--- title: "Endpoint protection for industrial systems: securing HMIs and SCADA servers" description: 93% of ransomware attacks on manufacturers target backup systems on these endpoints (Sophos, 2024). See what OT-appropriate endpoint protection needs. canonical_url: https://www.acronis.com/en/blog/posts/ot-endpoint-protection-hmi-scada/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Endpoint protection for industrial systems: securing HMIs and SCADA servers 93% of ransomware attacks on manufacturers target backup systems on these endpoints (Sophos, 2024). See what OT-appropriate endpoint protection needs. [Try now](https://www.acronis.com/en/products/cyber-protect-ot/trial/) [![Image 2: Subramani Rao](https://staticfiles.acronis.com/images/content/2e59a1554a5410544453069333301fb1.png)](https://www.acronis.com/en/blog/authors/subramani-rao/ "Subramani Rao") [Subramani Rao,](https://www.acronis.com/en/blog/authors/subramani-rao/)Senior Manager, Cybersecurity Solutions Strategy 5 min read Last updated 07 July 2026 Why generic IT endpoint tools fail on the plant floor, what HMI and SCADA workstations actually need and how to build OT-appropriate endpoint protection. For plant security leads, OT engineers and industrial CISOs. **OT endpoint protection** combines anti-ransomware, antivirus, EDR, vulnerability assessment and patch management deployed on the PC-class endpoints inside an industrial environment, primarily HMI workstations, SCADA servers, engineering workstations and historians. It is distinct from generic IT endpoint protection because it must support legacy operating systems, operate offline, run within tight resource constraints and integrate with the operator-led recovery workflows that plant staff actually use. ## Key takeaways **HMI and SCADA workstations are the most exposed endpoints in any industrial environment.** They run Windows. They sit between operators and the control system. They are often the most reachable PC-class device on the OT network. When ransomware hits a plant, these are the systems that go down first. **Generic IT endpoint protection does not work on the plant floor.** It assumes modern operating systems, cloud connectivity, regular signature updates and IT staff available to manage agents. None of those hold in OT. **OT endpoint protection needs four things IT EDR rarely delivers:** legacy OS support back to Windows XP and Server 2003, offline-capable behavioral protection, low resource consumption that does not interfere with control-loop timing and operator-led recovery for plant staff who cannot wait for IT. **Acronis Cyber Protect for OT is purpose-built for this.** It combines anti-ransomware, antivirus, EDR, vulnerability assessment, patch management and image-based backup on a single agent. It supports Windows XP SP1 through Windows 11 and Linux kernels 2.6.9 through 5.19. ABB, Schneider Electric, Toyota, Tata Steel, Sasol and BDR Pharmaceuticals run it in production. ## Why are HMI and SCADA workstations the attack surface that matters? **HMI and SCADA workstations are PC-class endpoints running general-purpose operating systems** (almost always Windows, occasionally Linux) that operate as the human interface to the industrial control system. They run Rockwell FactoryTalk, Siemens WinCC, Schneider Wonderware, AVEVA InTouch, Inductive Automation Ignition and GE Proficy iFIX. They sit at Levels 2 and 3 of the Purdue Model. Three properties make them the primary attack surface. They are **the most reachable PC-class systems in the plant** (PLCs and RTUs are embedded with proprietary firmware and harder to attack directly). They **sit at the intersection of operator and control system**: an attacker who compromises an HMI can manipulate what the operator sees and what commands reach the field. The Oldsmar water treatment incident (2021) is the textbook example: TeamViewer on an HMI was used to attempt poisoning sodium hydroxide concentrations. And they **run software that cannot be patched on a normal cadence** because automation vendors validate the operating system version with the HMI or SCADA application. CISA published more than 400 ICS advisories in 2025. Sophos State of Ransomware 2024 found 93% of ransomware attacks on manufacturing organizations attempted to compromise backup systems on these endpoints. The endpoint is the primary battleground. ## Why does generic IT endpoint protection fail on the plant floor? 1. **Modern operating systems only.** Most current EDR does not install on Windows XP, Vista, Server 2003 or Server 2008. OT plants commonly run all of these because the OEM-certified application requires that exact version. 2. **Cloud-managed consoles assume connectivity.** In segmented or air-gapped OT environments, endpoints cannot reach the console and the console cannot reach them. 3. **Resource consumption breaks control-loop timing.** HMI workstations often run on industrial PCs with limited CPU and RAM. Excess agent draw introduces latency into operator screen updates, alarm processing and historian writes. 4. **Aggressive remediation can stop production.** Killing a process or isolating a host on an HMI driving a chemical batch reactor can stop production or create a safety event. 5. **Engineering tools trip behavioral detection.** Legitimate Studio 5000, TIA Portal, EcoStruxure Control Expert and Ignition Designer activity often spawns shells, modifies system files and calls unusual APIs. 6. **Living-off-the-land detection is harder in OT.