What information do you need when an incident affects production—and is it still accessible at that point? In their presentation at our “ Plantvision ” Technology Insight 2026 event, Ann-Sofi Fagerström and Marcus Skymne linked the process industry’s safety efforts with cybersecurity in OT environments. Their shared message was that plant data needs to support the entire process: preventing incidents, providing a basis for decision-making when something happens, and making it possible to understand the cause and prevent a recurrence.
See the impact on production
An incident can begin with an equipment failure, an unintentional action, or a cyberattack. The causes vary, but the consequences can all be addressed in the same control room: loss of situational awareness, disruption to production, or difficulties in safely shutting down the facility. The lecture therefore placed incident preparedness in a broader context than the protection of individual systems. Ultimately, it is also about preventing harm to people and the environment.
Process security and OT security must be considered in conjunction with the operations they are intended to protect. Automation, networks, and physical components all interact in the production process. If they are treated as separate issues, emergency response teams risk overlooking interdependencies that become critical when an incident escalates.
Use data to detect anomalies earlier
The facility already has several sources of relevant information. Control systems, process history, fire and gas detectors, maintenance systems, power supply, and access control systems each contribute different aspects of the situational picture. Changes in pressure, temperature, level, flow, or vibrations can enable operators to take action before an anomaly leads to serious consequences.
Here, predictive maintenance took on a clear safety dimension. Detecting signs of an impending failure can reduce maintenance costs, but also prevent accidents. In the examples from refineries discussed in the lecture, a pump failure can lead to a leak of hot oil under pressure and, consequently, a fire. The same data that supports maintenance work can therefore be crucial for protecting the facility.
On the network side, logs and traffic monitoring serve a similar function. Once the normal state is known, unusual logins and changes in traffic patterns become easier to detect. Mapping assets and communications also provides a basis for segmentation and for identifying vulnerabilities that need to be addressed. The information is valuable both for what it reveals today and for what it helps the organization prepare for.
Practice what happens when you lose sight of the big picture
The presentation highlighted scenario planning as a link between risk analysis and practical preparedness. What events could have the greatest impact on our own facility? What resources are required, how should staff respond, and what is needed to resume production? Process data and knowledge about, for example, stored products can make the scenarios more concrete and support planning in collaboration with emergency services.
The same approach can be applied to cyber incidents. One example was a ransomware attack in the control room: how does the organization respond if the operators can no longer see what is happening? The exercise needs to cover both the technology and the interaction between those responsible for the systems and those responsible for production.
One particularly clear takeaway was to assign responsibility to roles, not to individual people. Emergency preparedness must function even when someone is sick, on vacation, or has left the organization. Roles, lines of communication, and accountability must be clearly defined before an incident requires quick decisions.
Provide control rooms and crisis management teams with a shared situational picture
During an ongoing incident, a great deal of information may be available, but it may not be easy to use. Operators who have to switch between many screens find it more difficult to quickly get an overview. The presentation demonstrated how pre-selected data can be consolidated into a single view for control rooms and emergency response teams.
Such a situational overview can combine an area map with critical process values, camera images, weather information, active alarms, and the status of safety and power systems. The data required depends on the risks associated with the operation. At a facility at risk of a gas leak, wind direction can be critical; in the event of a fire, information about the product and the quantity involved can support the rescue effort. The key is to select the information needed for decision-making, based on the specific needs of your own facility.
Alerts from the OT environment can also contribute to the control room’s overall situational awareness. Operators need to understand the information and know whom to contact, while ensuring that the issue is handled in collaboration with the appropriate specialists. A technical action—such as shutting down a computer—must be evaluated based on its impact on production. Therefore, IT, OT, and operations need to be able to coordinate their decisions.
Laying the Groundwork for a Fresh Start and Learning
Contingency planning must also address the question of where critical information is located during the incident itself. If the data is compromised along with other systems, it becomes more difficult to determine what has happened and when operations can resume. The fact that a system is functioning again does not, in and of itself, answer the question of whether the threat still exists elsewhere.
After an incident, alarm history, process values, operator actions, and communication logs help reconstruct the sequence of events. Together with interviews and other observations, they provide the basis for understanding the root cause. The findings may point to changes in procedures, technical measures, or other improvements. On the cybersecurity front, a similar analysis helps to understand how a threat gained entry, how it spread, and what needs to be addressed before resuming production.
Start with what you need to be able to decide
A concrete next step, based on the takeaways from the lecture, is to select a critical scenario and review what information is required before, during, and after the event. Where is that information located today? Can those in charge access it when the systems are compromised? Who makes which decisions? A joint exercise can highlight both information gaps and unclear lines of responsibility.
The overall message of the lecture was that data, accountability, and collaboration must go hand in hand. The process industry’s experience with risk analysis and emergency preparedness can strengthen efforts in OT security, while network and system information can complement our understanding of the facility. Together, they provide a better foundation for detecting, managing, and learning from incidents.
Would you like to discuss how emergency preparedness works at your facility? We’d be happy to talk further about the situations you want to be better prepared for and the information you need to be able to take action. Get in touch, and we’ll work together to identify where a first step would be most beneficial.