts, services, remote-access paths and software dependencies. Losing that host can create partial or complete loss of view, delay alarm response and force a controlled shutdown even when controllers continue to execute. CISA documented that pattern at a natural gas compression facility where ransomware affected Windows-based HMIs and other supervisory assets while the PLCs remained unaffected. A compromised host may also expose trusted communications or credentials. Human machine interface security therefore has two linked objectives: prevent untrusted use and restore trusted operator visibility within the required recovery time. The HMI must remain trustworthy during normal operation and recoverable after malware, hardware failure or configuration error. ## What are five common HMI security threats? Five common threats are unauthorized access, credential misuse, lateral pivoting, host ransomware and tampering with configuration or displayed data. This is a practical synthesis, not a universal taxonomy. **Unauthorized access.** Remote-control software, exposed services and weak authentication can produce an operator-equivalent session. CISA’s Oldsmar advisory reported unauthorized SCADA access and an attempted setpoint change, although initial access remained unconfirmed. **Credential theft or misuse.** Shared engineering or administrative accounts can collapse trust boundaries and give a valid user access across systems or zones. **Lateral pivot toward PLCs.** Nozomi Networks demonstrated that browser-based HMI flaws could permit code execution and access to other facility systems. This was research, not an observed intrusion. **Ransomware on the Windows host.** CISA documented ransomware affecting HMIs, historians and polling servers. PLCs were unaffected, yet operators lost partial visibility and shut down for about two days. **Configuration or display tampering.** A 2026 CISA advisory described malicious PLC project-file activity and manipulation of HMI and SCADA display data. It did not establish that a Windows HMI project file was changed. ## How should HMI security be split between the OEM layer and the workstation layer? The OEM layer and workstation layer should be secured as separate but dependent systems. This is an operational responsibility model, not a formal standards taxonomy. The OEM layer covers application authentication, patches, project structures, runtime packages, graphics, tags, recipes, alarms and platform-specific restore procedures. AVEVA InTouch, Rockwell FactoryTalk View, Siemens WinCC and GE iFIX each define their own project formats and recovery methods. The workstation layer covers the operating system, accounts, remote access, host firewall, storage, drivers, services and endpoint telemetry. Material changes still require OEM compatibility testing and operational approval. [Acronis Cyber Protect for OT](https://www.acronis.com/en/products/cyber-protect-ot/) operates at this workstation layer. It protects the PC or server running the OT application with host-level cyber protection and recoverable system images. It does not replace OEM controls or validate proprietary HMI graphics, tags, recipes, alarm logic or PLC control logic. ## How should an HMI workstation be hardened? HMI workstation hardening should reduce software, privileges and access paths without creating an unsafe or unsupported operating state. Build an OEM-validated host baseline. Remove unnecessary software and services, restrict communications and document dependencies. Patch the operating system and supporting components through change control, testing against the HMI version, drivers and redundancy design. Use unique, auditable accounts. Restrict administrator rights and make engineering or vendor access approved, time-bound and logged. Route remote access through a controlled path with strong authentication. Application allowlisting suits fixed-function hosts. Build the policy from a known-clean system, include approved OEM services and maintenance tools and test it in audit mode before enforcement. Host monitoring and EDR can add process, file and account telemetry where compatible. Tune detections, test response actions and avoid automatic containment that could remove critical visibility without operational coordination. The broader [endpoint-protection guidance for HMI and SCADA workstations](https://www.acronis.com/en/blog/posts/ot-endpoint-protection-hmi-scada/) covers this layer in more detail. ## What should an HMI backup include? An HMI backup should preserve both a recoverable host and the OEM-defined application state. A host image should capture the operating system, drivers, network settings, installed components, policies and licensing dependencies. It preserves OEM files only when they are included and captured consistently. Keep a separate OEM-supported project export or application backup. Rockwell provides FactoryTalk View HMI Server Backup and Restore procedures, while Siemens documents WinCC-specific project backups. Alarm history, recipes, historian data and external databases may need separate treatment. Rockwell’s documentation, for example, warns that some external and historical data sources are not included in the application archive. A complete recovery set should include the host image, OEM project export, external databases, alarm or historian records, licenses, drivers, installation media, network settings and recovery documentation. Version host images and OEM project backups independently. Keep at least one recovery copy beyond the credentials and incident that could damage production systems. Test recovery in isolation. Confirm that the host boots, the project opens, licenses and drivers are available and required services start. The [OT backup and recovery guide](https://www.acronis.com/en/blog/posts/backup-strategies-for-operational-technology-systems/) covers the wider industrial recovery strategy. ## How do you recover a compromised HMI workstation? Recover a compromised HMI workstation through an operations-led sequence that preserves safety, evidence and trust. **First, establish a safe process state and alternate visibility.** Isolate the host with operations approval, preserve required evidence and determine whether the incident extends beyond the workstation. **Second, restore trust in the host.** Rebuild or restore from a known-good image, rotate exposed credentials and remediate the original access path. **Third, restore the OEM application state.** Use the vendor-supported method for the project, runtime package and related databases. In CISA’s pipeline case, the organization acquired replacement equipment and loaded last-known-good configurations. **Fourth, validate in a segmented test state.