Your robot is security-certified. Your line isn't.

Here is an uncomfortable observation for anyone who has commissioned a plant. The best security news the robotics industry has produced in years is about to land on most factory floors as a procurement checkbox. KUKA has announced the industry's first Security Level 2 certification under IEC 62443, and it is real progress: a controller developed under a secure lifecycle, hardened, shipping from Augsburg without default accounts. Now watch what happens next. The robot arrives in a crate. It meets the integrator at two in the morning, inherits a PLC program it was never tested against, and gets plugged into a plant network nobody has defended since the drawings were signed. The certificate stops at the crate door. The risk walks through it.

What the certificate covers – and what it never did

IEC 62443-4-2 is component-level evidence. The vendor built the controller under a secure development process (62443-4-1), hardened the attack surface, signed the firmware, ships no default accounts. Real engineering, genuinely difficult, and KUKA earned the paper. Out of scope is everything at system level – 62443-3-3, the zones, conduits and access management across the cell the robot actually lives in. That standard is addressed to the asset owner. In procurement language: you.

A system's security level is the level of its weakest link, not the average of its parts. A component at SL2 inside a cell with a flat network, one shared HMI login and an undocumented remote-access router is a cell at whatever level the router says it is. Quality settled this logic decades ago. A certified gauge does not make a capable measurement system, which is why MSA exists – bias studies, repeatability runs, the gauge tested in the fixture with the operator. Security is relearning the same lesson at network speed.

I read the announcement with both halves of my CV. The quality director asks what evidence the certificate constitutes. The Certified Ethical Hacker – one of thirty-plus security certifications – asks what it leaves out. Procurement is staffed to ask only the first question.

The robot is certified as shipped; the line runs as installed.

Assurance dies at integration

I built the QA/QC department of a 900-plus-employee greenfield plant at SNOP, so I lived through commissioning: launch dates set in stone, customer penalties ticking, integrators on the floor at 02:00 against a handover date. I watched a machine pass its SAT on a Tuesday morning and fail a basic network hygiene check an hour later. Default password still on the HMI. Telnet opened for remote diagnostics. A consumer-grade router zip-tied inside the cabinet so the integrator's engineer could support the cell from another country. Each of those was labelled temporary.

The shared credential was worse than the password: one admin account for the whole maintenance team, so nothing could ever be attributed to a person. Firewall rules appeared over a weekend without touching change management. Here is what should bother every quality professional. Had that integrator changed a torque specification by half a newton-metre, we would have stopped everything – revalidation, capability study, ECN, the full ceremony. The weekend firewall rule drew no signature at all. Every action an integrator takes after delivery is an unmanaged process change; IATF 16949 change control was written for precisely this, and nobody has pointed it at the network.

None of this is theoretical for me. I am listed on T-Mobile's public bug-bounty Hall of Fame for clickjacking – a flaw class that lives entirely in the gap between how a component behaves and how someone embeds it in a larger system. Commissioning is that gap with a launch date attached. The integrator's weekend work was invoiced to the cent. The exposure it created carried no invoice until the day it did, and a single day of unplanned stoppage at tier-one rates starts in six figures. In euros.

Bring the cell inside the quality system

The fix is not new. Supplier quality wrote it decades ago; it only needs aiming at the network the way we once aimed it at the part. Treat the security certificate as you treat a supplier's material certificate – evidence at a point in time, not absolution. Put machine builders and integrators on the approved supplier list and audit them like any other supplier: VDA 6.3-style process audits covering project management and change control, not a self-assessment questionnaire. Then route network, credential and parameter changes through the same ECN discipline as process changes – same form, same change board, same revalidation trigger.

Add a security gate to FAT and SAT, because a machine that ships with a default password should fail final acceptance like a part out of tolerance. No default accounts anywhere in the cell, verified by scan rather than the integrator's word. Named individual logins, because a shared account is a finding, not a convenience. Every open port documented and justified, firewall rules handed over as controlled documents. Firmware versions recorded in the machine file before anyone signs the certificate of conformity.

None of this requires a security department. It requires a quality system that recognises the network as part of the process. An integrator with admin rights and a deadline is the industry's most reliable exploit, and the only countermeasure that scales is the change-control discipline quality already owns.

Two decades in automotive and aerospace taught me one lesson: a certificate opens the conversation; it does not close it. Calibration certificates, PPAP files, CE marks – all scope-limited, all demanding revalidation the moment reality touches the part. Procurement will collect SL2 marks the way it collects CE marks; let them. Quality management and ethical hacking are the same discipline practised at different altitudes – understanding how complex systems fail and building them so they don't. The robot in the crate is certified, and it belongs to the manufacturer. The line is uncertified, outside every component standard's scope, and entirely yours. Own the difference.