4,400+ Rockwell PLCs Exposed Online: Why Your Shop Floor Needs Multiple Layers of Cybersecurity in the AI Era

The latest industrial cybersecurity warning should get the attention of every manufacturer running connected machinery.

Recent reporting on Forescout research identified more than 4,400 Rockwell Automation PLCs directly exposed to the public internet, including thousands located in the United States. Researchers also identified 22 exposed devices in cities associated with recent attacks on U.S. water infrastructure.

The bigger lesson for manufacturers is not that Rockwell Automation equipment is inherently unsafe.

It is that industrial equipment should not be sitting directly on the open internet in the first place.

Rockwell itself has repeatedly advised customers to ensure controllers are not exposed to the public internet, enable available controller security protections, and use network segmentation and broader defense-in-depth strategies around industrial automation systems.

For woodworking manufacturers, cabinet plants, millwork operations, furniture manufacturers, and other automated production facilities, this issue extends far beyond one brand of PLC.

Your CNC router, edgebander, panel saw, robotic sanding cell, automated finishing line, material-handling system, compressor, dust collection system, and plant monitoring equipment may all contain network-connected controls.

In the age of AI, protecting those controls with multiple layers of security is becoming more important, not less.

The Attack Did Not Require Some Science-Fiction AI Hack

One of the most concerning aspects of the recent PLC activity is how ordinary the underlying exposure appears to be.

Industrial EtherNet/IP communications commonly use TCP/UDP port 44818. CISA and Rockwell guidance has long recommended restricting EtherNet/IP and CIP traffic from outside the manufacturing zone and preventing industrial control devices from being accessible directly from the internet.

That distinction matters.

Manufacturers sometimes imagine a cyberattack against a factory as an incredibly sophisticated hacker defeating layers of encryption, discovering an obscure zero-day vulnerability, and writing custom software specifically for their plant.

Sometimes attacks are sophisticated.

But many successful attacks begin with something much simpler:

The equipment was reachable.

Once an industrial controller, remote-access device, engineering workstation, or poorly configured gateway is exposed to the public internet, an attacker has been given an opportunity that should never have existed.

This is why cybersecurity starts with architecture, not antivirus software.

AI Changes the Economics of Cyberattacks

Artificial intelligence does not magically give attackers access to a properly secured industrial network.

But AI can make several activities easier to automate and scale.

Reconnaissance can be accelerated. Large collections of exposed devices can be analyzed. Documentation can be summarized. Common configuration patterns can be identified more quickly. Scripts can be developed and modified faster. Social-engineering messages can become more convincing.

The fundamental vulnerability may still be something remarkably mundane:

• An exposed industrial port

• A poorly configured firewall

• An unnecessary port-forwarding rule

• A remote-access gateway using weak credentials

• An engineering PC connected to both the business and machine networks

• An old VPN account nobody disabled

• A vendor modem that everyone forgot existed

• Default passwords

• Unsupported firmware

• Flat networks with no segmentation

• Remote services left enabled after commissioning

AI potentially increases the speed at which weaknesses can be discovered and exploited.

The response should therefore be defense in depth.

One security product is not enough.

Your CNC Machine Is Not Just a Machine Anymore

Consider a modern woodworking CNC router.

Mechanically, it contains familiar components:

spindle, vacuum system, servo motors, tool changer, drill block, lubrication system, sensors, and material handling.

Digitally, however, the machine may also contain:

• PLC

• CNC controller

• Industrial PC

• Windows-based HMI

• Ethernet switch

• Servo network

• Remote diagnostic software

• Machine database

• Tool libraries

• CNC programs

• Part files

• Production recipes

• Network shares

• Barcode systems

• ERP or MES connections

• Cloud-connected software

• Vendor remote-support capabilities

That is not simply a woodworking machine anymore.

It is an OT endpoint connected to your company's digital production infrastructure.

And the same applies to an automated edgebander, robotic sanding cell, finishing line, beam saw, sorting system, or packaging line.

Once production equipment becomes network connected, cybersecurity becomes part of machine reliability.

What Could a Shop Actually Lose?

Manufacturing cybersecurity is sometimes discussed as though the primary concern were stolen email addresses.

For the shop floor, the risk can be different.

Imagine arriving Monday morning and discovering that your CNC programs, tooling parameters, machine configuration files, PLC logic, production schedules, or recipe databases are unavailable or corrupted.

Production stops.

Now imagine trying to recover a machine when nobody has an offline copy of:

• PLC programs

• CNC parameters

• Servo parameters

• Machine configuration files

• Tooling databases

• Postprocessors

• Custom macros

• HMI configurations

• Robot programs

• Production recipes

The machine may be mechanically perfect.