** Check operating-system integrity, licenses, drivers, application version, project identity, alarm behavior, communications and displayed process values against approved engineering records. **Finally, reconnect in stages.** Obtain operations, automation, safety and security approval, keep a rollback path and monitor closely. The objective is a trusted HMI that behaves correctly in the live process. The [OT ransomware recovery guide](https://www.acronis.com/en/blog/posts/ot-ransomware-protection-and-recovery/) expands on coordinated plant recovery. ## How does Acronis Cyber Protect for OT protect an HMI workstation? Acronis Cyber Protect for OT protects the host beneath the HMI application so plant teams can restore visibility and reduce downtime without claiming control over proprietary project semantics or PLC logic. On-premises and [air-gapped deployments](https://www.acronis.com/en/blog/posts/air-gap-ot-network-protection/) use [Acronis Cyber Protect Local](https://www.acronis.com/en/products/cyber-protect/licensing/local/). This differs from generic endpoint recovery because an HMI may run on legacy, disconnected hardware and must return to an OEM-validated state. For [supported Windows and Linux systems](https://www.acronis.com/en/products/cyber-protect/system-requirements/), it provides image-based backup, [legacy OS support](https://www.acronis.com/en/blog/posts/securing-legacy-ot-systems-without-disrupting-operations/) and [Universal Restore](https://www.acronis.com/en/technology/universal-restore/) to dissimilar hardware. The same agent can combine backup with [anti-ransomware](https://www.acronis.com/en/technology/active-protection/), [anti-malware](https://www.acronis.com/en/technology/antimalware/) and EDR, while [backup scanning](https://www.acronis.com/en/products/cyber-protect/components/) can identify and remediate threats before restoration. [Acronis One-Click Recovery](https://www.acronis.com/en/blog/posts/why-one-click-recovery-is-crucial-for-keeping-operations-running/) lets authorized local personnel restore failed OT systems in minutes with a few clicks and without direct IT intervention. Engineering teams still validate the OEM application, communications and displayed values before reconnection. A public [Sasol case study](https://www.acronis.com/en/resource-center/resource/sasol-fortifies-plant-stability-and-business-continuity-with-acronis-cyber-protect/) reports reliable recovery to dissimilar hardware, resolution of compatibility problems and support for migration between physical and virtual systems. Workstation-layer protection OEM and plant-engineering responsibility Operating system, system image, accounts, storage, malware protection and host recovery HMI application patches, graphics, tags, recipes, alarm logic, project validation and PLC control logic **HMI security action plan**Apply OEM-supported application controls, harden the host, protect host images and OEM artifacts separately, test recovery in isolation and document who can initiate restoration. **Next step:**[Talk to an OT expert about protecting and recovering PC-based HMI systems](https://www.acronis.com/en/products/cyber-protect-ot/book-call/). ## What else do practitioners ask about HMI security? ### Does HMI redundancy eliminate the need for backup? No. Redundancy preserves availability, but it is not an isolated recovery point for ransomware, corruption or a configuration overwritten on both nodes. Rockwell documents backup of the active server in a redundant FactoryTalk View SE environment. ### How should HMI backup frequency follow configuration changes? Set cadence from the recovery point objective and change rate. Capture an OEM-supported project backup around material changes, then schedule copies according to acceptable data loss. NIST does not prescribe one interval. ### Should an HMI be backed up before an OEM update or migration? Yes. Preserve a host image and OEM-supported project export before changing the application, operating system, drivers or licensing components. Confirm the rollback procedure first. ### What should an HMI restore test record? Record recovery time, image and project versions, required media, licensing steps, driver gaps, validation results and approval. This creates a repeatable procedure. ### What changes when an HMI license is tied to hardware? Document the license, machine-binding criteria and OEM rehosting process. A successful image restore may still fail operationally if the license cannot move to replacement hardware. ### How do teams determine whether alarm history is inside the HMI project backup? Check the OEM backup scope and external database or historian connections. Some archives exclude alarm history or other data stores, which need separate recovery procedures. ### Are embedded or browser-based HMIs the same security problem as Windows HMI workstations? No. Embedded and browser-based devices depend more on OEM firmware, device configuration and network controls. This host-hardening and image-recovery guidance applies to PC-based systems. [Operational Technology (OT)](https://www.acronis.com/en/blog/tags/operational-technology/) ## Written by ![Image 3: Subramani Rao](https://staticfiles.acronis.com/images/content/2e59a1554a5410544453069333301fb1.png) Subramani Rao Senior Manager, Cybersecurity Solutions Strategy Subramani Rao is an award-winning cybersecurity leader, strategist, author and international speaker who drives cybersecurity solutions strategy at Acronis. He received the Cybersecurity Leadership Award at the 2026 GTIA UK & Ireland Spotlight Awards and authored a SANS Institute white paper on DDoS attacks and mitigation that has been cited by researchers worldwide. Through speaking, research and thought leadership, Subramani explores how organisations can move beyond prevention to build resilience across increasingly interconnected IT, OT and AI-driven environments. He holds an Executive MBA from London Business School, an MSc in Computer Security with Distinction and the CISSP certification. He is also the author of AI & Cybersecurity: Humanity’s Portal to the Infinite. [Previous post](https://www.acronis.com/en/blog/posts/ot-vulnerability-management/) [OT vulnerability management for Windows and Linux workstations](https://www.acronis.com/en/blog/posts/ot-vulnerability-management/) [Next post](https://www.acronis.com/en/blog/posts/from-ai-vision-to-msp-action-the-journey-continues-this-october/) [From AI vision to MSP action: The journey continues this October](https://www.acronis.com/en/blog/posts/from-ai-vision-to-msp-action-the-journey-continues-this-october/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 6: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read