ICS and SCADA: what they do and what they miss.
SCADA shows you the state of the process right now. That is what it was built for, and it is why it cannot tell you what is about to fail.
On this page6
ICS is the umbrella: every control system that runs a physical process. SCADA is one architecture underneath it, built for supervising equipment spread across distances too large to walk.
The terms get used interchangeably, usually by people selling to whoever is confused. The distinction is worth holding because it explains what each system will and will not do for you.
- 94.4%
- of equipment events had happened before at that site
- 10k+
- tags a mid-sized site can present to one operator
- 1960s
- when the supervisory-control model was first deployed
The difference
| ICS (the category) | SCADA (an architecture within it) | |
|---|---|---|
| Scope | Any industrial control system | Supervisory control over geographically distributed assets |
| Typical span | One machine to one plant | Substations, pipelines, water networks, wind farms |
| Core job | Control the process | Acquire data, present state, allow supervisory commands |
| Includes | PLCs, DCS, SIS, SCADA itself | RTUs, PLCs, HMI, historian, comms links |
| Control loop | Often local and closed | Local control with remote supervision on top |
SCADA tells you what the plant is doing. Almost nothing tells you what the plant is becoming.
A DCS running a refinery is ICS and not SCADA. A utility watching four hundred substations is running SCADA, and that SCADA is part of its ICS estate. The category tells you what the thing does; the architecture tells you how far apart its parts are.
What the parts do
- Sensors and actuators sit on the process itself and turn physical quantities into signals, and signals back into movement.
- PLCs and RTUs run the local control logic and hold the last line of protection, which is why they keep working when the link to the control room drops.
- The HMI is the screen an operator watches. It presents state; it does not decide anything.
- The historian records tag values over time, which makes it the most under-used asset on most sites.
- Protection relays act in milliseconds on electrical faults, far faster than any supervisory layer could.
Notice which of those is designed to look backwards. Only the historian, and it is usually treated as an archive rather than as evidence.
What SCADA was built to do, and what follows from it
SCADA was designed to answer one question well: what is the state of the process right now? It does that reliably, at scale, across distance, and it has been doing it since the 1960s.
Everything people complain about downstream follows from that design rather than from poor implementation. A system built to report the present moment has no opinion about the trajectory that led to it.
- Thresholds, not trends.
- An alarm fires when a value crosses a limit. A value that has doubled every month for four months and is still under the limit produces nothing at all.
- Tags, not assets.
- Ten thousand tags describe a site, but the transformer is not an entity the system knows about. Correlating tags into an asset is left to the person reading them.
- State, not memory.
- The current value is authoritative. Whether this exact event happened at this exact site three times this year is not a question the interface is built to answer.
- Presentation, not prioritization.
- In an alarm flood every alarm is equally loud. Ranking by consequence is the operator's job, performed under the conditions that make it hardest.
Why this matters for security
Two properties of this estate shape every security decision on top of it.
The first is that many ICS protocols were designed with no authentication, Modbus and DNP3 among them, because the network was assumed to be private and physically controlled. A command on the wire is trusted because it is on the wire. That assumption is what segmentation now has to reconstruct.
The second is asset lifetime. Equipment commissioned in the 1990s is still in service and will be for years. It cannot be patched on an IT cadence and often cannot be patched at all, so it is protected by controlling what can reach it rather than by changing it.
Where the history everyone already has comes in
The gap SCADA leaves is not a gap in data. Sites are collecting far more than they read, and the record of what has already gone wrong is usually sitting in a historian and a case log that nothing joins together.
In our own analysis of 14,898 support cases from monitored sites, 94.4% of equipment events had happened before at that same site. The detection layer had the signal every time. Nobody was tracking it.
That is the layer 42Hz adds, and it is deliberately a layer rather than a replacement. SCADA keeps doing the job it is good at. Reading the trend, remembering the recurrence and ranking by consequence are separate jobs that were never in its brief.
Common questions
Is SCADA obsolete?
No. It does its job, reliable supervisory visibility across distance, better than anything proposed to replace it. Treat proposals to rip it out with suspicion; the useful work is almost always additive.
Can we just set our alarm thresholds lower?
It trades one failure for the other. Lower limits convert late alarms into frequent ones, and an alarm that fires often gets acknowledged without being read. Rate of change is a different measurement from level, and no threshold on a raw tag produces it.
Do we need new sensors to get predictive value?
Usually not for a first pass. Most of what early degradation announces itself with is already being collected and discarded: trends in existing tags, alarm history, and the case record around them.
Does an analytics layer need to write to the control system?
It does not, and it should not. Reading is sufficient to detect, rank and recommend. A layer with no write path cannot be used to operate your plant if it is ever compromised, which removes the risk rather than managing it.
Does this match what you see?
If your own stations tell a different story we want to hear it. Send us the data that disagrees with us.