Cyber Physical Security · Information protection When the physical world becomes a digital target
Cyber Physical Security (CPS) protects systems that merge physical infrastructures with computational algorithms. As cyber threats become industrialized, the stakes go far beyond data: entire power plants, production lines, and lives are at risk.
- Since 1991International ICS
- OT / ITSecure convergence
- R226Classified equipment
- TSCM + cyberIn one operation
A cyber-physical systemIntrusion
- Business ITIT
- SupervisionSCADA
- ControllersPLC
- Sensors and actuatorsOT
- Physical process
Cyber Physical Security: definition
Cyber Physical Security, also called Cyber Physical Systems Security (sometimes shortened to CPSSEC), protects the devices and networks that link the physical world to computing resources.
A cyber-physical system measures, decides and acts: a sensor reads a value, a controller processes it, an actuator opens a valve, stops a motor or unlocks a door.
The difference with conventional cybersecurity fits in one sentence: here, an attack does not stop at stealing or encrypting data. It halts a line, falsifies a measurement, opens an access. And it can travel through the network as well as through the device itself, a cable or a radio wave.
Three layers to protect
- The networkLinks between business IT and industrial OT, remote access, wireless links.
- The equipmentControllers, sensors, actuators, supervision workstations, connected building devices.
- The physical environmentPremises, cabinets, cables, radio and electromagnetic emissions: what a network audit cannot see.
International ICS also uses the term for the integrated protection of an organisation against espionage that combines physical vectors (microphones, cameras, transmitters) and digital ones (spyware, network intrusions). Both meanings converge: threats no longer separate the physical from the digital.
The Cyber Physical Security approach of International ICSThe risks to CPS information protection
Cyber-physical systems create an unprecedented attack surface where a digital intrusion can trigger catastrophic physical consequences. Here are the critical risks to master.
01 / Critical threat
Ransomware on critical infrastructure
Ransomware attacks are no longer limited to data. They can paralyze power plants, water networks, or industrial production lines, putting entire populations at risk. Cyber ICS security is your first line of defense.
02 / Espionage
Industrial espionage via CPS sensors
Compromised sensors or physical implants can exfiltrate production data, trade secrets, or strategic plans in real time. Industrial espionage now specifically targets OT/ICS environments through increasingly sophisticated vectors.
03 / Physical sabotage
Industrial control system (ICS) sabotage
An attack on an industrial control system can cause equipment failures, explosions, or irreversible environmental damage. IT/OT convergence opens attack vectors that traditional security tools cannot detect.
04 / Interception
Communications interception & manipulation
Legacy industrial protocols without encryption are prime targets. Man-in-the-middle attacks on OT networks allow control commands to be altered without operators noticing. TSCM operations detect these hidden devices.
05 / GPS spoofing
GPS spoofing & navigation manipulation
Smart transportation systems, industrial drones and autonomous vehicles are vulnerable to GPS signal falsification. This technique can hijack or sabotage critical equipment remotely without leaving obvious digital traces.
06 / Supply chain
Supply chain compromise
Malicious components integrated during manufacturing or maintenance can create persistent backdoors in cyber-physical systems. Detecting these threats requires an approach combining digital audits and physical countermeasures like TSCM.
Three vectors that network audits do not see
They come up again and again in the analyses published by International ICS. None of them relies on a conventional software flaw.
- Building sensors
A building management unit fixed to the ceiling, permanently powered and connected to the network, is an ideal hiding place for a microphone.
The cyber-physical threat of BMS sensors - Equipment emissions
A screen, a video cable or a keyboard radiate. Researchers have shown that an air-gapped workstation can leak its data through its video cable.
Stealth pixels (TrojPix) and air-gapped networksPassive TEMPEST espionage - Out-of-band signals
A sensor can be fooled by a signal it is not meant to measure. A simple laser is enough to trigger a false motion on an infrared detector.
The hidden vulnerability of sensorsA laser triggers false motion
Which systems are concerned by CPS?
Operational Technology (OT)
Systems that monitor and control physical devices and processes in industries like manufacturing, energy, and transportation.
Industrial Control Systems (ICS)
SCADA, DCS and PLCs that drive critical infrastructure and production lines, forming the backbone of industrial operations.
IIoT (Industrial Internet of Things)
Massive networks of interconnected sensors and actuators that dramatically increase the attack surface in industrial environments.
Smart grids & smart buildings
Intelligent power grids and building management systems (BMS) integrating HVAC, access control, security and lighting.
Connected medical devices
Pacemakers, infusion pumps, patient monitors: a cyberattack on these devices can directly endanger human lives.
