Endpoint protection for industrial systems: securing HMIs and SCADA servers

Why generic IT endpoint tools fail on the plant floor, what HMI and SCADA workstations actually need and how to build OT-appropriate endpoint protection. For plant security leads, OT engineers and industrial CISOs.

OT endpoint protection combines anti-ransomware, antivirus, EDR, vulnerability assessment and patch management deployed on the PC-class endpoints inside an industrial environment, primarily HMI workstations, SCADA servers, engineering workstations and historians. It is distinct from generic IT endpoint protection because it must support legacy operating systems, operate offline, run within tight resource constraints and integrate with the operator-led recovery workflows that plant staff actually use.

HMI and SCADA workstations are the most exposed endpoints in any industrial environment. They run Windows. They sit between operators and the control system. They are often the most reachable PC-class device on the OT network. When ransomware hits a plant, these are the systems that go down first.

Generic IT endpoint protection does not work on the plant floor. It assumes modern operating systems, cloud connectivity, regular signature updates and IT staff available to manage agents. None of those hold in OT.

OT endpoint protection needs four things IT EDR rarely delivers: legacy OS support back to Windows XP and Server 2003, offline-capable behavioral protection, low resource consumption that does not interfere with control-loop timing and operator-led recovery for plant staff who cannot wait for IT.

Acronis Cyber Protect for OT is purpose-built for this. It combines anti-ransomware, antivirus, EDR, vulnerability assessment, patch management and image-based backup on a single agent. It supports Windows XP SP1 through Windows 11 and Linux kernels 2.6.9 through 5.19. ABB, Schneider Electric, Toyota, Tata Steel, Sasol and BDR Pharmaceuticals run it in production.

HMI and SCADA workstations are PC-class endpoints running general-purpose operating systems (almost always Windows, occasionally Linux) that operate as the human interface to the industrial control system. They run Rockwell FactoryTalk, Siemens WinCC, Schneider Wonderware, AVEVA InTouch, Inductive Automation Ignition and GE Proficy iFIX. They sit at Levels 2 and 3 of the Purdue Model.

Three properties make them the primary attack surface. They are the most reachable PC-class systems in the plant (PLCs and RTUs are embedded with proprietary firmware and harder to attack directly). They sit at the intersection of operator and control system: an attacker who compromises an HMI can manipulate what the operator sees and what commands reach the field. The Oldsmar water treatment incident (2021) is the textbook example: TeamViewer on an HMI was used to attempt poisoning sodium hydroxide concentrations. And they run software that cannot be patched on a normal cadence because automation vendors validate the operating system version with the HMI or SCADA application.

CISA published more than 400 ICS advisories in 2025. Sophos State of Ransomware 2024 found 93% of ransomware attacks on manufacturing organizations attempted to compromise backup systems on these endpoints. The endpoint is the primary battleground.

1. Modern operating systems only. Most current EDR does not install on Windows XP, Vista, Server 2003 or Server 2008. OT plants commonly run all of these because the OEM-certified application requires that exact version.
2. Cloud-managed consoles assume connectivity. In segmented or air-gapped OT environments, endpoints cannot reach the console and the console cannot reach them.
3. Resource consumption breaks control-loop timing. HMI workstations often run on industrial PCs with limited CPU and RAM. Excess agent draw introduces latency into operator screen updates, alarm processing and historian writes.
4. Aggressive remediation can stop production. Killing a process or isolating a host on an HMI driving a chemical batch reactor can stop production or create a safety event.
5. Engineering tools trip behavioral detection. Legitimate Studio 5000, TIA Portal, EcoStruxure Control Expert and Ignition Designer activity often spawns shells, modifies system files and calls unusual APIs.
6. Living-off-the-land detection is harder in OT. Attackers use legitimate PowerShell, WMI and vendor engineering software. Detection has to combine endpoint behavioral signals with awareness of operational role.

Acronis Cyber Protect for OT combines anti-ransomware, antivirus, EDR, vulnerability assessment, patch management and image-based backup on a single agent. Validated in production at ABB, Schneider Electric, Toyota, Tata Steel, Sasol and BDR Pharmaceuticals.

Where endpoint protection sits in the OT stack

Endpoint protection is one layer, not the whole stack. Pair Acronis Cyber Protect for OT (endpoint plus backup) with dedicated OT network monitoring (Dragos, Claroty or Nozomi) and OT-aware network segmentation.

IEC 62443-3-3 SR 3.2 (malicious code protection), SR 7.4 (system recovery), SR 2.4 (mobile code) and SR 3.4 (software and information integrity) all apply to OT endpoint protection. IEC 62443-4-1 covers supplier SSDLC (Acronis is certified). NIST SP 800-82 Rev 3 Section 6 covers ICS-specific risk management with explicit compensating-control guidance for legacy endpoints. NIS 2 Article 21 requires technical measures including risk analysis, incident handling and business continuity. NERC CIP-007 covers malicious code prevention on bulk electric system cyber assets. GxP covers data integrity in pharma.

1. CISA ICS Advisories (2025 calendar year)
2. Sophos State of Ransomware 2024
3. Dragos 2026 OT Cybersecurity Year in Review (February 2026)
4. SANS 2025 State of ICS/OT Cybersecurity Survey
5. Honeywell 2024 USB Threat Report
6. NIST SP 800-82 Rev 3, September 2023
7. ISA/IEC 62443 family
8. EU NIS 2 Directive (Directive 2022/2555)
9. NERC CIP-007, CIP-009
10. FDA 21 CFR Part 11
11. Oldsmar water treatment incident, 2021 (CISA Alert AA21-042A)
12. Acronis Cyber Protect for OT product page: acronis.com/en/products/cyber-protect-ot/
13. Acronis Manufacturing industry page: acronis.com/en/industries/backup/manufacturing/
14. TAG Infosphere and Omdia analyst notes on Acronis OT cyber resilience