TL;DR: In the ongoing US-Israel-Iran conflict landscape, CISA, FBI, and NSA advisories have flagged Iranian-affiliated threat actors targeting US water, wastewater, energy, and government-services infrastructure — with 3,000+ internet-exposed Rockwell Automation PLC devices explicitly named as a live risk surface. NC small and mid-size manufacturers running Rockwell ControlLogix, CompactLogix, or MicroLogix on the plant floor are structurally exposed if any operator-panel, engineering-workstation, or maintenance-VPN path reaches those PLCs from the internet. The risk is real, the defense is well-understood, and the fix window is measured in days, not months.
Key takeaway: Iranian state-linked activity historically escalates through targets of opportunity — water utilities and small-manufacturer plant floors have both been hit repeatedly. If you own PLCs and you cannot answer "is any of this reachable from the internet today?" in under 90 seconds, you are the target profile.
Do you know exactly which of your Rockwell PLCs are internet-reachable? Contact Preferred Data Corporation for a same-week OT-exposure audit. BBB A+ rated. On-site within 200 miles of High Point. Call (336) 886-3282.
What Is the Current Iranian APT Threat Landscape?
The July 2026 threat landscape is defined by an ongoing US-Israel-Iran military exchange and repeated advisories from CISA, FBI, and NSA warning that Iranian-affiliated cyber threat actors are actively targeting US critical infrastructure — with specific emphasis on water and wastewater systems, energy sector, and government services.
Three concrete facts every NC manufacturer should internalize:
- 3,000+ internet-exposed Rockwell devices at risk. The joint advisory named 3,000+ internet-exposed Rockwell Automation devices as a specific attack surface via PLC exploitation. Shodan-style external scans routinely find PLCs directly on the public internet.
- Water/wastewater is the historical bellwether, not the ceiling. Iranian-linked activity has hit multiple US water utilities since 2023. Manufacturing plant floors that run the same Rockwell or Modicon PLCs and the same VNC-over-internet remote-access patterns are the next tier of opportunity.
- The attacks are message-driven, not data-driven. Iranian critical-infrastructure operations historically prioritize disruption and defacement over exfiltration. That means the attacker's monetization threshold is low: any accessible PLC is a candidate.
Manufacturers frequently reason "we are not critical infrastructure" and dismiss the threat. That reasoning is incorrect on two counts: (1) manufacturers ARE part of critical infrastructure under CISA's 16-sector taxonomy, and (2) opportunistic Iranian activity has hit small manufacturers repeatedly as targets of convenience.
Key takeaway: The "we are too small to matter" theory is not defensible against an adversary whose goal is sending a message, not making money. That adversary hits whoever is reachable.
Which Rockwell Devices Are Most at Risk in an NC Manufacturer?
Rockwell Automation's PLC portfolio spans decades and product lines. The exposure profile is not uniform. Some devices are structurally more at risk than others.
Highest-risk Rockwell products in an NC SMB manufacturer:
- MicroLogix 1400 and 1100 series with internet-facing web servers. Older MicroLogix devices shipped embedded web servers that expose configuration and monitoring UIs on TCP 80. Historical CVEs (CVE-2020-6990, CVE-2021-33012, CVE-2022-1161) allow authentication bypass or code execution.
- ControlLogix 1756 series with EtherNet/IP directly reachable. ControlLogix over EtherNet/IP (TCP 44818, TCP 2222) is intended for plant-floor networks, not the internet. Any 1756 module reachable on 44818 from the public internet is an emergency remediation.
- CompactLogix 5370 and 5380 series with FactoryTalk Directory reachable via HTTP. FactoryTalk Directory over HTTP or HTTPS routinely ends up on port-forwarded ISP routers for "convenience" remote maintenance.
- PanelView Plus HMIs with VNC or RDP enabled. HMI panels that dual-boot Windows Embedded and expose VNC or RDP to a maintenance VLAN often end up bridged to the internet via a maintenance vendor's Fortinet or SonicWall rule.
Two configurations that dramatically reduce risk:
- Rockwell FactoryTalk Remote Access (formerly ThinManager) with proper VLAN segmentation. The right way to remote-manage.
- CIP Security enforced on ControlLogix 1756-EN4TR modules. Cryptographically authenticates EtherNet/IP traffic. Available on modern ControlLogix versions.
Your device inventory is the first step. If you cannot produce a signed Excel with every PLC by model, firmware version, and network reachability inside 48 hours, that is the emergency work.
