Securing operational technology in mining
Protecting lives, maximising operational resilience and overcoming the limits of traditional IT cybersecurity
The mining industry is facing an escalating wave of cyber threats as it becomes increasingly reliant on connected systems and digital technologies to drive efficiency and productivity. Modern mining operations rely on Cyber-Physical Systems (CPS), which Gartner defines as engineered systems that orchestrate sensing, computation, control, networking and analytics to interact with the physical world (including humans) spanning industrial control systems (ICS), OT devices, Internet of Things (IoT) devices and more.
CPS are at the heart of automation, remote operations and industrial connectivity, but their integration of physical processes with digital control makes them a particularly high-value target. Attacks on OT and CPS can endanger worker safety, halt production and damage equipment, as demonstrated by incidents such as the 2020 ransomware attack on Canadian gold miner Detour Lake, which disrupted operations for several days and the cyberattack on Norsk Hydro that led to a $70m loss.
As mining companies embrace automation, remote operations and cloud-based systems, this growing attack surface makes robust cybersecurity not just a technical necessity, but a business-critical priority, because an OT breach doesn’t just affect data — it can compromise the safety of operations, potentially leading to a complete shutdown and resulting in millions of dollars in lost productivity. While IT cyber-attacks often focus on ransomware aimed at stealing data and extorting money, OT cyber-attacks are typically more sophisticated, increasingly linked to nation-state actors and geared toward disrupting physical processes.
“In today’s global mining operations, the cyber threat isn’t theoretical, it’s operational. Operational Technology (OT) and Cyber-Physical Systems (CPS) environments are no longer isolated; their convergence with IT, IoT and autonomous systems has created an attack surface that adversaries are actively targeting. Asset visibility, exposure management and network segmentation aren’t nice-to-haves, they are the foundation of operational resilience.”
— Jason Pearce, Field Chief Technology Officer, APJ, Claroty.
Why traditional IT cybersecurity solutions fall short in addressing OT security challenges
Mining operations heavily depend on OT systems, such as Supervisory Control and Data Acquisition (SCADA), Programmable Logic Controllers (PLCs) and Distributed Control Systems (DCS), to orchestrate a wide range of critical functions. These systems manage critical processes like ore processing, material transport and water management, maintaining seamless coordination across complex mining workflows. While cybersecurity tools like Security Information and Event Management (SIEM), Network Detection and Response (NDR) and Extended Detection and Response (XDR) effectively secure traditional IT networks, they lack visibility into the unique assets, protocols and vulnerabilities of OT environments. Originally designed for reliability and safety rather than cybersecurity, these OT systems are highly susceptible to sophisticated cyber-attacks, posing significant risks to operational continuity, equipment integrity and worker safety.
Enhancing worker safety in mining with Claroty xDome, the leader in CPS security
With FIFO workers exposed to heavy machinery, hazardous materials and extreme environments, prioritising human safety is paramount. Eliminating fatalities is both a moral and legal necessity essential for maintaining operational integrity and fostering workforce confidence. Cyber threats targeting OT systems such as ventilation, autonomous vehicles and gas detection can compromise these safeguards and create life-threatening situations. Claroty reduces this risk by securing the integrity and availability of critical systems through continuous monitoring, real-time anomaly detection and secure access.
This proactive approach enables operators to detect and mitigate cyber risks before they escalate, reducing the likelihood of accidents and strengthening both safety and resilience across modern mining environments.
How Claroty helps mining companies reduce their CPS risk
Claroty plays a critical role in safeguarding many Australian mining operations, including those in the gold, iron ore and lithium sectors. The Claroty xDome platform provides unmatched asset visibility, exposure management, threat detection, risk assessment and secure access tailored specifically to industrial environments in 5 key ways:
- Complete Asset Visibility: Claroty’s complete asset visibility provides comprehensive, real-time discovery and classification of all CPS assets across the network. It delivers detailed insights into asset types, communication patterns and security posture without disrupting operations. This unified view enables organisations to accurately manage their environment, identify unauthorised devices and support effective risk management and compliance efforts. Traditionally this has been done using methods focused on passively scanning network traffic, but as demand increases for more granular visibility and these networks become more sophisticated, there is now more demand for dynamic discovery methods like OT project file ingestion, integrations with existing tooling and safe-active scanning of devices using their proprietary protocols.