** Attackers use legitimate PowerShell, WMI and vendor engineering software. Detection has to combine endpoint behavioral signals with awareness of operational role. ## What does OT endpoint protection actually need? Requirement Why it matters in OT Legacy OS support Plants run Windows XP, 7, 8, Server 2003 through 2022, Windows 11 and Linux kernels back to 2.6.9. The platform has to install on what the OEM certified. Offline-capable behavioral protection Air-gapped OT cannot reach cloud signature servers. Detection has to work without them. Low resource consumption on a single agent Combining anti-ransomware, antivirus, EDR, vulnerability assessment, patch management and backup on one agent reduces footprint and eliminates conflicts. Operator-aware response Configurable response per role, with operator-in-the-loop override on critical assets. OT-appropriate behavioral baseline Recognize legitimate engineering software and industrial protocol activity rather than flagging every Modbus write. Operator-led recovery When prevention fails, a plant operator on shift needs to restore the endpoint without an IT engineer on-site. The difference between a 30-minute and a 6-hour outage. ## How does Acronis Cyber Protect for OT deliver OT endpoint protection? **Acronis Cyber Protect for OT** combines anti-ransomware, antivirus, EDR, vulnerability assessment, patch management and image-based backup on a single agent. Validated in production at ABB, Schneider Electric, Toyota, Tata Steel, Sasol and BDR Pharmaceuticals. Capability What it delivers Active Protection (offline) Behavioral anti-ransomware detects ransomware behavior, anomalous process activity and unauthorized encryption without cloud signature updates. Continues to work at air-gapped Levels 2 and 3. Tuned to recognize legitimate engineering software activity. Single-agent design Anti-ransomware, antivirus, EDR, vulnerability assessment, patch management and backup on one agent. Reduces resource footprint and eliminates conflicts. Broad legacy OS coverage Windows XP SP1 through Windows 11. Server 2003 through 2022. Linux kernels 2.6.9 through 5.19. No competitor matches this range. Image-based backup with One-Click Recovery Plant operator can restore a failed HMI or SCADA workstation overnight via One-Click Recovery. Universal Restore handles dissimilar hardware for legacy industrial PCs no longer manufactured. Backup scanning with pre-restoral remediation Prevents reinfection from a poisoned backup image. Acronis Cyber Protect Local Plant-floor management console. No cloud dependency required. IEC 62443-4-1 certified SSDLC Supplier-level certification. Audit-ready evidence in industrial procurement. **Where endpoint protection sits in the OT stack** Endpoint protection is one layer, not the whole stack. Pair **Acronis Cyber Protect for OT** (endpoint plus backup) with dedicated OT network monitoring (**Dragos**, **Claroty** or **Nozomi**) and OT-aware network segmentation. ## How does endpoint protection map to OT compliance? IEC 62443-3-3 SR 3.2 (malicious code protection), SR 7.4 (system recovery), SR 2.4 (mobile code) and SR 3.4 (software and information integrity) all apply to OT endpoint protection. IEC 62443-4-1 covers supplier SSDLC (Acronis is certified). NIST SP 800-82 Rev 3 Section 6 covers ICS-specific risk management with explicit compensating-control guidance for legacy endpoints. NIS 2 Article 21 requires technical measures including risk analysis, incident handling and business continuity. NERC CIP-007 covers malicious code prevention on bulk electric system cyber assets. GxP covers data integrity in pharma. ### Sources 1. CISA ICS Advisories (2025 calendar year) 2. Sophos State of Ransomware 2024 3. Dragos 2026 OT Cybersecurity Year in Review (February 2026) 4. SANS 2025 State of ICS/OT Cybersecurity Survey 5. Honeywell 2024 USB Threat Report 6. NIST SP 800-82 Rev 3, September 2023 7. ISA/IEC 62443 family 8. EU NIS 2 Directive (Directive 2022/2555) 9. NERC CIP-007, CIP-009 10. FDA 21 CFR Part 11 11. Oldsmar water treatment incident, 2021 (CISA Alert AA21-042A) 12. Acronis Cyber Protect for OT product page: acronis.com/en/products/cyber-protect-ot/ 13. Acronis Manufacturing industry page: acronis.com/en/industries/backup/manufacturing/ 14. TAG Infosphere and Omdia analyst notes on Acronis OT cyber resilience [Operational Technology (OT)](https://www.acronis.com/en/blog/tags/operational-technology/) ## Written by ![Image 3: Subramani Rao](https://staticfiles.acronis.com/images/content/2e59a1554a5410544453069333301fb1.png) Subramani Rao Senior Manager, Cybersecurity Solutions Strategy Subramani Rao is an award-winning cybersecurity leader, strategist, author and international speaker who drives cybersecurity solutions strategy at Acronis. He received the Cybersecurity Leadership Award at the 2026 GTIA UK & Ireland Spotlight Awards and authored a SANS Institute white paper on DDoS attacks and mitigation that has been cited by researchers worldwide. Through speaking, research and thought leadership, Subramani explores how organisations can move beyond prevention to build resilience across increasingly interconnected IT, OT and AI-driven environments. He holds an Executive MBA from London Business School, an MSc in Computer Security with Distinction and the CISSP certification. He is also the author of AI & Cybersecurity: Humanity’s Portal to the Infinite. [Previous post](https://www.acronis.com/en/blog/posts/manufacturing-compliance-for-msps/) [Manufacturing compliance for MSPs: A practical guide to audit-ready resilience](https://www.acronis.com/en/blog/posts/manufacturing-compliance-for-msps/) [Next post](https://www.acronis.com/en/blog/posts/acronis-extends-microsoft-365-protection-with-entra-id-backup/) [Acronis extends Microsoft 365 protection with Entra ID Backup](https://www.acronis.com/en/blog/posts/acronis-extends-microsoft-365-protection-with-entra-id-backup/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 6: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read