CODESYS Control Runtime is the runtime software that executes a CODESYS-based control application on an industrial device, such as a PLC, IPC, or embedded controller. It interprets the control logic, manages I/O communication, and provides the execution environment for automation tasks and fieldbus connections.
What the runtime does in an industrial control stack
CODESYS Control Runtime is the execution layer that turns a compiled control application into live automation behaviour on a PLC, IPC, or embedded controller. It sits between the control logic and the physical process, so any weakness at this layer can affect both command execution and fieldbus communication.
Because the runtime is the active enforcement point for machine logic, it is not just a software component, it is part of the device’s trust boundary. If an attacker can influence the runtime, they may be able to alter process behaviour, disrupt I/O exchange, or persist inside the control environment.
Why runtime integrity matters for PLC and embedded control
The runtime’s integrity determines whether the control application that engineers designed is the one that actually executes. In industrial systems, that matters because the runtime is often close to the process, with privileges to manage I/O, communication sessions, and device state. A compromised runtime can therefore create safety, availability, and operational risk even when the application logic itself was written correctly.
This is why defenders should treat the runtime as a high-value execution target, not just a deployment detail. Runtime compromise can invalidate assumptions about deterministic behaviour, trusted inputs, and the correctness of downstream alarms or interlocks.
Exposure points and common failure modes
Exposure usually emerges through the device itself, the management interface, or the network paths used to reach the controller. If the runtime is reachable from poorly segmented engineering networks, exposed remote access channels, or weakly controlled maintenance paths, it becomes easier to probe, tamper with, or brute force.
Failure modes often include unauthorised logic upload, unsafe configuration drift, denial of service against the control process, or manipulation of communications to connected devices. In environments using CODESYS-based stacks, the surrounding industrial protocol and runtime ecosystem also matters, which is why PIPEDREAM ICS Toolkit Guide is relevant as a reference for attack patterns and defensive detection around this platform class.
Security controls for protecting the execution environment
Protection starts with asset inventory and version awareness, because operators need to know where the runtime is installed and how it is exposed. Network segmentation, restricted engineering access, strong authentication for administrative functions, and tight change control all reduce the chance that the runtime can be modified without authorization.
Where the environment depends on compensating measures or an accepted temporary exception, the control decision should be explicit and time bound. Security Exceptions and Risk Acceptance Guide is useful when a plant must document residual exposure, compensating controls, and expiry for a temporary operational concession.
For broader runtime hardening, defenders should also watch for default trust assumptions in automation components, especially where the controller must interact with tools, agents, or supervisory systems. Agent Controls and Monitoring Guide and OWASP Agent Control Standard Guide are useful navigation points when runtime governance extends into policy enforcement, approvals, and monitored execution paths.
Risk and Threat Considerations
Because the runtime is the execution authority for the controller, compromise can have immediate operational consequences, including altered outputs, process disruption, and loss of trustworthy control state. If attackers gain access to the runtime path, they can target the same layer that validates, runs, and maintains the automation task.
Failure mechanism: Attackers exploit weak access control, exposed management interfaces, or untrusted update and engineering paths to modify runtime behaviour, interrupt I/O, or maintain persistence on the device.
Impact: The result can be unsafe process behaviour, service interruption, hidden manipulation of control logic, and reduced confidence in the integrity of the industrial environment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-7 — Software, Firmware, and Information Integrity | Protects runtime integrity and detects unauthorized changes to control software. |
| AC-6 — Least Privilege | Limits who can reach or modify the control runtime and its management functions. | |
| CM-2 — Baseline Configuration | Covers controlled runtime configuration and drift management for industrial devices. | |
| Recommendation — Verify runtime binaries and control logic integrity before deployment and during operation. Restrict runtime administration to the minimum set of approved operators and services. Maintain approved baseline settings for the runtime and detect unauthorized configuration drift. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Applies to hardening and controlling the runtime host and its software settings. |
| Recommendation — Harden the controller host and lock down the runtime configuration to approved values. | ||
Related resources from NHI Mgmt Group
- What is the difference between prompt-based control and runtime authorization for agents?
- When should organisations treat runtime telemetry as a primary control?
- What is the difference between compliance evidence and runtime access control?
- What is the difference between vaulting and runtime access control?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org