Supervisory Control Testing, Remote Access Validation, and Engineering Workstation Review

SCADA Security Testing Under Your Operators' Safety Rules

An HMI, a historian and an engineering workstation decide who can watch the process and who can change it, yet office network testing treats them like any other server. A Global Digital Forensics SCADA test proves whether an operator account can open engineering functions, whether a vendor session closes when the ticket does, and whether a compromised historian can reach back into the control zone. Our specialists work from configuration and passive evidence first, run every active check on a replica or inside a window your engineers approve, and stop the moment your operator calls it.

Scope Your Assessment Call (800) 868-8189

Water treatment and electrical utility infrastructure.

Testing Built for the Screens That Drive the Process

Supervisory control and data acquisition sits between your operators and the remote equipment, and it is where an intruder who wants to move a valve or hide an alarm will aim. Enterprise testing tools were never designed for it: an aggressive scan can freeze an HMI, flood a historian or drop a polling cycle to the field. We test the supervisory layer as it is actually deployed, with the access that actually exists, inside limits your operations team writes down before we begin.

Plant managers, CISOs and internal auditors usually call at a predictable moment: a supervisory platform upgrade, a vendor access review, a suspicion that someone holds more control permission than they should, or an assessment finding that now needs proof. Before any testing starts we agree the systems in scope, the operating windows, the excluded actions and the person who can say stop.

HMIs and Engineering Workstations
We test whether the operator screens and the stations that rewrite controller logic are truly separated, and whether an operator login can launch engineering tools.
Historians and Data Brokers
We follow the servers that carry process data to the business and prove whether traffic can travel back the other way into the control zone.
Vendor and Remote Sessions
We trace VPNs, jump hosts and support tools from request and approval through multifactor checks, session recording and shutdown.

Scope Your Assessment

From Operator Login to Engineering Control

The human machine interface is the screen an operator uses to watch and drive the process. The engineering workstation is a different machine with a different job: it configures the system and rewrites controller programs, so a compromise there reaches programming functions far beyond the operator view. The historian stores process data and usually feeds business applications, which makes it a bridge between the control network and the enterprise, and bridges carry traffic both ways.

We test how access to those functions is separated. That means proving whether a routine operator account can open engineering tools, how vendor support is requested, approved and logged, which accounts and services span the supervisory and enterprise networks, and whether the logs can say who made a change and when. An HMI that launches the engineering tool with the operator's own credentials is a finding, and a common one.

Want to know whether an operator account at your site can reach engineering functions? Call (800) 868-8189 and a specialist will explain how we prove it, starting from configuration records and a test instance.

The Protocol Name Tells You Nothing About the Deployment

Knowing that a site runs Modbus TCP, DNP3, EtherNet/IP, OPC UA or IEC 61850 says nothing about whether commands are authenticated on that installation or whether privileged functions are restricted. Protocols differ in the protections they can support, and deployments differ in the protections someone actually turned on, so we examine the device, the software version, the configuration and the surrounding controls together.

Configuration review and passive observation answer most questions before an active check is proposed. When active proof is warranted, it is limited to approved targets and methods inside a window your engineers choose, and the operator can halt it at any moment. Take a vendor support account that is supposed to be view only: on a test instance we show that the same account opens a configuration function, then document the permission, the access it required and the production comparison your engineers need to confirm it.

Sometimes a test shows that someone got there first, through a login nobody recognizes or ladder logic that has drifted from the last approved copy. We halt that line of testing, notify the contact named in the rules of engagement and secure the records, and our 24/7 OT, ICS and SCADA incident response team takes it from there.

Methodology

Four Stages From Stop Authority to Retest

01 / Stop Authority and Test Boundaries

We agree the process owners, operating windows, excluded actions, stop conditions, communications plan and recovery support before anyone connects a laptop.
02 / Passive Baseline of the Supervisory Layer

We map supervisory assets, protocols, zones, remote paths and normal communications from existing records, configuration exports and approved captures.
03 / Active Proof, One Named Target at a Time

Operator approved checks run in a laboratory, on a replica or in a controlled production window chosen to fit the process risk, and your operator can halt any step.
04 / Consequence Ranked Fixes and Retest

Each weakness is tied to the paths that reach it, its process consequence and a maintenance plan the plant can schedule, and we retest the fixes once they are in place.