Smart transportation & robotics
Autonomous vehicles, traffic control systems, industrial robots whose security directly conditions the physical safety of operators.
CPS vs IoT: a fundamental distinction
An IoT device collects and transmits data with limited control over the physical environment: a smart thermostat is the classic example. It is primarily concerned with connectivity and monitoring.
A cyber-physical system goes much further: it processes data in real time and physically acts on its environment. A self-driving car, a robotic arm, or a remotely controlled turbine are CPS. The digital decision has immediate physical consequences.
This added complexity creates radically different risks. A software bug in a CPS doesn’t corrupt a file, it can trigger an industrial accident.
Critical pointThe majority of CPS systems were designed before cybersecurity became an imperative. They operate in environments that were never intended for interconnected networks, creating structural vulnerabilities that are difficult to address without production downtime.
| Criterion | IT | OT | IoT | CPS |
|---|---|---|---|---|
| Role | Process information | Run a process | Collect and transmit | Measure, decide, act |
| Priority | Confidentiality | Availability | Connectivity | Safety of people and continuity |
| Example | Email, business software | Controller, SCADA | Smart thermostat | Industrial robot, autonomous vehicle |
| Effect of an attack | Data leak or loss | Production stoppage | Exposed data, pivot into the network | Immediate physical consequence |
TSCM & Cyber Physical Security: the missing link
Cyber Physical Security cannot be limited to digital defenses alone. TSCM operations (Technical Surveillance Countermeasures) form the essential physical component of any robust CPS strategy.
In critical industrial environments, surveillance or eavesdropping devices hidden in equipment, control rooms or OT networks can serve as attack vectors completely invisible to traditional cyber tools. A physical implant in a programmable controller completely evades a software vulnerability scan.
International ICS combines TSCM and Cyber ICS expertise to deliver 360° protection for your cyber-physical systems: from detecting physical espionage devices to securing industrial communication protocols.
Discover International ICS TSCM operationsClandestine device detection
RF sweeping, thermal analysis and physical inspection of equipment to detect any implant or listening device concealed in industrial facilities.
Electromagnetic emissions analysis
Identification of information leaks via side channels (TEMPEST) in OT/ICS environments, a little-known but critically exploited vector by state-level threat actors.
Physical OT network security
Audit of physical connections, maintenance ports and unauthorized access points to OT network infrastructure, complementing ICS cybersecurity.
Industrial counter-espionage
Protection against industrial espionage targeting manufacturing secrets, R&D plans and production data via compromised sensors or hidden microphones.
What a TSCM operation takes
The benchmarks published by International ICS for an operation covering 200 m². They show the scale of the actual work.
- 10 kHz to 24 GHzRadio spectrum swept, and beyond
- 3 expertsOn site, at least
- 80 kgOf equipment approximately, R226 classified
- 6 to 9 hOn site, followed by an illustrated report
A passive microphone or a standalone recorder emits nothing: radio sweeping will not find them, only dismantling and physical inspection will. RJ45 cables and optical fibre are checked as well.
- Radio monitoringOperators on site, or a device designed by International ICS and left in place, watch the radio spectrum, Wi-Fi and Bluetooth. The analysis is AI-assisted and validated by an operator.Radio monitoring and spectrum analysis
- Smartphone analysisAn infected phone is a microphone and a camera in every meeting. The analysis takes at least 24 hours, on International ICS premises.Mobile forensic analysis
- The means of an operationThree operators, 80 kg of equipment, an illustrated report: objective criteria to assess a service before ordering it.Demand means, not promises
Securing a cyber-physical system in four phases
This is the sequence International ICS follows for every assignment, whatever its scope.
Assess the threat
A confidential interview: who may target you, what must be protected, the history of the premises. The scope of the operation follows from it.
Check the physical layer and the airwaves
A full TSCM operation: radio spectrum, physical inspection, acoustic and optical search, passive devices and power-line carriers. With R226 classified equipment, outside staff hours.
Audit the digital layer
Wired and wireless networks, targeted penetration tests, workstations and servers, mobile forensic analysis. The aim is to find exploitable flaws, active compromises and exfiltration channels.
Report and remediate
A report details each analysis, the vulnerabilities found and the corrections to carry out first. It can be used in legal or regulatory proceedings.
Understanding the stakes of Cyber Physical Security
Cyber Physical Security: Risks & Solutions. CPS threat landscape and protection methods by International ICS experts. The video is loaded from YouTube on click.