- Exposure Management: Claroty’s xDome identifies and assesses vulnerabilities across all connected CPS assets to go beyond traditional Vulnerability Risk Management and bring organisations into exposure management. By combining detailed asset profiles with threat intelligence and risk scoring, xDome pinpoints real risk exposure, prioritising vulnerabilities based on their likelihood of exploitation and potential business impact. Understanding and quantifying this exposure is critical. It allows organisations to move beyond simply listing vulnerabilities to understanding which weaknesses truly threaten operations and safety. Claroty maps these critical vulnerabilities to known exploits and provides actionable remediation guidance, enabling security teams to proactively reduce actual risk exposure and strengthen the resilience of critical infrastructure effectively. This focus on exposure management ensures that security efforts are directed where they matter most, preventing potential disruptions before they occur.
- Threat Detection: Claroty’s threat detection leverages deep OT protocol awareness and continuous monitoring to identify anomalies, vulnerabilities and threats in real time. By establishing a baseline of normal network behaviours, it can detect deviations that may indicate malicious activity, such as unauthorised commands or unusual traffic patterns. Claroty xDome uses signature and behaviour-based analytics to detect known and emerging threats, while providing detailed alerts and context to accelerate response and minimise risk to critical OT assets.
- Network Protection: Claroty strengthens OT network protection by making segmentation practical and safe. It begins with deep asset discovery and mapping of all communications across CPS, providing the visibility needed to design effective segmentation. Using this insight, Claroty helps define logical zones and conduits in line with standards like IEC 62443, simulates policies before enforcement to avoid disrupting operations and integrates with firewalls and NAC solutions to apply those rules seamlessly. Once segmentation is in place, Claroty continuously monitors for policy violations, unauthorised connections or lateral movement, ensuring that threats are contained without compromising uptime.
- Secure Access: xDome Secure Access centralises and secures both internal and third-party access to OT environments by providing a single, frictionless, controlled access point. It enforces role-based permissions, multi-factor authentication and session monitoring to ensure only authorised users can connect to critical systems. With full session recording and audit trails, mining companies gain complete visibility into all user-activities, reducing the risk of unauthorised access and ensuring compliance with security policies.
From pit to port: simplifying compliance in mining
Claroty helps mining organisations meet regulatory and compliance obligations by aligning with both global and local cybersecurity standards. With the xDome platform, operators can strengthen governance and risk management in line with ISO/IEC 27001, map controls to the NIST Cybersecurity Framework, address the maturity pillars of the Australian Energy Sector Cyber Security Framework (AESCSF) and meet the requirements of the Security of Critical Infrastructure (SOCI) Act.
In 2025, Australia adopted AS IEC 62443 series of standards to strengthen the cybersecurity of its critical infrastructure and operational technology systems. Unlike traditional IT-focused standards, IEC 62443 is specifically designed to address the unique risks and requirements of OT environments, including ICS and SCADA networks. The standard provides a globally recognised framework to ensure the safety, reliability and resilience of critical systems.
How Claroty helps support the Foundational Requirements (FR) and System Requirements (SR) of AS IEC 62443-3-3:
- Asset identification and management Claroty automatically discovers and inventories all connected assets within the OT network, including SCADA systems, PLCs, HMIs and communication protocols. This visibility is foundational to implementing and maintaining a security program aligned with IEC 62443.
