Growing connectivity, new regulations, and long-term operational requirements are pushing cybersecurity decisions into the earliest stages of industrial project design.
The earliest decisions in a new industrial project often have the longest impact. Choices involving automation, supplier access, and long-term support can be difficult and expensive to change once the process has been commissioned, yet they will continue to affect reliability, maintenance, and operational risk for years. OT cybersecurity is now one of those foundational decisions.
Operational Technology, or OT, includes the control systems, industrial networks, software, and connected devices used to monitor and operate physical processes. Unlike traditional IT systems, which primarily manage business information, OT controls the plant itself, including pumps, valves, turbines, motors, production equipment, and other critical process assets. As industrial facilities become more connected, protecting these systems is becoming just as important as protecting the physical infrastructure they control.
In many industrial projects, however, OT cybersecurity is still treated as something that can be handled later, after the main technology selections have been made and the system design is already moving toward detailed engineering or commissioning.
That approach simply does not work anymore. As industrial systems become more connected and cybersecurity requirements continue to expand, decisions made late in the project can create compliance issues, increase costs, complicate commissioning, and leave plant owners with security gaps that are much harder to address after startup.
In the European Union, OT cybersecurity is moving beyond a matter of technical preference. The Cyber Resilience Act and NIS2 are placing defined responsibilities on both sides of the industrial environment. Suppliers must provide products that meet security requirements, while critical infrastructure operators must manage cybersecurity risk throughout their operations.
“In the EU, cybersecurity is enforced by law. That is why everyone is on their toes,” says Teemu Kiviniemi, Solution Manager for OT Cybersecurity Services at Valmet. Valmet is a leading worldwide provider of process technologies, automation systems, and services for the pulp, paper, and energy sectors. The company’s automation and flow control offerings further extend their reach into a wide range of other process industries. With headquarters in Espoo, Finland, Valmet has over 220 years in the industrial sector.
This is where timing becomes critical. When cybersecurity is considered only after the core system architecture has already been selected, the project team is effectively trying to add security after the product has been designed.
“It is like first making a product and then putting the quality in afterwards. It doesn’t work that way,” says Kiviniemi. “You need to take cybersecurity into consideration from the start.”
The cost of late cybersecurity decisions
Once the system architecture is already established, new cybersecurity requirements can be difficult to accommodate without creating additional complexity. Compliance may require new components, changes to existing interfaces and workflows, or exceptions that leave the overall system more difficult to operate and maintain.
The cybersecurity requirements also continue after the project is complete. Although the EPC may still deliver the project on time, any compromises made during design can remain with the owner for the next 20 to 30 years. This is particularly important in OT, where industrial systems cannot be patched, modified, or rebooted with the same freedom as conventional IT systems.
“Email server patching may inconvenience employees for an hour. A poorly timed or poorly tested OT patch can affect production, safety, or, in the case of a power plant one million people don’t get electricity and it makes headlines,” says Kiviniemi.
Kiviniemi says this is where support after commissioning becomes critical. Valmet can continue to manage that risk through patch assessment, vulnerability management, monitoring, endpoint protection, and lifecycle support for its automation systems.
With modern automation platforms like Valmet DNAe, cybersecurity is built into the underlying architecture. The platform was developed to support IT/OT convergence, with industrial-standard interfaces and edge technology providing connectivity from field-level sensors through to cloud applications. This allows data to move across the system and supports the use of digital intelligence and AI-based tools at different levels of the operation.
For more information about Valmet’s process automation systems, please visit www.valmet.com.
