+14% / 30d
PLC exposure increasing in East Asia
Japan · South Korea · Taiwan
EtherNet/IP · MELSEC · FINS
Remote accessibility increases the number of pathways between digital infrastructure and physical operations.
View constellation →The physical world is already online.
Observe internet-visible industrial systems before exposure becomes an incident. Exposure counts and distributions shown in the public preview are illustrative and do not represent a live inventory of internet-connected systems.
The physical world is already online.
Observe internet-visible industrial systems before exposure becomes an incident.
Exposure
View 02 — Exposure
See where the physical world touches the network.
Exposure
Something was reachable.
Signal
Something moved.
Pattern
Something connected.
Incident
Something happened.
These stages do not imply an inevitable progression. Exposure does not automatically become an incident; a signal does not automatically become an attack; a pattern does not automatically confirm attribution. Threat Constellation observes transitions and relationships without assuming causation.
Exposure state model
Internet-visible does not mean vulnerable. Vulnerable does not mean compromised.
Exposed
Internet-reachable or externally visible.
Not an automatic transition
Vulnerable
A known or suspected weakness may affect the system.
Not an automatic transition
Exploited
Evidence indicates that a weakness is being actively used.
Not an automatic transition
Compromised
Unauthorized access or control has been confirmed.
Exposure is not evidence of compromise.
An internet-visible industrial system may be securely configured. Visibility alone does not establish vulnerability, exploitation, or unauthorized access.
Illustrative observations · 30d
Stable · 312 systems
Remote engineering interfaces remain internet-visible
Manufacturing · Energy · Infrastructure
Siemens S7 · OPC UA
Remote engineering access may create a direct bridge between external networks and industrial control environments.
View constellation →+6% / 30d
Building automation broadening in metropolitan areas
United States · Singapore
BACnet · Modbus
Facility systems are increasingly reachable, expanding exposure beyond traditional industrial sites.
View constellation →View 03 — Pathway
From cyber risk to physical consequence
The point is conceptual: digital access can eventually influence physical behavior.
Internet
Remote access
Industrial network
PLC / Controller
Robot · Motor · Conveyor · Sensor
Physical world
In IT security, compromise affects information.
In industrial systems, compromise can affect motion.
View 04 — Physical AI
Physical AI meets cyber exposure
As machines gain autonomy, the boundary between cybersecurity and physical safety becomes thinner. Physical AI expands the importance of understanding the infrastructure beneath autonomous machines.
Intelligence sits on top of infrastructure. Autonomous systems do not operate in isolation.
AI
Robot
PLC / Controller
Industrial network
Remote infrastructure
Internet
Observation lenses
What this observation layer helps reveal.
What is reachable?
Internet-visible industrial services, remote interfaces, controllers, gateways, and supporting infrastructure can be observed at an aggregated level.
Signals are observations, not conclusions. Data may include public intelligence, network telemetry, security advisories, and verified incident reports.
Exposure extension
DEVICE / SYSTEM EXPOSURE
AMBIENT EXPOSURE
Exposure created by being physically present within a sensing environment, even without active network participation.
ネットワークに能動参加していなくても、感知環境の中に身体があることで生じる露出。
Connected observation
The Ambient Observer
Exposure is no longer only a property of reachable devices. Presence inside a sensing field can itself become an exposure surface.
Observe the ambient layer →Exposure extension
PERIMETER / OUTPUT INSPECTION
BEHAVIORAL SUPERVISION
As systems gain autonomy, exposure is joined by a second question: whether runtime behavior, identity, authorization, and legitimacy are being observed at all. Supervision here is not only regulation. It is the secondary infrastructure that decides whether an action can be trusted.
Connected observation
The Supervisory Layer
What is supervising autonomous behavior?
Trace the second layer →Exposure extension
WHAT IS REACHABLE / WHAT CAN BE SENSED
WHAT CAN THE AGENT PHYSICALLY CHANGE
Exposure created when an autonomous system can initiate, modify, or repeat a physical action after gaining authorized access to equipment.
認可された機器アクセスのあと、自律システムが物理的な動作を開始・変更・反復できることで生じる露出。
Connected observation
Physical Action
What can the agent physically change?
Trace physical-action supervision →