Loss of Safety (T0880) is the outcome where an adversary compromises the functions that should bring a process to a safe state when conditions become dangerous. Safety systems exist because many unsafe conditions develop faster than a person can react; if they are disabled, the next upset can become an injury, a release or damaged plant. MITRE ATT&CK for ICS v20 lists T0880 as an Impact technique, and its detection strategy states plainly that no standard detection method currently exists for it. That shifts the work to preventing the techniques that lead to it, watching for those, and planning a safe response. This guide is for process safety engineers, control engineers, OT security engineers and site leaders. It goes deeper on the impact than the Safety Instrumented Systems Security Guide, which covers SIS architecture and IEC 61511 in detail.
Key takeaways
- It is an outcome, not an action. ATT&CK describes adversaries targeting and disabling safety functions as a prerequisite to further attack or to let future unsafe conditions go unchecked.
- Detection is indirect. MITRE's DET0779 records no standard detection method, so defenders detect the enabling techniques, such as program download to a safety controller.
- Two real cases. ATT&CK records Triton reprogramming SIS logic, and CyberAv3ngers manipulating critical shutdown and alarm logic in the 2026 Iranian Water Campaign.
- Isolation and mechanical layers are the mapped mitigations. ATT&CK lists Safety Instrumented Systems (M0812) and Mechanical Protection Layers (M0805).
- Detection can itself cause disruption. ATT&CK notes that strict safety policies may force a shutdown once loss of safety is detected, which can serve an adversary seeking disruption.
What T0880 covers
ATT&CK describes T0880 as adversaries compromising safety system functions designed to maintain safe operation when unacceptable or dangerous conditions occur. Safety systems are often built from the same elements as control systems, but their sole purpose is to make the process fail in a predetermined safe manner. ATT&CK notes that speed is critical in correcting these conditions to limit impacts such as Loss of Control (T0827) and property damage.
Two consequences follow from ATT&CK's description. First, loss of safety may be quiet: a safety function can be disabled long before any hazard occurs, waiting for an upset. Second, when operators detect it, plant policy may require a shutdown, causing Loss of Productivity and Revenue (T0828). Either way the adversary gains. See T0827 Loss of Control and T0828 Loss of Productivity and Revenue.
| Impact technique | What is lost | Typical layer |
|---|---|---|
| T0880 Loss of Safety | Safety system functions that keep a process safe when unacceptable or dangerous conditions occur | Safety instrumented system and related safety functions |
| T0837 Loss of Protection | Protective functions designed to prevent the effects of faults and abnormal conditions | Protection relays and protective logic |
| T0827 Loss of Control | Sustained ability to issue commands, even after interference subsides | Basic process control system |
| T0829 Loss of View | Sustained reporting or visibility of process state | HMI, SCADA, historian |
For the neighbouring protection impact see T0837 Loss of Protection, and for the tactic as a whole the ATT&CK for ICS Impact Tactic Guide.
Procedure examples in ATT&CK
Triton (S1009)
ATT&CK records that Triton can reprogram SIS logic to allow unsafe conditions to persist, or reprogram the SIS to allow an unsafe state while using the DCS to create an unsafe state or hazard. Mandiant's original analysis describes an attacker who gained remote access to an SIS engineering workstation and used Triton to reprogram Triconex SIS controllers. Some controllers entered a failed safe state and shut the process down when application code between redundant processing units failed a validation check; Mandiant assessed with moderate confidence that this shutdown was inadvertent while the attacker was developing the ability to cause physical damage. The safety system did what it was designed to do, but only because the attacker's code failed.
CyberAv3ngers (G1027)
During the 2026 Iranian Water Campaign, ATT&CK records that CyberAv3ngers manipulated critical shutdown and alarm logic, which would allow the system to enter unsafe process states without proper notification or protections. The joint advisory AA26-097A (FBI, CISA, NSA, EPA, DOE, US Cyber Command's Cyber National Mission Force and the Department of the Treasury; published 7 April 2026, updated 22 July 2026) describes added logic overriding instruction sets that maintain safe operating parameters, and the disabling of critical shutdown and alarm logic, in PLCs reached over the internet. The lesson for many water and energy sites is that safety-relevant logic often lives in ordinary PLCs, not a separate certified SIS. See the Water and Wastewater Cybersecurity Guide.
