Which of the following is a common indicator of compromise in OT networks?

• A. Unusual PLC/HMI commands
• B. Regular firmware updates to devices
• C. Standard office network traffic
• D. Normal daily backups

Answer: (A)

Unusual PLC or HMI commands are a common indicator of compromise in OT networks because the control system should operate within tightly defined, approved parameters. When you see commands that don't fit the established baseline—unexpected setpoints, new or altered control sequences, rapid changes to actuators, or commands issued at odd times—it signals that someone or something outside normal operations may be manipulating the process. Since PLCs and HMIs directly control physical equipment, such anomalies can indicate attacker activity or malware attempting to alter operations, bypass safety, or conceal their presence.

Regular firmware updates are routine maintenance and are expected parts of keeping devices secure and up to date, not signs of intrusion by themselves. Standard office network traffic is typical IT activity and doesn’t inherently indicate a breach in the OT environment. Normal daily backups are normal protective measures and do not by themselves point to compromise.