Evidence we examine

Send the sites, the control systems and the windows you can offer, and a senior assessor will propose the scope.

Records Behind Every SCADA Finding

Passive network and flow records show which assets talk, over which protocols and across which zones. Asset, firmware and configuration inventories, firewall rules and remote access and identity records show what the architecture allows. HMI, historian and engineering workstation logs show what people and services actually did, controller logic and approved backups give a reference for unexplained changes, and operating procedures and recovery plans tell us what the plant can tolerate while we work.

What you receive

A Fix List Engineering Can Schedule

An asset and trust path map of the supervisory environment, a record of every operator approved validation and its conditions, findings ranked by process consequence, and a remediation, maintenance and retest plan. Management reads which weaknesses could affect supervisory access or the operating record and in what order to fund the fixes; engineering gets the configuration and test detail to make them.

If you need a controlled exploit path rather than a configuration finding, ICS penetration testing extends this work under the same operator approvals.

Call (800) 868-8189 or request a free consultation to plan this work around your operation.

Choose the Depth the Plant Can Support

Configuration and access review

Exports, rule sets, role definitions and remote access records, reviewed without a single packet sent to the control network. It is the right start for a platform upgrade or a vendor access review, and it often answers the board's question on its own.

Supervisory test on a replica or in a window

Operator approved checks against HMIs, historians, engineering workstations and remote access paths, run on a spare system where one exists or inside a production window your engineers choose. Every difference between the spare and production is recorded before a conclusion carries across.

Full industrial attack path testing

When the question is whether an intruder could get from the business network to the controllers, ICS penetration testing follows authorized attack paths across the wider plant, and OT, ICS and SCADA security assessments cover architecture, access and recovery across every site.

Not sure which depth fits your next maintenance cycle? A senior specialist will recommend one on the first call.

Scope Your Assessment

Findings Built for the Boardroom and the Courtroom

Every operator approved validation leaves a written record of the target, the method, the window, who approved it and how the system responded, and that record is what a board or a regulator can check line by line. It is the discipline Global Digital Forensics has applied since 1992 and that our examiners bring to testimony in federal and state courts. Founder Joseph Caruso, CISSP, has worked in technology since 1980, from real time transaction systems to cybersecurity incident response. Meet the team.

Technical methods and scope

Test the Supervisory System as a Connected Whole

The test boundary can include engineering workstations, historians, domain and identity services, remote access, data brokers, firewalls, field gateways, controllers and the paths that connect them. The scope map identifies which systems can affect supervision or control and which business services can reach them.

Operators identify the critical functions, the known fragile assets, the approved windows, the prohibited commands, the safe proof conditions and the recovery contacts, and the work uses passive and configuration evidence before any active test is considered.

Passive Observation and Configuration Review

Passive analysis characterizes protocols, communicating assets, unexpected paths, cleartext services, remote sessions and deviations from the documented architecture without sending a probe to a field device. Configuration review covers firewall rules, identity boundaries, service accounts, workstation hardening, backups, project file controls and vendor access settings.

The report records sensor placement, the capture period, any dropped traffic and the systems that stayed quiet during observation, so your engineers know exactly what the baseline covers.

Call (800) 868-8189 or request a scoping call to plan the assessment around production.

Controlled Validation

Operator approved validation confirms whether a documented rule is enforced, whether an unauthorized identity can reach a function, whether a jump host restricts file transfer or whether a test account can exceed its role. Controller writes, command replay, flooding and denial of service checks belong on a laboratory bench, a test instance or a hardware in the loop rig, not on the plant floor.

Digital twins and replicas support deeper work, and each result from one carries the configuration and firmware comparison that shows how far it applies to production.

Remote Access, Segmentation and Engineering Controls

Testing follows plausible paths through VPNs, vendor tools, jump servers, dual homed hosts, historian connections and shared identity services, and assesses least privilege, multifactor authentication, session approval, logging, file transfer, credential lifecycle and network enforcement along each one. Engineering project files and controller logic are reviewed under change control, because an unexplained change can matter more than a network vulnerability.

