Cyber-physical systems (CPS) are systems where software and networks are tightly coupled to physical processes. Embedded computers read the physical world through sensors, run control logic, and act on it through actuators, in a feedback loop where the physical process shapes the computation and the computation shapes the process. A power grid, a robotic assembly line, and a water treatment plant are all cyber-physical systems.
What are cyber-physical systems?
The term describes any system where a computer's decisions have physical consequences. A sensor reports a temperature, tank level, or motor speed. Control logic evaluates it against a setpoint. An actuator opens a valve, trips a relay, or adjusts a drive. NIST, which has published a CPS framework, frames these as engineered systems built from the seamless integration of computational and physical components.
That coupling is the whole point and also the whole risk. In pure IT, a bad instruction corrupts data. In a cyber-physical system, a bad instruction moves a machine.
How do cyber-physical systems work in OT?
In operational technology environments, CPS are the machinery of production. Programmable logic controllers execute deterministic control loops. SCADA systems supervise processes across a plant or a region. Sensors and actuators do the physical work, and a historian records it all for engineering and compliance.
These systems were designed for reliability and long life, not for security. A PLC installed a decade ago may run continuously for years, speak an unauthenticated protocol like Modbus, and have no capacity for an endpoint agent. The Purdue model was the classic way to organize and defend them, though flat networks and IT/OT convergence have eroded those neat layers.
Why are cyber-physical systems hard to secure?
Because a compromise crosses from bits into the physical world. Stuxnet, in 2010, altered PLC logic to destroy centrifuges while reporting normal readings to operators. In December 2015, attackers opened breakers across Ukrainian distribution utilities and left roughly 230,000 people without power, then wiped the systems behind them. These were not data breaches. They were physical outcomes driven through the cyber layer.
The defensive constraints are just as real. You cannot reboot a running furnace to patch it. You cannot install agents on a controller that has no room for one. Safety and availability outrank confidentiality, which inverts the usual IT priority order and rules out many standard security tools.
Who needs to secure cyber-physical systems?
Anyone who runs them: manufacturers, electric and water utilities, oil and gas operators, transportation and building automation, and the defense suppliers whose production depends on them. For contractors handling CUI, the standards apply directly. NIST SP 800-171 and CMMC govern the information side, while IEC 62443 and NIST SP 800-82 govern the industrial control side. IEC 62443 in particular defines the zone-and-conduit model for isolating cyber-physical assets so a fault or intrusion in one zone cannot spread.
How is a cyber-physical system different from IoT?
They overlap but are not the same. IoT devices are usually consumer or enterprise endpoints that sense and report over the internet. Cyber-physical systems are engineered control systems where software closes a loop and directly commands physical equipment, often in safety-critical settings with hard timing requirements. An IoT thermostat reports and suggests; a cyber-physical control system decides and acts.
Trout secures the network these systems live on, enforcing segmentation and identity-based access so a reachable controller is not an exploitable one. See Defense and government contracting.
