By Leslie Shields, Lead Systems Engineer at ITI Group
Balancing security with information availability
According to Waterfall Security’s 2025 report (opens in new tab), cyber-attacks with physical consequences increased by 146% in 2024 rising from 412 affected sites in 2023 to 1,015 in 2024. As more OT components become connected, the attack surface continues to grow.
Securing a PI System therefore requires balancing OT imperatives (availability, safety, real-time performance) with IT principles (defence in depth, least privilege, encryption, and auditability). The convergence of these two worlds introduces risk. An insecure OT pathway could allow an attacker to reach enterprise IT systems, or vice versa.
For that reason, layered architecture, segmentation, and controlled interfaces are essential.
Be Security Ready
Because the PI System bridges both Operational Technology (OT) and Information Technology (IT) domains, security must respect the requirements of each. A weak link on either side can have far-reaching consequences.
As part of ITI Group’s Real-Time Data Services, we regularly perform PI System Audits to identify security gaps, performance issues, and improvement opportunities across our clients’ PI Systems.
A typical audit includes a comprehensive security review covering both PI System configuration and the underlying system architecture. On average, our audits uncover four to five critical or high-level security risks, along with several lower-level vulnerabilities.
AVEVA PI System Audits
In this article, we’ll focus on the security aspects we assess during PI System Audits and share some of the common critical and high-level security issues we encounter.
Threats & Attack Vectors
When evaluating PI System security, we consider a range of potential threats and attack vectors, including:
- Unauthorized access to PI Data Archive, PI AF, or PI Vision.
- Privilege escalation within PI’s built-in security.
- Man-in-the-Middle (MitM) or replay attacks on data flows.
- Misconfiguration or weak hardening of Windows hosts.
- Legacy components (like PI Interfaces, old connectors) vulnerable to exploits.
- Uncontrolled lateral movement from OT to IT networks or vice versa.
- Weaknesses in identity management or credential storage.
- Lack of logging, auditability, or monitoring.
Securing access to the PI System requires thinking about authentication, trust, and access level permissions.
Authentication Mechanisms
Older versions of the PI System rely on Windows Integrated Security (WIS) whereas PI Server 2023+ can utilise OpenID Connect (OIDC) for authenticating to PI services. OpenID Connect uses TLS/SSL to encrypt all authentication methods. Pre 2023 versions of PI Server do have encryption for WIS connections, however, do not support encryption for PI Trusts and rely on weaker identity flows. In PI Server 2023+ PI Trusts are fully encrypted.
In several PI System Audits, we have encountered misconfiguration of IP-based trusts. Engineers often misunderstand the netmask field setting it to the subnet rather than the individual host. This inadvertently grants access to every device on that subnet, sometimes with elevated privileges.
This mistake quietly exposes the PI Data Archive to unintended systems, often with elevated privileges. In some cases, the trust was mapped to high-level identities, increasing the risk of data manipulation or configuration changes.
Beyond correcting the netmask, our recommendation is to move away from PI Trusts altogether. For systems prior to 2023, where Trusts lack encryption and granular control, transitioning to Windows-based PI Mappings with least-privilege service accounts and group-based roles provides better security and traceability. This approach aligns with modern enterprise security policies and authentication standards.
Authorisation and Access Control
Access control is another critical focus area. We frequently find that users or service accounts are granted more privileges than necessary, violating the principle of least privilege.
Each account’s access—whether Read, Write, or Admin—should be reviewed carefully. Where needed, create dedicated PI Identities or Groups with narrowly scoped permissions for each component.
A particularly risky pattern is when multiple users, groups, or trusts are mapped to the “piadmin” identity, which grants unrestricted administrative control. This represents a critical-level vulnerability that attackers can exploit.
Backup & Recovery
Backup configuration is another high-risk area where we see frequent issues. Common findings include:
- No daily backups implemented
- No offline (air-gapped) backups maintained
- Failed backups not being monitored or investigated
We recommend implementing daily backups for PI Data Archive, PI AF databases, and configuration files. Backups should be stored securely offline and restore tests should be conducted regularly to confirm recoverability. A clearly documented backup and recovery policy is essential.
Other Challenges & Considerations to Watch For
In addition to the critical and high-level risks we have discussed there are several challenges and considerations to also take into account when evaluating your PI System’s security that may not be explicitly covered during a normal PI System Audit. These include:
- Legacy Systems & Backwards Compatibility
Many sites will still run PI Interfaces or older OS versions that cannot be upgraded easily. In such cases, isolating and hardening them is critical.
- Performance vs Security Trade-offs
Encryption, logging, and intrusion detection can add latency or overhead. You must carefully balance system responsiveness with security.
- Organizational Silos (IT vs OT)
Aligning security goals, change windows, and responsibility boundaries between IT and OT teams is often challenging but essential.
- Regulatory & Compliance Requirements
For example, in the UK/EU, frameworks like NIS2 (or forthcoming Cyber Security and Resilience legislation) demand stronger incident reporting, governance, and resilience. Ensuring your PI System is mapped into your broader compliance regime is important. Our recent blog post “NIS2 & UK Cyber Security: What PI System Admins Need to Know” covers more on this topic.
- Scalability & Complexity
As your PI System grows (multi-site, cloud, remote collectors), maintaining consistent security policies, identity mappings, and patching grows more difficult.
Securing the AVEVA PI System is not just about setting the security configuration in the PI System itself; it’s about embedding security into the architecture, operations, and governance of your PI System.
At ITI Group, we help organisations identify vulnerabilities, strengthen defences, and align their PI Systems with modern cybersecurity standards.
If you’d like to discuss a PI System Audit or learn more about improving your system’s security posture, contact us today.