Industrial companies have long used hazard and operability analysis (HAZOP) and layers of protection analysis (LOPA) to understand process safety risks. These studies look at how a process could fail and whether existing safeguards would keep that failure from becoming a serious incident.
Recent attacks on U.S. water systems show why cyberattacks belong in this conversation. In July 2026, CISA observed malicious cyber activity targeting more than 100 internet-exposed U.S. water and wastewater systems.
Attackers remotely accessed internet-facing programmable logic controllers and changed device configurations, causing utilities to lose monitoring or control. Federal agencies also reported operational effects including pressure loss and flooding and warned that pressure loss could allow untreated groundwater to enter water pipes.
Traditional HAZOP studies primarily consider process deviations arising from equipment failure, operating conditions and human error. Cyber HAZOP extends the analysis to deliberate manipulation through cyberattack.
For CISOs and security leaders in industrial settings, a weak password, exposed remote connection or vulnerable controller matters much more when they can see what it could do to a process: cut water pressure, push equipment outside a safe operating range or prevent a protective shutdown when it’s needed.
When cybersecurity weaknesses reach a physical process
The consequences aren’t theoretical, and water systems aren’t the only example.
TRITON showed what can happen when attackers reach an industrial safety system. Attackers took remote control of a connected workstation and tried to reprogram its controllers. Some controllers entered fail-safe mode and shut down related processes, helping expose the intrusion. But the attack demonstrated a much more troubling possibility: an attacker had reached the system designed to shut down an industrial process when operating conditions become unsafe.
Separately, Stuxnet targeted control systems at Iran’s Natanz uranium-enrichment facility. The malware repeatedly changed centrifuge speeds, at one point pushing them close to the mechanical limits of their rotors and later slowing them dramatically. Researchers also found that Stuxnet suppressed warning and safety controls that could have alerted operators to the speed changes.
In Honeywell’s 2026 OT Cybersecurity Benchmark Report, 64% of the 603 security, risk and operations leaders surveyed say a significant OT cybersecurity incident could have a severe or high impact on physical equipment and worker or customer safety.
Unsecured pathways can produce serious consequences. An attacker could abuse a maintenance function to bypass a protective control, leaving the process without that layer of protection. Changing sensor or actuator ranges could leave operators working from false information. Malicious safety-system configuration changes could go unnoticed until a legitimate update applies them.
Cyber HAZOP is designed to identify how a cyberattack could cause a process hazard and what consequences could follow before a real incident does.
Connect cybersecurity findings to operational priorities
A vulnerability assessment can identify a weakness. Penetration testing can show whether an attacker can exploit it. Cyber HAZOP adds the question security leaders ultimately need answered: What could happen to the process if the attack succeeds?
Understanding the implications can change where a finding belongs on the remediation priority list. An exposed engineering system may look like a generic access-control problem. But if compromising it could disable a safety interlock or change shutdown logic, the risk extends far beyond the network.
According to Honeywell experts, on average, 50% of the process-loss scenarios they analyzed could be caused by intentional cyberattacks. And 98% of the scenarios that could lead to fatalities involved an attack on the safety instrumented system.
Cyber HAZOP insights like these can impact security priorities. Lesser technical weaknesses can be more accurately rated as severe or urgent if they could lead to a safety system shutdown, or leave equipment operating beyond safe limits. That’s what makes Cyber HAZOP valuable for process safety management and cyber investment planning alike.
Honeywell uses semi-quantitative analysis linked to the customer’s existing process safety risk matrix, weighing likelihood against potential process consequences. That gives teams a clearer basis for deciding what to fix first.
Reassess risk when industrial systems change
Industrial systems have become more connected over time. Safety systems once isolated on serial connections increasingly use Ethernet and connect to broader control networks. In some plants, systems once kept separate even share an engineering workstation.
That convenience can create a new attack path. A workstation once isolated from a safety function may now provide a route toward sensors and actuators controlling the process.
That’s why greenfield projects, new SCADA deployments, major upgrades and architecture changes are important points to assess or revisit Cyber HAZOP. A prior risk study may still describe the process correctly while missing a cyber pathway that didn’t exist when it was conducted.
Process safety management programs and compliance requirements today favor recurring reviews. In the United States, OSHA requires process hazard analyses for covered processes to be updated and revalidated at least every five years.
International standards and guidance also reinforce structured cybersecurity risk assessment. ANSI/ISA-62443-3-2-2020 addresses security risk assessment for industrial automation and control system design. ISA-TR84.00.09-2024 Part 1 provides guidance for integrating cybersecurity into the safety lifecycle of process safety controls, alarms and interlocks.
In addition, insurance requirements can add a reason to revisit risk. Organizations may need to demonstrate that cybersecurity exposure has been assessed against the operational consequences it could cause, especially after updates to systems or processes.
Honeywell connects cybersecurity and industrial process safety
Honeywell was first to market with Cyber HAZOP and developed a patented methodology that combines OT cybersecurity, process safety management and industrial operations expertise. Using proprietary tooling, Honeywell evaluates more than 500 cyberattack scenarios against customer risk criteria and considers both cybersecurity controls and the process safeguards intended to limit an attack’s consequences.
For CISOs, that means prioritizing findings based on what an attack could actually do to the process, including when a safeguard itself could be compromised.
GovInfoSecurity. Attackers Targeted Over 100 US Water Systems in July Hacks. Chris Riotta, August 26, 2026.
Federal Bureau of Investigation and U.S. Environmental Protection Agency. “Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing Programmable Logic Controllers, Causing Operational Disruptions.” Public service announcement, July 30, 2026.
The Guardian. “Triton: hackers take out safety systems in ‘watershed’ attack on energy plant.” News report by Samuel Gibbs, December 15, 2017.
WIRED. “Report Strengthens Suspicions That Stuxnet Sabotaged Iran’s Nuclear Plant.” News report by Kim Zetter, December 27, 2010.
Honeywell Technologies. 2026 OT Cybersecurity Benchmark Report, 2026.
Mary Sebastin and Saltanat Mashirova. “A specialised approach to assessing cyber-physical risks.” Hydrocarbon Engineering, April 2024. Assessment observations based on data collected and analyzed by Honeywell OT Cybersecurity Operations in 2023.
U.S. Department of Labor, Occupational Safety and Health Administration. “Process Safety Management of Highly Hazardous Chemicals.” 29 CFR 1910.119(e)(6), accessed August 27, 2026.
International Society of Automation. “ANSI/ISA-62443-3-2-2020, Security for Industrial Automation and Control Systems – Part 3-2: Security Risk Assessment for System Design.” Standard, 2020.
International Society of Automation. “ISA-TR84.00.09-2024 – Part 1, Cybersecurity Related to the Safety Lifecycle.” Technical report, 2024.
