What is SCADA? How Supervisory Control Systems Work

Supervisory control and data acquisition (SCADA) is an industrial control system that monitors and controls physical processes across plants, utilities, and infrastructure. SCADA gathers real-time data from field sensors, presents it to operators on a central interface, and sends commands back to equipment such as pumps, valves, and motors.

These systems run critical infrastructure, making them high-value targets. Industrial control system vulnerabilities reached a record high in 2025, with 508 ICS security advisories flagging 2,155 vulnerabilities across the sector.

What a SCADA System Does

A SCADA system performs five core functions across an industrial operation. 

• Supervisory control: SCADA issues automated and operator-driven commands to field equipment, adjusting processes without manual work at each device.
• Data acquisition: SCADA collects analog and digital readings from sensors and meters, converting field measurements into structured records.
• Real-time monitoring: SCADA tracks process variables against defined thresholds, giving operators live visibility into plant conditions.
• Alarm and event handling: SCADA raises alerts when readings breach safe limits, prompting a fast operator response.
• Logging and reporting: SCADA writes events to a historian database, supporting trend analysis, audits, and compliance reporting.

How SCADA Works

SCADA works by moving data from field devices to a central server and control commands back to equipment, closing a continuous monitoring loop. Five stages define this flow.

1. Sensors and actuators measure physical conditions such as pressure, temperature, and flow at the equipment level.
2. RTUs and PLCs collect these readings, run local control logic, and convert signals into digital data.
3. Communication networks transmit the data from remote units to the central system over Ethernet, cellular, radio, or fiber.
4. Supervisory computers process incoming data, evaluate it against setpoints, and store records in a historian.
5. Operators read the processed data on an HMI and send control commands back through the same path.

Core Components of a SCADA System

SCADA architecture combines field hardware, communication links, and supervisory software into a layered system. Five components carry the workload.

1. Field devices: sensors and actuators

Field devices sit at the equipment level and form the sensory layer of SCADA. Sensors measure conditions such as flow, voltage, and temperature, while actuators execute commands by opening valves or starting motors.

2. RTUs and PLCs

RTUs and PLCs act as the field controllers that connect equipment to the SCADA network. Remote terminal units (RTUs) gather sensor data at distant sites, and programmable logic controllers (PLCs) run automated control logic for local machinery.

3. Communication network

A communication network links field controllers to the central system and carries data in both directions. SCADA networks use wired and wireless channels, including Ethernet, cellular, radio, and fiber optic connections.

4. Supervisory computer and historian

A supervisory computer, sometimes called the master terminal unit (MTU), forms the core of SCADA. It processes field data, applies control logic, and writes records to a historian database for trend analysis and reporting.

5. Human-machine interface (HMI)

An HMI presents SCADA data to operators through dashboards, graphics, and alarms. Operators use the HMI to watch process performance, acknowledge alarms, and send commands to field equipment.

Types of SCADA Systems

SCADA systems fall into four generations, each defined by its architecture and connectivity.

Each generation added connectivity, and that connectivity expanded the attack surface that modern SCADA security addresses.

SCADA vs ICS vs PLC vs DCS

SCADA is often confused with related control-system terms. Three distinctions matter most.

SCADA vs ICS

SCADA is one type of industrial control system (ICS), not a separate category. ICS is the umbrella term covering SCADA, distributed control systems, and standalone controllers, while SCADA refers to supervisory systems that gather data across dispersed sites.

SCADA vs PLC

A PLC is a component inside a SCADA system, not an alternative to it. Programmable logic controllers execute real-time control on individual machines, while SCADA supervises and coordinates many PLCs across an entire operation.

SCADA vs DCS

SCADA supervises geographically dispersed assets, while a DCS controls processes inside a single facility. Distributed control systems (DCS) prioritize continuous process control within one plant, and SCADA prioritizes data collection and supervision across long distances.

SCADA Communication Protocols

SCADA systems exchange data through specialized industrial protocols. Five appear most often. 

• Modbus: a widely deployed serial and TCP/IP protocol that connects controllers, sensors, and SCADA masters.
• DNP3: a protocol built for electric utilities and water systems, common across energy grids and pipelines.
• OPC UA: a modern, platform-independent standard that carries authenticated data between industrial devices and software.
• IEC 60870-5: a telemetry protocol used in power transmission and distribution across Europe and Asia.
• PROFINET: an industrial Ethernet protocol for real-time communication in manufacturing and process automation.