The challenges of cyber-physical security
Securing cyber-physical systems demands going beyond traditional IT approaches. Here are the structural obstacles every organization faces.
Challenge 01
Security-by-design gaps
The vast majority of industrial systems were designed in isolated environments without built-in cybersecurity. Retroactive upgrades are costly and often impossible without production downtime.
Challenge 02
Conflicting IT/OT priorities
IT teams prioritize data confidentiality; OT teams emphasize system availability. These opposing priorities create blind spots in the security strategy, exploitable by sophisticated adversaries.
Challenge 03
Heterogeneous protocols & interoperability
CPS environments mix equipment from different generations using incompatible proprietary protocols. Maintaining security in this fragmented ecosystem requires highly specialized technical expertise.
Challenge 04
Real-time data processing constraints
Cyber-physical systems operate with latency constraints incompatible with certain traditional security solutions. Any processing delay can lead to incorrect decisions with immediate physical consequences.
Challenge 05
Legacy system vulnerability management
The coexistence of modern equipment and aging systems creates a mosaic of vulnerabilities difficult to map and remediate. Patch management in OT environments requires careful planning to avoid production interruptions.
Challenge 06
Evolving regulatory compliance
NIS2, IEC 62443, NERC CIP: regulatory requirements for critical infrastructure cybersecurity are tightening. Continuous compliance demands resources and expertise that few organizations have in-house.
- NIS 2European directive: risk management and incident reporting for essential and important entities.
- DORAEuropean regulation on digital operational resilience for the financial sector.
- IEC 62443Series of international standards for the security of industrial automation and control systems.
- NERC CIPNorth American standards for the protection of the bulk electric system infrastructure.
International ICS operations end with a documented report that can be used to meet NIS 2 and DORA obligations. Learn more.
International ICSInformation protection
Information protection at the industrial level
International ICS is Europe’s leading expert in information protection for cyber-physical and industrial environments. Their unique approach combines Cyber ICS expertise, field TSCM operations, and intelligence against industrial espionage.
Unlike purely IT-focused approaches, International ICS integrates the physical dimension of security (clandestine device detection, RF emissions auditing, industrial perimeter hardening) with deep expertise in industrial control systems cybersecurity.
For organizations managing critical infrastructures, sensitive production sites, or environments where compromise would have physical consequences, International ICS is the indispensable partner in Europe.
- Founded in 1991
- R226 classified equipment, SGDSN/ANSSI authorisations
- Listed on Cybermalveillance.gouv.fr
- UNGM supplier no. 1080713, United Nations
- First in Europe to integrate cyber into TSCM operations in the private sector
- Operations in France and internationally
International ICS services
- Cyber Physical Security
- Cyber ICS: cyber audit
- TSCM operation
- Mobile forensic analysis
- Radio monitoring
- Industrial espionage
- The strategists
- The company
Who it is for
- Strategic and defence industries
- Large groups and mid-caps
- Institutions
- Law and business firms
- Exposed executives
Ten terms to find your way
The acronyms of the field, in one sentence each. Full definitions are in the International ICS glossary (in French).
- CPS cyber-physical system
- A system where a computation drives a physical effect: robot, turbine, pump, door. Glossary
- OT Operational Technology
- The computing that runs machines, as opposed to IT, which handles information. Glossary
- ICS Industrial Control System
- All the equipment that controls an industrial process. Not to be confused with International ICS, the company.
- SCADA supervision
- Software that displays the state of an installation and relays the operators’ commands.
- PLC programmable logic controller
- An industrial computer that runs, in a loop, the control logic of a machine.
- IIoT Industrial Internet of Things
- Sensors and connected devices deployed in industrial settings. Glossary
- BMS building management system
- The network that runs the heating, ventilation, lighting and access control of a building. Glossary
- TEMPEST
- The study of unintentional emissions from equipment, from which what they process can be reconstructed. Glossary
- Air gap isolated network
- Physical isolation of a network, with no link to the outside. Glossary
- TSCM technical surveillance countermeasures
- The search for eavesdropping and capture devices in premises, a vehicle or a piece of equipment. Glossary
FAQ: Cyber Physical Security
Essential questions about CPS, information protection risks, and available solutions.
What is Cyber Physical Security (CPS)?
Cyber Physical Security (CPSSEC) encompasses all measures designed to protect systems that merge computational algorithms with physical processes. These systems monitor, control and optimize real-world activities (power plants, production lines, transport networks, medical devices) in critical sectors. A security failure can have direct and severe physical consequences, making CPS fundamentally different from traditional IT security.
What are the main risks of cyber-physical systems?
