OPC UA can refuse. Almost nobody asks it to.

This series has been a run of the same disappointing result. A pump moved by a stranger. Two name-brand controllers that handed over their setpoints. A broker that trusted anyone who knocked. Every one of them read and written off the wire with no credential, because every one of them was built for a world where the network itself was the security.

So it is worth ending on the exception, because there is one, and it matters. OPC UA is the protocol the others should have been. It came out of the same industrial world, but a decade later, after the lesson had been learned, and it has a real lock built into the specification rather than bolted on after a breach.

I built an OPC UA server with two doors. One with security switched off, the way a server often ends up when someone stood it up to get an integration working and never went back. One with sign-and-encrypt turned on, certificates on both ends. Behind both doors, the same value: a pump speed of 42. I read it through each while a man on the wire watched.

Through the open door, the read came back 42 and the number sat on the wire in plain sight, exactly the kind of readable value the first three parts were built on. Through the locked door, the read also came back 42, and the wire saw an encrypted blob and nothing else. Across the entire capture, both reads succeeding with the same answer, the actual value crossed in the clear exactly once. The secure door carried the same truth and told the wire nothing. You cannot ask Modbus to do that. You can ask OPC UA, and it says yes.

So why does OPC UA still show up in breach stories? For the same reason the broker did. The secure mode is optional, and off-by-default is a decision even when nobody decides it. The open door makes the integration work in five minutes. The locked door needs a certificate on each end, a trust relationship between them, and a commissioning engineer who did not reach for the easy option the moment the handshake threw an error on a Friday afternoon. The lock exists. Turning it takes an afternoon, and the schedule never quite reaches the afternoon.

That is the whole state of OT security in one sentence. The tools to say no exist, more of them every year, and the wire stays readable because saying no is work that the plan keeps deferring.

Put all four parts together and a single rule falls out. The protocols that cannot defend themselves, Modbus and the vendor fieldbuses, you defend at the network: segment the cell, permit only the writes that must happen, watch for the one that should not. The protocols that can defend themselves, MQTT and OPC UA, you defend at the protocol: turn the lock on. And you do both, always, because there is a legacy device in every cell that will never speak the secure version, and a network boundary is the only thing that protects it.

The older the protocol, the more the burden falls on the drawing. The newer it is, the more the protocol will carry, if you let it. OPC UA is the one most willing to carry it, and the one most often deployed with the lock switched off.

I have the two-door capture, the value that appeared once instead of twice, in the lab write-up. And the whole series, every protocol and every capture, starts back at the pump that moved itself.