Cybersecurity in Industry: Securing Critical Systems in a Digital Age

As industries grow increasingly automated and interconnected, cybersecurity and industrial safety have become inseparable. In the module “Cybersecurity in Industry – Security of OT and Cyber-Physical Systems”, Professor Paolo Trucco sheds light on why safeguarding safety-critical and mission-critical systems is more urgent than ever.

The stakes are high

From energy plants to transport networks and healthcare infrastructure, modern industrial systems are no longer isolated machines—they are cyber-physical networks where a cyberattack can translate directly into physical danger.

“Cybersecurity and safety go hand in hand,” says Professor Trucco. “In sectors where failures can affect employees, the public, or the environment, the consequences of an attack are not just technical—they are societal and economic.”

Bridging IT and OT

One of the challenges in industrial cybersecurity lies in the convergence of Information Technology (IT) and Operational Technology (OT). IT systems prioritize confidentiality, while OT systems prioritize availability and integrity, because downtime or errors can be dangerous.

OT systems are also built to last decades, meaning they cannot be frequently updated like IT networks. Cultural differences further complicate the picture: while cybersecurity is well-established in IT, it is still emerging among industrial safety engineers. Despite these differences, the two domains must work together across the entire system lifecycle—from design to decommissioning.

Learning from the frontlines

The module takes students deep into safety-critical and mission-critical systems, including:

• Process industries
• Energy systems
• Transport infrastructure
• Healthcare
• Finance and essential services

Students examine real-world cases, perform risk assessments, and hear directly from industry professionals, such as gas network operators and major banks.

Interactive exercises include business simulations of cyberattacks, where students design continuity plans for manufacturing operations and essential services, experiencing firsthand how decisions in cybersecurity can ripple across industries.

Cyber incidents as lessons

The curriculum also explores landmark cyber incidents such as Stuxnet and Triton. Triton, notably, targeted industrial safety systems, not for espionage but to create unsafe operational conditions.

“These cases show that cyberattacks are not just about data—they can directly jeopardize lives,” says Professor Trucco. “Understanding past incidents is critical for preparing students to anticipate and mitigate future threats.”

Equipping students for the future

By the end of the module, students develop:

• A systemic mindset, connecting physical, cyber, and organizational layers
• Hands-on skills in risk analysis and mitigation for cyber-physical systems
• Knowledge of regulations like NIS 2 and the Cyber Resilience Act
• Exposure to emerging technologies such as quantum cryptography and remote surgical robotics

Through practical exercises and final projects, students learn to frame complex problems and implement solutions in safety-critical environments, preparing them to navigate the intricate intersection of cybersecurity, industrial operations, and public safety.

Why it matters

In an era where industries are digital, automated, and interconnected, the ability to protect critical systems is essential. Professor Trucco’s module trains the next generation of experts to safeguard the infrastructure society depends on, turning theoretical knowledge into practical, life-saving solutions.