- Network segmentation and access control Claroty supports the design and enforcement of secure network architectures, including zones and conduits, a core concept in IEC 62443. By enabling secure segmentation of operational environments, such as control systems, critical infrastructure and supporting platforms. Claroty helps prevent the lateral movement of threats.
- Threat detection and anomaly monitoring Claroty provides continuous monitoring for cyber threats and abnormal behaviour across OT environments. This aligns with IEC 62443’s requirements for detection, alerting and response to unauthorised activity and potential breaches within industrial networks
- Secure access Secure access to OT assets is essential for internal and third-party maintenance and support. Claroty Secure Access enforces role-based controls, monitors and records sessions and provides full auditability, aligning with key IEC 62443 requirements to ensure safe and accountable remote interactions with critical systems.
- Risk management and security levels Claroty helps define and implement Security Levels based on risk assessments, ensuring mining OT systems are appropriately protected according to their criticality. This supports a systematic, standards-based approach to reducing cyber risk.
- Support for defence-in-depth strategy IEC 62443 advocates a defence-in-depth approach and enables this by integrating with firewalls, endpoint protection, SIEMs and other security technologies to provide layered protection and centralised visibility.
Driving cyber resilience in mining: how Claroty’s Team82 research division leads the charge
Team82, Claroty’s research and threat intelligence team, delivers critical threat and vulnerability research to protect industrial, healthcare and commercial networks, ensuring system safety, reliability and integrity in essential industries. They proactively identify and ethically disclose vulnerabilities, having uncovered over 400 CPS vulnerabilities to date. Team82 keeps Claroty’s platform ahead of evolving threats by simulating real-world cyberattacks, enhancing threat detection, exposure management and network segmentation. Their work addresses the unique challenges of remote, high-risk mining environments, delivering robust protection for critical operations.
In the 2025 State of CPS Security report, Team82 examined nearly one million OT devices and uncovered alarming vulnerabilities across industrial environments. The study found that 40% of organisations had OT assets insecurely connected to the internet, while 12% contained known exploited vulnerabilities. Even more concerning, more than 12% of mining organisations had OT assets communicating with malicious domains, demonstrating that the risks to these critical systems are not theoretical but actively present.
Further analysis of more than 50,000 devices revealed a troubling sprawl of remote access tools. More than half of organisations (55%) use four or more remote access solutions in their OT environments. Many of these tools are non–enterprise grade and lack fundamental privileged access management capabilities.
The implications of Team82’s research extend far beyond statistics — they serve as a wake-up call for organisations to prioritise cybersecurity as a core component of operational safety. In remote, high-risk settings where physical and digital worlds collide, even a single vulnerability can cascade into widespread disruption.
Ultimately, Claroty’s commitment through Team82 reinforces a vital truth — in the mining industry, where the stakes involve human lives, environmental integrity and economic stability, proactive defence isn’t optional, it’s essential. As threats continue to evolve, ongoing research and collaboration will be key to building resilient systems that protect the industry’s future.
The convergence of IT and OT systems in mining will only accelerate. As such, adopting a comprehensive cybersecurity solution that understands vertical nuances of the mining industry, like Claroty xDome, is no longer optional, it’s a critical investment in continuity, safety and operational resilience.
Claroty empowers mining companies to move forward with digital transformation while maintaining confidence that their operations are protected from evolving cyber threats. In an industry where uptime is gold, robust CPS security is the bedrock of modern mining.
Ready to strengthen your operational and cyber resilience? Connect with Claroty’s WA Sales Director, John Rice, on LinkedIn to explore how Claroty can support your journey.
Claroty’s mining cybersecurity specialists are ready to explore your specific requirements, share proven approaches for implementing CPS security and help you advance toward higher CPS cybersecurity maturity.
Claroty
www.claroty.com
, which Gartner defines as engineered systems that orchestrate sensing, computation, control, networking and analytics to interact with the physical world (including humans) spanning industrial control systems (ICS), OT devices, Internet of Things (IoT) devices and more.){kind=link}