Detecting the path to loss of safety
Because DET0779 contains no standard analytic, build detection on the techniques that precede the impact. The table lists enabling techniques drawn from the Triton and 2026 cases and the signals that matter on safety assets.
| Enabling technique | Signal on safety assets | Source |
|---|---|---|
| Program Download (T0843) | Any program download, online edit or append to a safety controller outside an approved safety change | Protocol monitoring on the safety network conduit; safety engineering workstation logs |
| Change Operating Mode (T0858) | Safety controller key switch or mode moved out of run outside a scheduled programming event | Controller diagnostics and alarm journal; key position audits |
| Modify Program (T0889) | Safety application hash differs from the approved version | Periodic comparison against the stored safety baseline |
| Alarm Suppression (T0878) and Modify Alarm Settings (T0838) | Safety-related alarms shelved, suppressed or changed without a recorded operator action | Alarm journal and historian |
| Any new connection to the safety network | Traffic to safety controllers from hosts other than the safety engineering workstation or approved data gateway | Network monitoring; Mandiant recommends monitoring ICS traffic for unexpected flows |
Process data gives a final check: a trip demand condition that occurs without the expected safety action, or bypasses and overrides that stay active beyond their approved time, both deserve immediate review with process safety. See ICS T0858 Change Operating Mode, T0889 Modify Program and the OT Network Security Monitoring Guide.
Prevention: ATT&CK mitigations and Triton lessons
| Control | Source guidance | Practical application |
|---|---|---|
| M0812 Safety Instrumented Systems | ATT&CK: ensure all SIS are segmented from operational networks | Own zone for the SIS; conduit only to the safety engineering workstation and an approved data path |
| M0805 Mechanical Protection Layers | ATT&CK: protection devices should have minimal digital components; examples include interlocks, rupture disks and release valves | Keep non-digital layers in the hazard analysis and maintain them; they act whatever the software does |
| Engineering workstation isolation | Mandiant: workstations that can program SIS controllers should not be dual-homed to other DCS or IT networks | Dedicated safety engineering workstation; see the Engineering Workstation Security Guide |
| Hardware programming control | Mandiant: use physical key switches; keep keys out of PROGRAM mode except during scheduled programming; manage and audit key position changes | Key position in the safety change procedure and shift checks |
| One-way data flow | Mandiant: use a unidirectional gateway instead of bidirectional connections for applications that depend on SIS data | Historian and DCS read SIS data through a one-way path |
| Host restriction | Mandiant: strict access control and application allowlisting on any host that can reach the SIS over TCP/IP | Allowlisting on the safety engineering workstation and gateways |
Where safety logic lives in ordinary PLCs, AA26-097A's steps apply directly: remove internet exposure, set controllers to run mode, enable programming protection, review running project files for unauthorised changes, and keep tested offline backups. The OT Cyber Physical Risk and Safety Guide covers how to bring cyber scenarios into hazard analysis, and the Safety and Security Co-engineering Guide covers joint working between the two disciplines.
Where identity fits
Triton began with remote access to an SIS engineering workstation. Every account that can reach that workstation, and every vendor or integrator credential used for safety system support, is a path to this impact. Keep a short, named list of people with safety engineering access, require multi-factor authentication for any remote path, make vendor access time-bound and supervised, and remove it when the work ends. See the OT and ICS Identity and Access Guide and the OT Remote Access Guide.
How to implement
- Inventory safety functions: list every function that brings the process to a safe state, including safety logic in ordinary PLCs, with the controller and network each depends on.
- Baseline the safety applications: store hashed, approved versions offline, under the safety change procedure.
- Isolate: move safety controllers and their engineering workstation into their own zone; replace bidirectional links with one-way paths where data is only read. Test changes on a non-production system or during a planned outage, with the previous configuration kept for rollback.
- Control programming: key switches in run, programming protection on PLCs holding safety logic, key position audits on each shift.