But digitally, it can be unusable.

That is why Rockwell's current guidance specifically recommends maintaining controller project files offline for disaster recovery, in addition to removing unnecessary internet exposure.

For manufacturers, machine backups should be treated with the same seriousness as spare spindles, bearings, tooling, and critical replacement parts.

Layer 1: Keep Machine Controllers Off the Open Internet

This should be the starting point.

A PLC, CNC controller, robot controller, HMI, or other industrial device should generally not be directly reachable from the public internet.

Rockwell's March 2026 security guidance explicitly recommends ensuring controllers are not exposed to the public internet and calls for network segmentation and defense-in-depth protections.

CISA has issued similar guidance for industrial control systems for years: minimize network exposure, place control-system devices behind firewalls, isolate them from business networks, and use secure methods when remote access is necessary.

Manufacturers should specifically look for:

Port forwarding from the shop's public IP directly to machine controls.

If that exists, determine why.

There may be a legitimate historical reason—a machine builder needed remote access during installation, for example—but that does not mean the configuration should remain indefinitely.

Layer 2: Put a Firewall Between the Internet and OT Network

Your internet connection should not lead directly to your manufacturing network.

Industrial machines should sit behind appropriately configured network security controls.

That means controlling:

who can communicate with the OT network, what devices they can reach, what protocols they can use, and when that communication is allowed.

CISA specifically recommends restricting EtherNet/IP and CIP traffic such as traffic involving ports 2222 and 44818 from outside manufacturing zones.

A firewall cannot fix every cybersecurity problem.

But it dramatically changes the conversation from:

"Anyone on the internet can attempt to communicate with this controller."

to:

"Only explicitly authorized communications can reach this industrial network."

That is an enormous difference.

Layer 3: Segment the Office Network From the Shop Floor

One of the most important concepts in industrial cybersecurity is IT/OT segmentation.

Your accounting employee's workstation should not have unrestricted network access to the PLC controlling a production machine.

Neither should:

• Sales laptops

• Guest Wi-Fi

• Employee phones

• Smart TVs

• Office printers

• Marketing computers

• Unmanaged tablets

• Personal devices

Yet smaller manufacturing operations frequently grow their networks organically.

Someone adds a switch.

Then another Wi-Fi access point.

Then a machine needs internet access.

Then a service technician needs remote connectivity.

Then the estimating software needs to send jobs to the CNC.

Before long, the entire facility may effectively operate as one large flat network.

That is convenient.

It is also dangerous.

Rockwell specifically points industrial users toward segmented industrial network architectures and defense-in-depth strategies rather than direct public connectivity.

A better architecture separates business IT from production OT and tightly controls the traffic crossing between them.

Layer 4: Secure Remote Machine Support

Remote support is extremely valuable.

Centex Automation and machine manufacturers can diagnose many problems much faster when qualified technicians can securely connect to equipment instead of immediately requiring an onsite service call.

The solution is not eliminating remote support.

The solution is controlling it.

Where remote access is required, CISA recommends secure methods such as VPNs while also emphasizing that VPN infrastructure itself needs to be maintained securely.

A modern remote-support strategy should consider controls such as:

• VPN or secure remote-access gateway

• Multi-factor authentication

• Individual technician accounts

• No shared generic passwords

• Access logging

• Time-limited access

• Explicit customer authorization

• Restricted access to specific equipment

• Removal of inactive accounts

• Updated remote-access appliances

• Ability to disable remote connectivity when not required

The principle is simple:

Remote support should create a temporary controlled path into the machine—not a permanent open door from the internet.

Layer 5: Protect the Engineering Workstation

Another overlooked risk is the computer used to program or service the machine.

A PLC can be isolated perfectly, but if an infected engineering laptop is connected directly to the controls network, you have potentially created a bridge around your other defenses.

Engineering workstations deserve special treatment.

They should be maintained, patched where appropriate, protected from unnecessary applications, restricted from casual web browsing, and controlled carefully when USB devices or removable media are used.

The laptop that programs your PLC should probably not be the same laptop somebody's teenager uses to download games on the weekend.

That sounds obvious.

In small manufacturing companies, these situations happen.

Layer 6: Back Up Every Machine Before You Need the Backup

Every automated manufacturing facility should maintain a machine-level disaster-recovery library.

