Loss of View is a cyber effect where operators can no longer see the true state of a process or control system. Attackers hide alarms, suppress telemetry, or falsify status so the wrong response is taken. Defenders should verify data from independent sources, protect historian and HMI paths, and alert on unexpected gaps or inconsistencies in process visibility.
What “loss of view” actually means
loss of view is less about one sensor failing and more about the operator’s picture of the process becoming untrustworthy. The control system may still be running, but the displayed state no longer matches reality because alarms are hidden, values are delayed, or status is falsified. That makes it a visibility attack as much as a control-system attack.
The key issue is trust in the operator interface and the data path behind it. In an industrial environment, a false calm can be just as dangerous as an obvious outage because it changes how humans and automation decide what to do next.
How attackers create a false operational picture
Loss of View is usually produced by interfering with the channels that carry telemetry, alarm state, and event data. Attackers may suppress alerts, alter historian records, freeze a display, or feed the HMI a believable but stale status. The result is not necessarily immediate shutdown, but an operator who is steering with bad information.
This is especially effective when the compromised path sits between the field devices and the people who rely on them. If the historian, HMI, or reporting chain is treated as authoritative without independent checks, the attacker can change what is seen without necessarily changing what is physically happening. For industrial environments, the OT Security Guide is the most direct place to connect this effect to segmentation, historian trust, and plant visibility paths.
Why detection and response become harder
Once visibility is degraded, the main operational risk is bad decision-making. Operators may continue normal operations during a developing incident, mis-rank an alarm, or delay shutdown because the screen does not show the true condition. That can turn a contained compromise into a process safety, availability, or environmental event.
Loss of View also tends to hide the attacker’s footprint. A process that looks stable can mask manipulated setpoints, disabled alarms, or missing telemetry, which means the defender may not notice compromise until an independent measurement, physical symptom, or third-party report forces a re-check. External guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls and MITRE ATT&CK Enterprise Matrix helps anchor the issue in integrity, monitoring, and adversary technique tracking.
Risk and Threat Considerations
Loss of View matters because it attacks the trust relationship between the process and the operator. If defenders rely on a single telemetry path, a single historian, or a single HMI layer, an attacker can create a misleadingly normal picture while the underlying process changes in ways the operator no longer sees.
Failure mechanism: The attacker disrupts integrity or availability of visibility data by hiding alarms, falsifying status, or suppressing telemetry, so the operator’s response is based on a false representation of the process.
Impact: The environment can drift into unsafe operation, delayed response, or missed containment because the control room no longer has trustworthy situational awareness.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Loss of View depends on tampering with alarms, telemetry, or visibility records. |
| SI-4 — System Monitoring | Continuous monitoring is needed to spot missing telemetry and inconsistent state data. | |
| SC-7 — Boundary Protection | Segmentation limits attacker reach to historian and HMI paths used to distort view. | |
| Recommendation — Correlate audit and monitoring data to detect suppressed or altered process visibility. Monitor process visibility paths for gaps, inconsistencies, and unexpected silence. Isolate HMI, historian, and control networks to reduce visibility-path tampering. | ||
| MITRE ATT&CK | T1562 — Impair Defenses | Hiding alarms and suppressing telemetry are defense-impairment behaviours in OT compromise. |
| Recommendation — Map alarm suppression and telemetry tampering to defense-impairment detections. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Visibility attacks often remove or alter the records needed to see what changed. |
| Recommendation — Protect and review logs that prove whether process visibility was altered. | ||
Practitioner Guidance
What to verify: Treat the HMI or historian as one input, not the source of truth. Verify the same process state through independent telemetry, field instrumentation, engineering access, or an out-of-band monitoring path before trusting the displayed condition.
What to prioritise: Focus first on the visibility chain that can mislead operators at scale, especially alarm handling, historian integrity, and any path that can suppress or rewrite process status without leaving an obvious operational symptom.
Practitioner takeaway: The most dangerous part of Loss of View is not that data disappears, but that it becomes believable enough to drive the wrong response, so resilience depends on independent verification of process state.
Related resources from NHI Mgmt Group
- How can fraud teams and IAM teams work together after a document loss?
- Who is accountable for SaaS data loss when browser-based work creates gaps in legacy controls?
- Why do remote work environments increase the risk of data loss and account compromise?
- What should security teams do when insider threat monitoring needs to work alongside AI tools and data loss prevention?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org