26 Jul 2026 · 5 min read
Modbus isn't insecure. Your network is.
security · modbus · ot · architecture
Every few months a security vendor rediscovers that Modbus has no authentication, no encryption, and no way to tell a legitimate command from a malicious one, and writes the same breathless post about it. The facts are correct. The conclusion — Modbus is dangerously insecure, panic — is lazy, and it points everyone at the wrong fix.
Here's the more useful way to say it: Modbus isn't insecure. It's exposed. Those are different problems with different solutions, and confusing them is why so much OT security money gets spent in exactly the wrong order.
The protocol did its job. The walls moved.
Modbus was published in 1979 for a serial link — one master, a few slaves, a run of RS-485 cable inside a locked panel. In that world, "no authentication" wasn't an oversight. It was correct. The security boundary was the room. If you could put bytes on that wire, you were already standing inside a facility that had locks, fences, and people. Adding a password to the protocol would have solved a problem that physics had already solved.
1979 · the wall was the panel
2026 · the wall is gone
Nothing about the protocol changed between 1979 and now. What changed is that somebody put it on Ethernet, gave it a routable IP, connected that network to the business network, connected that to the internet for a bit of remote convenience, and left port 502 answering to the entire planet. The protocol is doing exactly what it was designed to do: trust whoever can reach it. The mistake was making it reachable.
Blaming Modbus for this is like blaming the interior doors of your house for not having deadbolts. They don't need deadbolts. The front door does — and somebody left it open.
The Shodan number is mostly theatre
You'll see the scary statistic: search Shodan for port:502 and you get
around 770,000 results. It
gets quoted as "770,000 exposed industrial devices," and it makes for a great
slide.
It's also mostly noise. A huge share of those hits are honeypots (security researchers want you to knock), Modbus simulators, load balancers, and things that answer on 502 without being an industrial device at all. When researchers actually filter for confirmed, responding ICS equipment, the number collapses to a few hundred.
So the honest version is less viral and more uncomfortable: the apocalyptic count is inflated, and the real count is still indefensible. A few hundred genuinely exposed control systems — pumping stations, small utilities, building management — is not a rounding error when any one of them controls something physical. And the trend is real: ICS vulnerability disclosures nearly doubled between 2024 and 2025. Don't panic at 770,000. Do lose sleep over the few hundred that are real.
Yes, there's a "secure Modbus." No, it's not the answer.
Since 2018 there has been an official Modbus Security specification: Modbus wrapped in TLS, X.509 certificates or pre-shared keys, running on port 802 instead of 502. It's real, it works, and almost nobody uses it.
The reflex is to call that an adoption failure. I'd call it a correct instinct. Bolting TLS onto a 1979 protocol encrypts the link between two devices that should already be sitting inside a segmented zone where nothing untrusted can reach them. If your architecture is sound, the encryption buys you very little. If your architecture is broken — Modbus routable from the internet — then TLS on that link is a padlock on a screen door. Secure Modbus solves the last 5% for people who've already done the first 95%. Most haven't, which is why the spec sits unused and the plants that need it most aren't the ones deploying it.
The industry buys security upside down
Here's the part that actually costs money. Walk into a plant that just had a scare and you'll often find a six-figure OT intrusion-detection appliance on a purchase order — deep packet inspection, anomaly-detection ML, a dashboard in the SOC — sitting on top of a network where port 502 is still reachable from the corporate VLAN, and a vendor's remote-access box is still dialed in because it was convenient during commissioning.
The expensive tools aren't useless. They're just bought first, when they should be bought last. Almost everything that shows up on Shodan is stopped by the boring, free work at the bottom of that list: don't route control protocols to the internet, segment the network into zones with a default-deny firewall between them, and rip out the remote-access shortcuts nobody documented. None of it demands a new budget line. All of it gets skipped because it isn't a product you can buy, and it makes someone admit the architecture was wrong.
This is the same argument I made about which layers of a SCADA stack are allowed near the cloud: the control layer stays local, behind a boundary, full stop. Modbus security isn't a protocol feature you enable. It's the zone-and-conduit discipline of IEC 62443 applied honestly — which is unglamorous, which is why it doesn't sell.
The threat isn't who you think
The mental model of an OT attack is Stuxnet: a nation-state, custom malware, a years-long operation. That happens, but it's not what the Shodan-exposed devices are exposed to. The realistic threat to a small utility with port 502 open is opportunistic and dumb — someone runs a scan, finds an unauthenticated device, and pokes it because they can. The bar is low not because attackers are brilliant, but because the exposure is careless. That's genuinely good news: careless is fixable, and it's fixable for free.
What to actually do
Nothing here is exotic. Assume Modbus trusts anyone who can reach it, because it does, and design so that "anyone who can reach it" is a very short list:
- Never let a control protocol touch a public IP. Not "behind a password." Not reachable at all. If remote access is genuinely needed, it goes through a VPN into a jump host, not a port forward.
- Segment. Zones and conduits, a default-deny firewall between OT and IT, and between cells. This is the single highest-value thing on the list.
- Kill the convenience. The undocumented cellular modem, the vendor's always-on remote box, the "temporary" rule from a commissioning three years ago. Those are the front door standing open.
- Monitor what you already have before buying something new — even basic logging of what's talking to your PLCs beats an unwatched six-figure box.
- Then, if you want, deploy secure Modbus or an IDS. Last, not first.
Modbus will never have a password, and it doesn't need one. The vulnerability was never in the packet. It's in the network drawing that put a 1979 protocol one hop from the internet and called it modernisation.
Fix the drawing.
Reviewing an OT network's exposure, or arguing about where the security budget should go? Tell me about it.
Keep reading
