The hack is a setpoint. The chart is the alarm.

Here is an uncomfortable observation from this week's news. Intruders hit refrigeration systems across Europe – supermarket cold rooms, food-plant chillers – and the security industry filed it under cybercrime. I read the reports and saw something else: an unauthorised process change. Nobody stole data. The attackers changed cooling setpoints.

Product sat outside its validated temperature range and spoiled, and no quality alarm fired anywhere, because quality had never imagined a hostile actor inside the parameter table. SANS reports that about a third of industrial organisations have suffered an operational-technology incident. This is not exotic.

It is Tuesday.

A setpoint attack is an unauthorised process change

Run the incident through PFMEA logic and it stops being a technology story. A cooling setpoint is a validated process parameter, no different in kind from a torque target, a cure temperature or a weld current. Its authority comes from validation alone: someone proved that product made at 4°C conforms, and the parameter was frozen on that evidence. Move it to 14°C and the validated state is gone. In quality terms every unit made under the unvalidated value is suspect stock, and suspect-stock rules apply whether the shift came from tool wear, an engineer's typo or a keyboard in another country.

Motive is not an input to disposition.

That indifference is a strength. The QRQC sequence – stop, bracket the window, quarantine, verify by independent measurement, disposition – was built for shifts whose cause we did not yet know. Across two decades in automotive and aerospace plants I have run it on causes ranging from a drifting sensor to a maintenance handshake that skipped a step. The day the cause turns out to be malicious, the first four hours of the response are still ours. The security team arrives later. Containment is a quality function.

The control chart does not care about motive

An X-bar shift is a shift. The chart does not know why the mean moved, and it was never told the process could only fail through wear and drift – which is exactly why it works as a tamper detector. Sustained interference in a parameter table produces the signature SPC was designed to catch: a run of points off centre, a step change, a trend. A plant with a disciplined output-side control plan has a tamper detector on every line, already staffed, already calibrated, already audited. Nobody has told the security team it exists.

Motive lives in the attacker's head, not in the distribution. Measure where motive cannot hide.

There is an older principle underneath: never trust the controller's own readback. Metrology people have preached this for years about self-reported machine data, and it maps one-to-one onto security. A PLC logging its own parameters is testifying about itself, and an adversary with access to the parameter table can often shape the log as well. Independent output-side measurement – real parts, real gauge – is the one version of events the intruder cannot quietly rewrite.

One trade-off has to be settled before the incident: retention. To bracket an intrusion window you need process records reaching back past the earliest plausible change. If your SPC history lives for 90 days and the intruder has held the parameter table for 140, you cannot show where clean product begins. Everything is suspect. The recall letter writes itself.

The conversation quality and security have not had

The gap irritates me because I have worked both sides of it. Two decades of control plans, QRQC and VDA 6.3 process audits, including the QA/QC monitoring for a 900-employee greenfield plant, built from an empty building upward. On the other side, a CEH certification and a responsible-disclosure credit on a telecom operator's bug-bounty Hall of Fame for a clickjacking finding. I have been the person who investigates an unexplained process shift and the person who finds the exposed interface. From either chair the playbook reads the same: assume nothing is as validated as its paperwork claims, and measure independently.

Three moves would close most of the distance. Run a joint tabletop whose scenario ends not in IT restoration but in quality disposition: six weeks of product, one compromised parameter – what ships? Add parameter-integrity questions to internal process audits: who can change this setpoint, how the change is authorised, how you would catch one that skipped authorisation. In the audits I led, that last question was never on anyone's list. And pre-agree ownership, because when the root cause is malicious, containment and disposition still belong to quality. An 8D does not get easier because the root cause has an IP address.

Then do the arithmetic in euros. A plant pushing €2 million of output a week that discovers a two-week-old unauthorised parameter change is looking at up to €4 million of quarantined stock before sorting, rework and scrap. The same change caught by a control chart inside 24 hours costs a shift's containment and a few thousand euros of investigation. That spread, a factor of a hundred or more, is the price of two departments that have never sat in the same room.

My standing claim, earned from both sides: quality management and ethical hacking are one discipline – the study of how complex systems fail and the construction of systems that do not. The plant that investigates every unexplained shift as though it had an adversary is ready for tool wear and port scanners with the same discipline. I have sat in a meeting where a six-figure firewall renewal was approved in ten minutes, then in the next one where someone queried the cost of printing the control charts beside line 3. The cheapest intrusion detection system in most plants has been on the wall for years. Walk the security team over and introduce them.