What Does an OT Exposure Audit Look Like?
An OT exposure audit is the standard technical assessment PDC delivers for NC manufacturers concerned about Iranian, ransomware, or opportunistic threats. It is a defined 5-day engagement.
Day 1: External scan.
- Public-IP scan (Shodan-style + targeted TCP port sweep) against all ISP-assigned IPs the manufacturer holds. Any responsive EtherNet/IP (44818), Modbus (502), OPC UA (4840), CIP (2222), or FTP/Telnet management ports are P0.
- Documented list of every internet-reachable industrial-control port with a firewall block plan.
Day 2: Internal PLC inventory.
- Passive network capture on the plant-floor VLAN using Wireshark or a Claroty/Nozomi/Dragos sensor.
- Every PLC by model, firmware, and IP documented.
- Every engineering workstation with RSLogix, Studio 5000, or FactoryTalk installed identified.
Day 3: Segmentation review.
- Firewall rules between corporate LAN and plant-floor VLAN reviewed.
- Any "any-any" or overly permissive rule documented for remediation.
- Purdue-model layer mapping (Levels 0-3.5) validated against the actual network.
Day 4: Remote-access review.
- Every vendor VPN, cellular router, and remote-management path enumerated.
- Vendor account inventory: who has access, what is their MFA posture, when was access last used.
Day 5: Executive report.
- Prioritized remediation with timeline and cost.
- 30-day, 90-day, and 12-month roadmap.
- Signed document for cyber-insurance and CMMC evidence.
Cost for a typical NC manufacturer: $6,000-$15,000 depending on plant complexity. Delivered by PDC's Cybersecurity team with plant-floor experience from decades of NC manufacturing engagements.
Comparison: OT Security Postures for NC Manufacturers
Not every NC manufacturer is at the same OT-security maturity level. Understanding where you sit determines the remediation priority.
| Maturity Tier | Typical NC SMB Profile | Iranian APT Exposure | 90-Day Recommendation |
|---|---|---|---|
| Tier 0: Flat Network | ~40% of NC manufacturers | Critical: plant floor reachable from any office jack | Emergency VLAN segmentation this quarter |
| Tier 1: Basic Segmentation | ~35% of NC manufacturers | High: VLANs exist but rules are permissive | Firewall rule tightening + inventory |
| Tier 2: Purdue-Aligned | ~20% of NC manufacturers | Moderate: proper segmentation, weak monitoring | OT sensor deployment (Claroty / Nozomi / Dragos) |
| Tier 3: Zero Trust OT | ~5% of NC manufacturers | Low: continuous monitoring + CIP Security | Continuous improvement, tabletop exercises |
Tier 0 remediation cost: $18,000-$40,000 one-time to reach Tier 1. Highest ROI in security spending an NC manufacturer can make.
Tier 1 to Tier 2 transition: $25,000-$60,000 one-time (OT sensor + services). Delivers continuous plant-floor visibility. Frequently reimbursed by CMMC or insurance premium reductions.
Most NC SMB manufacturers we assess land in Tier 0 or Tier 1. The July 2026 Iranian threat elevation is the operational excuse to move to Tier 2 this budget cycle.
What Are the Iron Rules of Plant-Floor Segmentation?
Segmentation is the single highest-leverage OT control. It costs money once and reduces every attack's blast radius forever.
Five iron rules of plant-floor segmentation for NC SMB manufacturers:
- Plant floor is its own VLAN. Not shared with office, not shared with WiFi, not shared with guest, not shared with printers.
- Corporate → Plant floor is deny-by-default. Explicit allow rules for: MES data collection, ERP data sync, engineering-workstation ports. Nothing else.
- Plant floor → Corporate is deny-by-default. Explicit allow rules for: outbound data collection, cloud telemetry to Rockwell FactoryTalk Cloud (if used), specific vendor cloud endpoints. Nothing else.
- Plant floor → Internet is deny-by-default (via corporate firewall proxy). If a vendor needs cloud connectivity for a specific device, allow that one endpoint. Not broad internet.
- Remote access is via VPN + MFA to a dedicated engineering workstation only. No direct RDP or VNC from anywhere on the internet.
Those five rules are 90% of OT security. The technical implementation is standard managed-IT work: VLAN definitions, firewall rules, a Fortinet or Palo Alto or Cisco Firepower device sized to the plant.
How Should NC Manufacturers Coordinate With Their PLC Vendor?
