OT File Security: Scanning Once at the Door Is Not Enough
A sponsored OPSWAT article published on IIoT World on 9 November 2026 argues that file integrity must be assured from approval all the way to the PLC or HMI. The point matters to anyone who distributes programs, HMI projects or firmware, regardless of the product being promoted.
On 9 November 2026, IIoT World published a piece marked "Sponsored by Opswat", summarizing an article from OPSWAT's blog. Its thesis: at OT sites, scanning a file at the point of entry is not sufficient, because integrity must be guaranteed until the file reaches a PLC or HMI. It should be read as vendor-sponsored content, but it raises a concrete point for anyone working in automation.
The gap between approval and deployment
According to the article, OT sites typically scan and approve files at entry: vendor firmware, contractor patches, configuration updates. After approval, however, security teams lose visibility until the file arrives at the target device.
The problem is made worse by legacy devices. Legacy PLCs, HMIs and engineering workstations cannot run EDR agents and cannot verify that the file they receive matches the one that was approved. Once a device is connected, files are accessible by default.
What a scan actually proves
A file modified after verification, whether by mistake or on purpose, looks identical to an unmodified one: the scan record remains valid and the approval stays on file. In OPSWAT's words, a scan proves the file was clean at a given moment, not that it is still the same file at deployment time. Confirming that the file has not changed between approval and deployment is described as essential in regulated industries.
Relying on every operator to follow every step at every site is a process assumption, not a security control.
The proposed solution and the listed requirements
OPSWAT proposes MetaDefender Drive with Smart Touch, built on Secure File Storage. Files copied from vendor or contractor devices stay isolated until they pass verification at a MetaDefender Kiosk. If a verified file is modified before deployment, it is automatically blocked and hidden until it is verified again. The model thus shifts from "scan once and deploy" to "verify continuously until deployment".
Other requirements listed include:
- verifying contractor and supply chain devices before they connect;
- applying consistent inspection policies across sites, with centralized management;
- managing firmware distribution in air-gapped environments;
- keeping records ready for audits.
Limitations to keep in mind
Before drawing conclusions, a few caveats are worth considering:
- the article provides no incident data or figures;
- it does not mention hashes, digital signatures or blockchain;
- the product claims come from the vendor and are not independently verified;
- it is more a security piece than an automation one, and its link to data integrity is only partial.
Practical takeaway
The principle holds regardless of the product. Anyone who distributes PLC programs, HMI projects or firmware can close the gap with a hash or signature check at deployment time, comparing the file against the approved one. This does not necessarily require a commercial platform, and it also produces an audit trail that is useful at regulated sites.
In short: record the file's fingerprint at approval, verify it immediately before loading, and keep the result. That way the control does not depend on the discipline of individual operators but becomes part of the process.