For each critical machine, consider preserving current copies of:

• PLC program

• CNC parameters

• Robot program

• Machine configuration

• HMI application

• Servo parameters

• Tool database

• CNC programs

• Postprocessor

• Macros

• Network configuration

• Software versions

• Firmware versions

• Backup and restore instructions

At least one current backup should be offline or otherwise isolated from the production network.

Why?

Because a backup stored on a network share that becomes encrypted or compromised alongside the production systems may not be much of a backup.

Rockwell's guidance to upload controller projects and retain copies offline reflects exactly this disaster-recovery principle.

Layer 7: Control Who Can Change Machine Settings

Manufacturers spend tremendous amounts of time dialing in equipment.

Consider what is stored inside a modern automated cell:

Tool offsets.

Feed rates.

Spindle parameters.

Servo settings.

Vacuum parameters.

Sanding recipes.

Robot paths.

Edgebander glue temperatures.

Pressure settings.

Finishing recipes.

Calibration values.

PLC logic.

Those settings have real economic value.

A shop may have spent months—or years—developing them.

They should not be treated as disposable data.

Restrict administrative access.

Give operators the permissions they need to operate equipment without automatically giving everyone permission to alter system-level configuration.

Maintain known-good backups before major changes.

Log configuration changes where the platform supports it.

Cybersecurity is not only about preventing an attacker from entering the building digitally.

It is also about maintaining control over the configuration that makes your factory run correctly.

Layer 8: Know Every Device Connected to Your Plant

You cannot secure equipment you do not know exists.

Industrial networks frequently contain forgotten equipment:

An old cellular modem.

A maintenance router.

A remote-access appliance installed by a previous machinery supplier.

An unmanaged Ethernet switch hidden inside an electrical cabinet.

An old PC running Windows because one machine still needs it.

A wireless bridge installed five years ago.

A second Ethernet connection someone added because the first network "wasn't working."

Create an inventory.

For every network-connected production asset, know:

What is it?
Who owns it?
Why is it connected?
Does it need internet access?
Who can remotely access it?
Is it still supported?
Do we have a backup?

If nobody can answer those questions, that device deserves attention.

Don't Disconnect Your Factory From Technology—Engineer the Connection

The lesson from these PLC incidents is not that automation or connectivity is bad.

Quite the opposite.

Connected manufacturing gives shops enormous advantages:

• Remote diagnostics

• Automated production reporting

• ERP integration

• Barcode-driven manufacturing

• Predictive maintenance

• Machine monitoring

• Automated scheduling

• AI-assisted production analysis

• Robotics

• Lights-out manufacturing

• Faster technical support

The manufacturing companies that learn to use those technologies effectively will have a significant competitive advantage.

But connectivity has to be engineered.

You would never install a 20 HP spindle without guarding, overload protection, emergency stops, and safety circuits.

Digital connectivity deserves the same engineering mindset.

The Centex Automation Approach: Automation With Security in Mind

At Centex Automation, we believe manufacturing automation should increase productivity without unnecessarily increasing exposure.

When integrating CNC routers, edgebanders, robotic sanding systems, material handling, finishing equipment, and other automated machinery, the network architecture surrounding that equipment is becoming increasingly important.

Manufacturers should be thinking beyond:

"Can this machine connect to the network?"

The better questions are:

Should it connect?
What does it need to communicate with?
Who needs remote access?
How is that access authenticated?
What separates it from the internet?
What separates it from the office network?
Can we recover the machine if something happens?

Those questions will matter even more as artificial intelligence becomes integrated into production planning, maintenance, diagnostics, vision systems, robotics, and manufacturing software.

Your Shop Floor Needs More Than One Locked Door

Physical security has always worked in layers.

The property has a fence.

The building has a lock.

The electrical room has another lock.

The machine has operator permissions.

Critical settings have passwords.

Digital security should work exactly the same way.

Internet isolation.
Firewall.
Network segmentation.
Secure VPN.
Multi-factor authentication.
Restricted user permissions.
Protected engineering workstations.
Offline machine backups.
Monitoring.

No single layer is perfect.

That is the point.

If one defense fails, another defense should still stand between an attacker and the equipment running your factory.

The discovery of thousands of internet-exposed industrial controllers is another reminder that the machines controlling real-world production processes deserve a different level of protection than an ordinary internet-connected device.

In the age of AI, the question is no longer whether manufacturing equipment will become more connected.

It will.

The question is whether manufacturers will engineer that connectivity with the same discipline they apply to the machinery itself.

At Centex Automation, we believe they should.

Because protecting your production equipment, machine programs, PLC logic, recipes, parameters, and intellectual property is no longer just an IT issue.

It is part of protecting production.