The attack is catalogued. The PFMEA isn't.

Here is an uncomfortable pairing from the week's news. A French supermarket chain lost cold-chain control across its stores because someone, years earlier, bolted a remote-access box onto legacy refrigeration controls and no risk document ever mentioned it again. The compressors stopped honouring their setpoints. Whole aisles of stock went to the bin. The root cause was a modem nobody had inventoried. Anyone who has run a plant knows the particular silence when equipment that always hummed suddenly does not. That same week, MITRE published ATT&CK v20 with expanded OT technique coverage – a public, versioned catalogue of how adversaries break industrial processes. In two decades of supplier audits I have never seen failure documentation maintained to that standard. The best-kept failure-mode catalogue in the industry now describes how to break a factory.

An FMEA written by the enemy

Strip out the security vocabulary and ATT&CK reads like a quality document, because structurally it is one. A tactic is a failure effect: what the process suffers, whether that is spoiled stock or a stopped press. A technique is the failure mode, the specific mechanism that produces the effect. Published mitigations are prevention controls. Detection analytics are detection controls. Severity, occurrence, detection – the entire grammar of a PFMEA, pre-filled and versioned, prioritised by observed real-world frequency rather than by whoever argued loudest in the workshop.

I carry both passports. Two decades of PFMEAs under IATF 16949 and AS9100, and a Certified Ethical Hacker certification that is not decorative – a clickjacking finding on T-Mobile's public bug-bounty Hall of Fame. That finding came out of the same disciplined enumeration that drives an 8D. You list the surfaces, form a hypothesis, verify it, document reproduction steps a stranger could repeat. Whether the target is a web page or a welding cell, the method does not change. Only the consequence does.

A kill chain is a process map drawn by someone whose product is your downtime.

Where the PFMEA stops

Now look at the document that is supposed to protect the line. Every PFMEA I have ever audited – automotive, aerospace, tier one, sub-tier – stops at operator error. Wrong torque, skipped weld, mislabelled container. Malicious input sits out of scope, sometimes implicitly, occasionally in writing. We score the failure modes that have no intent and ignore the ones that do.

The seams are worse than the scope. Severity lives with quality, because quality owns the effect. Likelihood lives with IT, because IT owns the threat. Detection has no owner at all – no procedure claims it. And management of change, the one mechanism that should catch an unassessed device, never sees vendor kit. It arrives during commissioning or a service visit and generates no notice.

I have the scar tissue. During a VDA 6.3 process audit at an automotive plant I found a supplier's remote-diagnostics modem zip-tied inside a control cabinet, quietly bridging the production network to a cellular link. No change notice. No FMEA revision. The maintenance lead told me the vendor fitted it during commissioning – three years earlier. Score that failure mode honestly. Severity: line-down at five figures an hour. Occurrence: unsecured remote access is common enough that a supermarket's refrigeration is this month's public example. Detection: nobody in that plant had ever looked at the device on purpose. A quality engineer forced to put S/O/D on that modem would have killed it in one afternoon.

The standards bodies have already ruled. The ISA/IEC work on integrated functional safety and cybersecurity treats a security event as a safety event with an uninvited author. The convergence is operational, not theoretical. Quality simply has not been summoned to the meeting yet.

Run it like a PFMEA review

The pragmatic version is one meeting. Pick the top ten ATT&CK OT techniques relevant to your line – with vendor remote access in play, that means initial-access techniques for external remote services, engineering-workstation abuse, manipulation of control logic. Book two hours. Put the controls engineer, the quality engineer, IT/OT and whoever signs change notices at one table. Score each technique for severity, occurrence and detection exactly as you would a process failure mode, or use action priority if you follow the AIAG-VDA approach. Then behave like it is a PFMEA: high-priority items get actions with owners and dates, not discussion.

Feed the survivors into layered process audits. An LPA item that asks whether the cabinet holds a device absent from the network drawing – and who put it there – catches the modem class better than an annual penetration test. When something does fire, containment is QRQC muscle memory: isolate, verify scope, document, within the day. The fire drill is a quality discipline long before it is a security one.

The arithmetic is not close. Two hours of eight people costs under €2,000. One afternoon of a stopped line dwarfs that before you price the supermarket's cold aisle.

The attack is catalogued – versioned, public, free. The method is not missing either. Quality has owned it for decades, and it is the only discipline that forces severity, occurrence and detection into the same sentence with a consequence for ignoring them. What is missing is the room: a table where the controls engineer who knows what the PLC will tolerate and the quality engineer who knows how to score a failure mode work the same grid, on the same afternoon. Book that room before the compressors do the scheduling for you.