Key CPS risks include ransomware attacks on critical infrastructure, sabotage of industrial control systems (ICS), industrial espionage via compromised sensors, GPS spoofing attacks, and physical intrusions combined with cyberattacks. These threats can cause significant material, human, and economic damage, and unlike pure data breaches, they can directly harm people.
What is the difference between a CPS and an IoT device?
A cyber-physical system (CPS) integrates computation, control, and physical processes to act on the environment in real time, like a self-driving car or an industrial robot. An IoT device primarily collects and transmits data with limited physical control, like a smart thermostat. CPS have far greater complexity and physical interaction, with significantly higher security risks: a bug doesn’t just corrupt data, it can trigger real-world accidents.
What is a TSCM operation and how does it relate to CPS security?
TSCM (Technical Surveillance Countermeasures) operations detect and neutralize listening devices, surveillance or espionage equipment hidden in premises or hardware. In the CPS context, TSCM is essential because compromised sensors or physical implants in industrial controllers can serve as attack vectors completely invisible to traditional cyber tools. International ICS provides specialized TSCM operations specifically designed for OT/ICS environments.
How can organizations protect industrial systems against espionage?
Protection against industrial espionage in a cyber-physical context requires a multilayer approach: regular physical and digital security audits, TSCM operations to detect surveillance devices, OT/IT network segmentation, continuous network and behavioral anomaly monitoring, and staff training. International ICS provides organizations with combined expertise in Cyber ICS and industrial counter-espionage.
Which sectors are most exposed to CPS security risks?
The most exposed sectors are energy (smart grids, nuclear and thermal power plants), manufacturing (ICS, robotics, smart manufacturing), healthcare (connected medical devices), transportation (autonomous systems, traffic management), smart buildings (BMS), and water infrastructure. A successful attack in these sectors can have serious physical consequences for populations and create major economic disruptions.
Is a network isolated from the Internet enough to protect an industrial system?
No. Isolation protects against remote attacks, not against what happens on site. Equipment radiates: screen, video cable, keyboard. Research has shown that an air-gapped workstation can leak its data through these emissions. And a device planted during a maintenance visit does not need the network. An isolated site must therefore also be checked physically.
Further reading (in French): passive TEMPEST espionage and stealth pixels (TrojPix).
Does Cyber Physical Security also concern office buildings?
Yes. An office building is run by a building management system (BMS): heating, ventilation, lighting, access control, fire detection. Add cameras, video conferencing and connected devices. Each of these is permanently powered and connected to the network: both an entry point and a possible hiding place for a microphone.
Further reading (in French): the cyber-physical threat of BMS sensors.
Does Cyber Physical Security help with NIS 2 and DORA?
It contributes to it. The NIS 2 directive requires the entities concerned to manage their risks and report their incidents; the DORA regulation imposes digital operational resilience on the financial sector. International ICS operations end with a documented report that can be used in these processes.
Why choose International ICS for CPS security in Europe?
International ICS is Europe’s leader in information protection and cyber-physical security. Their expertise covers Cyber ICS, TSCM operations, industrial espionage protection, and critical infrastructure security. Their unique approach combines both physical and digital dimensions of security, where most actors only cover one.
The company, founded in 1991, works with R226 classified equipment and is listed on Cybermalveillance.gouv.fr.
Cyber Physical Security news
The latest articles and analyses published by International ICS experts on cyber-physical systems security. Articles are in French.
La menace cyber-physique des capteurs BMS : le nouveau terrain de jeu du contre-espionnage
Read the article
Piratage Find My iPhone : la faille de sécurité qui transforme votre iPhone en cible parfaite
Read the article
Pixels furtifs (TrojPix) et émissions électromagnétiques : le nouveau vecteur contre les réseaux air‑gapped
Read the article
ICS et cybersécurité OT : comprendre les enjeux du DFIR
Read the article
Dashcams connectées : un risque sous-estimé
Read the article
Cyber Physical Systems Security : la vulnérabilité cachée des capteurs
Read the articleFurther reading on international-ics.com (in French)
- Passive TEMPEST espionage: why your screens and cables betray your secrets
- IoT security: a simple laser triggers false motion
- Drone security: a major MAVLink flaw
- Video conferencing: a discreet flaw exposes your actions in real time
- Android Auto: the discreet flaw that exposes information protection
- Espionage through RJ45 cables: an invisible threat
- International ICS, European pioneer of TSCM integrating cyber
- Is your office bugged? The 7 warning signs
An industrial site, a control room or a sensitive building to have checked?
International ICS operates in France and internationally, in complete confidentiality.