A practical example of Loss of View is an operator no longer seeing accurate sensor values after an attacker disrupts telemetry or tampers with a display. The process may still be running, but staff lose trustworthy visibility. Teams should check for sudden data gaps, stale readings, and unexpected display changes.
How Loss of View Shows Up in a Real Operation
A practical example is an operator watching a plant dashboard that suddenly shows stale sensor values, missing telemetry, or an unchanged trend line even though the process has moved on. The process may still be running, but the person making decisions no longer has trustworthy visibility into what is actually happening.
That can happen when telemetry is disrupted in transit, when a historian stops receiving updates, or when an attacker tampers with the display layer so the screen looks normal while the underlying state is not.
What Makes Loss of View Operationally Dangerous
loss of view is dangerous because it breaks the human ability to confirm state, detect deviation, and make timing-sensitive decisions. In OT and other monitored environments, the failure is not always immediate process stoppage. The more common danger is that staff continue operating against false confidence, delayed alarms, or a blind spot in an otherwise healthy control loop.
It is especially risky when teams rely on one view of the world, such as a single HMI, a single telemetry path, or a single monitoring console. If that path is corrupted, the operator may trust the wrong picture longer than they should.
How Practitioners Detect It and Separate It from a Real Process Fault
The first question is whether the loss is in the process or in the visibility layer. Compare the operator view with independent sources such as raw sensor feeds, adjacent controllers, alarm histories, and network health indicators. A true Loss of View often shows up as sudden data gaps, frozen values, time drift, or display changes that do not match other evidence.
Look for the pattern, not just the symptom. If readings freeze across multiple tags at once, if alarms stop updating, or if values change in a way that is inconsistent with physical reality, treat the visibility path itself as suspect. That is why OT Security Guide is useful background here, since it covers the industrial control context where manipulation of view and denial of view are practical attack paths.
Risk and Threat Considerations
Loss of View creates a control-room blind spot that attackers can exploit to delay response, conceal manipulation, or force operators into making decisions with bad data. In OT environments, the risk is not only confusion. It is that the defender may keep running a degraded or unsafe process because the display still appears trustworthy.
Failure mechanism: The attacker disrupts telemetry, falsifies readings, or changes what the operator sees, while the physical process continues to run and the false picture masks abnormal state.
Impact: Staff may miss a developing fault, accept unsafe conditions, or misread the effectiveness of a response, which can extend dwell time and increase operational or safety consequences.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 define the specific risk controls and attack patterns relevant to this topic.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T0837 — Manipulation of View | Maps directly to falsifying or distorting operator visibility in OT. |
| T0814 — Denial of View | Covers loss of trustworthy sensor visibility caused by telemetry disruption. | |
| Recommendation — Map suspicious display and telemetry anomalies to view-manipulation techniques and hunt for corroborating evidence. Correlate sudden data gaps and frozen readings with denial-of-view activity in OT telemetry. | ||
| OWASP Non-Human Identity Top 10 | NHI-08 — Environment Isolation | Isolation failures can let one environment's visibility or display path affect another. |
| Recommendation — Segregate monitoring and display paths so compromise cannot distort multiple environments at once. | ||
Practitioner Guidance
What to verify: Treat the operator display as untrusted until you confirm it against an independent source of truth. If stale values, missing tags, or unexplained screen changes appear, validate the telemetry path, the historian, and the display chain before assuming the process itself is stable.
Escalation / exception: Escalate quickly when the same blind spot affects multiple critical signals or when you cannot explain the mismatch within the normal refresh interval. A single failed sensor may be a fault, but a pattern of frozen or inconsistent view data is a visibility incident until proven otherwise.
Practitioner takeaway: The key judgement is to separate process stability from visibility stability, because a system can be running and still be effectively unsafe if operators no longer trust what they see.
Related resources from NHI Mgmt Group
- What is an example of Web-Scale Data Poisoning: Split-View Attack in practice?
- What is an example of Loss Exceedance Curve in practice?
- What is the difference between data leak prevention and data loss prevention in practice?
- Why do traditional endpoint DLP tools often fail to stop insider data loss in practice?