- Monitor the enabling techniques in the detection table, in alert-only mode first, with process safety agreeing what an approved safety change looks like.
- Rehearse the response jointly with operations and process safety before an incident.
Decision guidance
- Certified SIS present: focus on isolation, key switches, a dedicated engineering workstation and monitoring of the safety conduit.
- Safety logic in ordinary PLCs (common at small water and wastewater sites): treat those PLCs as safety assets; no internet exposure, run mode and programming protection come first.
- Integrated control and safety platforms: confirm with the vendor and process safety how logical separation is enforced and monitored.
- Where digital layers cannot be secured quickly: confirm mechanical protection layers are in place and maintained, as M0805 suggests.
Responding to a suspected loss of safety
This is a process safety event first. Security does not decide how the plant runs.
- Hand the decision to operations and process safety, who will follow the site's procedure for operating with a degraded safety function, which may mean a controlled shutdown or added compensating measures.
- Preserve evidence without touching safety logic: network captures from the safety conduit, safety engineering workstation logs and images, key position records and the controller diagnostic buffer.
- Contain the access path: isolate the safety engineering workstation and remote access routes; check other controllers reachable from the same hosts.
- Restore a verified safety application under the safety change procedure, with proof testing as process safety requires, before declaring the function restored.
- Report: notify national authorities and regulators as your sector requires, and the safety system vendor.
See the OT Incident Response Guide.
Detection and measurement
- Inventory completeness: percentage of safety functions mapped to controllers, including those in ordinary PLCs.
- Isolation: number of hosts that can reach safety controllers, against the approved list.
- Key discipline: safety controller key positions out of run outside scheduled programming, per quarter.
- Baseline integrity: percentage of safety applications checked against stored hashes in the last quarter.
- Bypass hygiene: safety bypasses or overrides active beyond their approved time.
- Rehearsal: date of last joint safety and security exercise.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK for ICS v20 | T0880; M0805, M0812; DET0779; S1009, G1027; enabling T0843, T0858, T0889, T0878 | Impact, mitigations, cases and enabling techniques |
| NIST SP 800-53 Rev. 5 | SC-7 Boundary Protection, CM-3 Configuration Change Control, CM-5 Access Restrictions for Change, SI-7 Software, Firmware, and Information Integrity, SI-4 System Monitoring, IR-4 Incident Handling | Isolation, safety change control, integrity, monitoring and response |
| NIST CSF 2.0 | ID.RA-03, PR.IR-01, PR.PS-01, DE.CM-01, RS.MA-01 | Threat identification, network protection, configuration management, monitoring and coordinated response |
Common failure patterns
- Safety logic in PLCs not treated as safety: internet-reachable PLCs held shutdown logic in the 2026 activity.
- Dual-homed safety engineering workstation: one compromise reaches both the DCS and the SIS.
- Key switch left in program: the controller accepts new logic from any host that can reach it.
- Bidirectional data links for convenience: a read-only need opens a write path.
- Assuming a trip proves safety works: Triton's shutdown came from failed attacker code, not from a defence.
Practitioner checklist
- List every safety function and the controller and network it depends on.
- Keep hashed, approved safety applications offline.
- Segment safety controllers and give them a dedicated engineering workstation.
- Use one-way data paths where SIS data is only read.
- Keep key switches in run and audit them each shift.
- Monitor downloads, mode changes and new connections on the safety conduit.
- Maintain mechanical protection layers in the hazard analysis.
- Rehearse a loss-of-safety response with operations and process safety.
Standards and references
- MITRE ATT&CK for ICS: Loss of Safety (T0880)
- MITRE ATT&CK: Detection of Loss of Safety (DET0779)
- MITRE ATT&CK: Triton (S1009)
- MITRE ATT&CK: CyberAv3ngers (G1027)
- Mandiant: Attackers Deploy New ICS Attack Framework TRITON
- FBI, CISA and partners: AA26-097A, Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · Safety Instrumented Systems Security Guide · OT Cyber Physical Risk and Safety Guide · ATT&CK for ICS Impact Tactic Guide