Describe the plant and the constraints your operators set and the first call plans the work around them.

Findings the Operations Team Can Use

Each reported issue connects the evidence to an affected asset, the access it required, the process consequence and a realistic treatment. Deliverables can include an asset and trust path map, configuration findings, the controlled test record, a consequence ranked remediation plan and retest results, with a framework mapping when you name the framework and version.

Want the evidence organized against a specific framework? Name the framework and version when you scope the test.

Show Us the Supervisory Layer Before an Attacker Finds It

Tell us the supervisory platforms, the remote sites, the vendor access paths and the windows your plant can give. A senior SCADA test lead will walk you through the recommended testing depth, the methods that fit those windows, the timeline and the pricing on the first call, and that consultation is free.

Scope Your Assessment Call (800) 868-8189

If ranking what you find is the harder problem, OT vulnerability management turns test results into an operating backlog, and an OT network assessment covers the wider plant network.

Free planning tools

Download the Readiness Workbook for the Scoping Call

A SCADA scoping call moves faster when the operations lead arrives with the inventory and the rules already drafted. Our OT Preparation Kit, the OT Security Readiness checklist with its CSV workbook, covers supervisory assets, zones and conduits, per asset method restrictions, remote vendor dependencies and the stop and resumption authority your plant signs before testing.

OT Preparation Kit

Inventory, boundary and rules of engagement worksheets for the supervisory layer.

Format: ZIP containing a printable HTML checklist and a CSV workbook.

Download the OT Preparation Kit (ZIP)

Read the readiness checklist online
OT Security Assessment Preparation Checklist

Process scope, system inventory, access records and operating constraints to gather before the test team arrives.

Format: PDF, also readable online.

Download the Review Checklist (PDF)

Read the assessment preparation checklist online

Planning a wider program? The OT assessment planning library holds the sector packs and project workbook, and our guide to non disruptive SCADA and OT security testing explains the reasoning behind the stop rules.

Frequently asked

Send the sites, the control systems and the windows you can offer, and a senior assessor will propose the scope.

Spare Systems, Standards and Plant Scheduling

Is SCADA testing the same as an ICS penetration test?

They overlap. SCADA security testing focuses on the supervisory functions, the HMIs, historians, engineering workstations and remote access paths, and the controls around them. An ICS penetration test follows authorized attack paths across the broader industrial environment. Many operators start with the first and move to the second.

Can testing use a spare system?

Yes, and for disruptive checks we prefer it. We record every difference from production, including firmware, configuration, patch level and network position, before a conclusion from the spare is applied to the live system.

Can the results support NERC CIP, AWIA or ISA/IEC 62443 work?

Yes. When you name the framework and the version, we map each finding to it, and the evidence package is organized so your compliance team and auditors can follow it requirement by requirement.

What should we define before this work begins?

The supervisory servers, HMIs, historians, engineering workstations, communications and remote access paths in scope, plus operator involvement, the permitted test windows and the person who can say stop. The OT Preparation Kit above walks through each one.

How is work planned around plant operations?

Safety requirements, methods and operating windows are agreed with your engineers first. Any active testing is then scoped target by target, with stop conditions and recovery support written down before it starts.

What access and information are needed?

Network diagrams, asset and firmware information, configuration exports and the remote access arrangements. We define the access and the evidence we need during scoping and ask for nothing beyond it.

How do we agree on deliverables?

We settle who reads the report, its format, the remediation order and the retest before work starts, so there are no surprises at delivery.

Scope your SCADA test

What the Scoping Call Settles Before a Test

Leave a name and the best way to reach you. A SCADA test lead replies to set up the scoping conversation, and nothing sensitive belongs in this form.

Since 1992 · 24/7 hotline · Testified in federal and state courts

Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed November 3, 2026.

SCADA Security Testing Under Your Operators' Safety Rules

Testing Built for the Screens That Drive the Process

HMIs and Engineering Workstations

Historians and Data Brokers

Vendor and Remote Sessions