Industries That Use SCADA

SCADA runs the physical processes behind six core industries. 

1. Energy and utilities: SCADA controls power generation, transmission, and distribution across grids and substations.
2. Water and wastewater: SCADA manages pump stations, treatment plants, and storage tanks for municipal supply.
3. Oil and gas: SCADA monitors pipelines, refineries, and drilling sites spread over long distances.
4. Manufacturing: SCADA coordinates production lines, robotics, and quality control on the plant floor.
5. Transportation: SCADA operates rail signaling, traffic systems, and transit control networks.
6. Building management: SCADA regulates HVAC, lighting, and access systems across commercial facilities.

Benefits of SCADA

SCADA delivers five operational benefits to the industries that deploy it. 

• Real-time visibility: SCADA surfaces live process data, letting operators spot anomalies and act before small faults escalate.
• Operational efficiency: SCADA automates routine control tasks, reducing manual work and shortening response times.
• Reduced downtime: SCADA flags equipment issues early through continuous monitoring, cutting unplanned outages.
• Predictive maintenance: SCADA analyzes historical and live trends to schedule maintenance before equipment fails.
• Regulatory compliance: SCADA logs process data for the audits and reporting required in regulated sectors.

SCADA Security: Threats and Defenses

SCADA security protects industrial control systems from cyberattacks that disrupt physical operations. Older SCADA networks were engineered for reliability, not security, which leaves gaps that attackers exploit.

Why SCADA is vulnerable

Three conditions weaken SCADA. Legacy devices run outdated software and unencrypted protocols, IT and OT convergence connects once-isolated networks to the internet, and exposed remote-access points hand attackers a direct entry route. NIST SP 800-82 documents these OT weaknesses and the safeguards that address them.

Common SCADA attacks

SCADA attacks target both data and physical equipment. Documented cases include Stuxnet, which damaged Iranian centrifuges in 2010, the 2015 Ukraine grid attack that cut power to 230,000 people, and the 2021 Oldsmar water plant intrusion that altered chemical dosing. CISA reports that attackers reach many of these systems through internet-exposed assets and default credentials.

How to secure SCADA

Effective SCADA security follows layered controls. Network segmentation, structured around the Purdue Model, isolates control systems from corporate IT, multi-factor authentication protects remote access, regular patching closes known vulnerabilities, and continuous monitoring detects intrusions early. Continuous external vulnerability scanning of internet-facing assets flags exposed SCADA interfaces before attackers reach them.

How CloudSEK Surfaces Internet-Exposed SCADA Assets

CloudSEK is not an Operational Technology (OT) security platform, and it does not monitor industrial protocols or replace dedicated ICS tools. It addresses one specific SCADA risk: internet-exposed assets that attackers find first.

CloudSEK BeVigil maps an organization's external attack surface and flags SCADA interfaces, open ports, and remote-access points reachable from the public internet. This outside-in view matches the vantage point attackers use, letting teams remove exposure before it becomes an entry route.

CloudSEK Threat Intelligence tracks the ransomware groups and state-linked actors targeting critical infrastructure, giving SOC teams early context on campaigns against their sector. Both complement, rather than replace, the OT monitoring that secures the internal control network.

Frequently Asked Questions

What does SCADA stand for?

SCADA stands for supervisory control and data acquisition. The term describes industrial systems that monitor and control physical processes from a central location.

Is SCADA hardware or software?

SCADA is both hardware and software. Hardware includes RTUs, PLCs, and sensors, while software processes the data and drives the operator interface.

What is the difference between SCADA and HMI?

An HMI is the operator interface within a SCADA system, not a replacement for it. SCADA runs the full control and data pipeline, and the HMI displays that data to operators.

Is SCADA still used today?

Yes, SCADA is still used across critical infrastructure worldwide. Energy, water, and manufacturing operators run modern web-based and cloud-connected SCADA daily.

What is a SCADA engineer?

A SCADA engineer designs, configures, and maintains SCADA systems for industrial operations. The role covers HMI development, PLC integration, and control-system troubleshooting.

Can SCADA systems be hacked?

Yes, SCADA systems can be hacked, most often through internet-exposed assets and weak credentials. Attackers reach exposed interfaces, then manipulate control logic or disrupt physical operations.