Rockwell Automation, Siemens, and Schneider Electric all publish OT security advisories and vendor guidance. Coordinating with your vendor is table stakes.
Three vendor coordination actions for July 2026:
- Subscribe to Rockwell Automation Security Advisories. Rockwell publishes advisories at psirt.rockwellautomation.com. Every plant-floor operator or maintenance manager should be on that mailing list.
- Review current PLC firmware against Rockwell's supported version matrix. Firmware older than the vendor's supported "N-2" line loses eligibility for security fixes. Older MicroLogix and ControlLogix hosts are frequently on firmware that no longer receives updates.
- Ask Rockwell for an On-Site Security Assessment. Rockwell offers paid site-security assessments. For manufacturers with 100+ PLCs, this is worth doing every 24 months.
CISA also publishes ICS advisories at cisa.gov/uscert/ics. Subscribe. Read. Act.
Ready to lock down your plant floor? Call PDC at (336) 886-3282 or request a same-week OT-exposure audit. We audit every PLC, every remote-access path, every firewall rule, and deliver a signed remediation roadmap. Our Manufacturing industry practice is built exactly for NC manufacturers with plant-floor exposure.
Why Is IT/OT Convergence the Underlying Problem?
The reason NC SMB manufacturers are exposed to Iranian APT activity is not because Rockwell PLCs are weak. It is because IT and OT have converged operationally without converging on security posture.
Three convergence realities:
- PLCs increasingly need internet access. For firmware updates, remote diagnostics, cloud analytics, and predictive maintenance. That access must be tightly controlled, but it is real.
- Engineering workstations are corporate Windows hosts. RSLogix 5000, Studio 5000, and FactoryTalk View run on standard Windows workstations that get email, browse the web, and receive Office documents. Compromise any one of those workstations and you have PLC access.
- Maintenance vendors need in-and-out access. ATVs, motor drives, VFDs, CNC controllers, and every other plant-floor device is routinely maintained by third-party vendors who need remote access.
The security answer is not "block everything." It is "control everything." Named user accounts with MFA on the VPN. Named workstations for engineering. Named cloud endpoints for firmware. Named vendor accounts with time-limited access.
PDC's OT/IT Integration capabilities specifically address this convergence. We are one of the few NC managed-IT firms that maintains plant-floor expertise from decades of manufacturing engagements. Our Manufacturing practice is the reference for NC SMB manufacturers navigating IT/OT security.
Frequently Asked Questions
Are we actually at risk if we do not run water utility systems?
Yes. Iranian-linked activity has historically hit water utilities as high-visibility targets, but the same threat actors regularly hit manufacturers, service providers, and construction firms as targets of opportunity. Any internet-reachable PLC or HMI is a candidate.
How do we know if any of our PLCs are internet-reachable?
A Shodan search on your ISP's IP block, an external Nmap scan, and a review of every firewall rule that includes "any" in the destination or the port field. If your MSP cannot produce that report in 48 hours, get a second opinion.
Our maintenance vendor requires remote VNC access to PanelView HMIs. Is that acceptable?
Only if it goes through a VPN with MFA, terminates on a jump host, and uses named accounts with logged sessions. Direct VNC over the internet is not acceptable in 2026 regardless of whether the vendor prefers it.
Do we need CMMC or NIST 800-171 certification to defend against this?
No. The controls that reduce Iranian APT exposure are the same controls that reduce ransomware exposure. Whether or not you pursue CMMC/NIST formal certification, plant-floor VLAN segmentation, MFA on remote access, and PLC inventory are baseline. If you already need CMMC for a DoD subcontract, the required controls overlap heavily with what protects you here.
What if we cannot patch our older MicroLogix or ControlLogix firmware?
Segment those PLCs behind an internal firewall that denies inbound traffic from any source except the specific engineering workstation that needs it. Deploy an OT sensor (Claroty, Nozomi, or Dragos) to catch anomalous PLC command sequences. Plan the PLC hardware refresh onto your 24-month CapEx cycle.
How does cyber insurance react to unremediated OT exposure?
Every 2026 cyber-insurance renewal we have seen for NC manufacturers includes questions about plant-floor segmentation, OT asset inventory, and internet-facing industrial-control-system ports. Renewals that answer "no" or "we do not know" trigger premium increases, coverage exclusions, or non-renewal. The insurance economics alone justify the OT-exposure audit.
Related Resources
- Cybersecurity Services
- Managed IT Services
- Manufacturing Industry Services
- Network Infrastructure
- Contact PDC — same-week OT-exposure audit