Same Alert, Different Impact

A failed login is one of the most ordinary events a security team sees. Most SIEM logic scores it the same way no matter where it happens. In an industrial environment, that assumption breaks. A failed authentication against a historian on the operations network can be routine. The same failed authentication against the controller running a turbine can be the first move toward taking it offline.

Same alert. Opposite meaning. A rule that reads only the signature cannot separate routine from emergency because the difference is location, not event type. Most OT detection content stays flat because it inherits IT logic where one subnet resembles another. On a plant floor, location is everything. Fixing that gap means writing detection that knows which level of process it is watching and what it means when activity crosses a boundary.

The Purdue Model is the operational map for “where” in OT networks. Level 0 is physical process. Level 1 is basic control through PLCs and RTUs. Level 2 is supervisory control through HMIs and SCADA. Level 3 is site operations including historians, alarm servers, and engineering workstations. Level 3.5 is the industrial DMZ, where legitimate cross-boundary pathways are meant to pass. Levels 4 and 5 are enterprise IT.

The model’s core value is vertical consequence. The closer an event sits to Level 0, the closer it sits to physical impact. A detection program that cannot encode that gradient misses the most important variable in industrial risk.

Operational risk depends on level context. An unexpected write command to a Level 3 historian might warrant review. The same write command at Level 1 warrants immediate control-room response. Context sharpens it further. A command from an HMI during a maintenance window can be normal. The same command from the DMZ at 3 a.m. can be urgent.

Flat detection logic cannot make that distinction. It assigns one severity to “unauthorized write” and either floods analysts with false critical alerts or suppresses controller-level danger as routine noise. Location is part of severity, not optional metadata.

If location defines severity, then cross-level movement deserves highest scrutiny. High-value detections focus on boundary violations: enterprise hosts connecting directly to Level 1 controllers, unfamiliar protocol presence on OT segments, new unbaselined links between OT assets, and abnormal data volume across historian replication paths.

In a correctly zoned environment, enterprise-to-controller access should be difficult by design. That is why detecting it quickly is so valuable. In its 2026 Year in Review, Dragos described adversaries reaching OT-hosting infrastructure and stripping operators of visibility and control, activity that boundary-aware programs can catch sooner than signature-only logic.

Purdue-zone-aware detection means each rule is written with explicit level and boundary awareness. One “unauthorized write” becomes multiple detections, each scoped to specific zones, each with level-appropriate severity, expected-good baselines, and response playbooks.

IEC 62443 structures risk through zones and conduits. Detection should mirror that model. The Purdue map defines where systems sit and how traffic should flow, but it does not enforce boundaries on its own. Detection turns the map into an alarm. At lower levels, that alarm content must be safety-reviewed so response logic never pressures operators into destabilizing actions.

If your current rules do not explicitly encode where an event occurs and which line it crosses, a coverage review is a practical first step to close the gap between alerts you receive and alerts the plant floor actually needs.

Sources: IEC 62443, Purdue Model (PERA) and ISA-95, Dragos 2026 OT Cybersecurity Year in Review.