Why compressors are now part of the cybersecurity picture
A compressor used to be a machine with a relay panel. Today many controllers have Ethernet ports, Modbus interfaces, web pages, cellular modems and links to the manufacturer’s cloud. Sequencers, BMS and SCADA connections, energy meters and remote-monitoring gateways sit around them. Each connection brings value, and each creates a path that someone could misuse, deliberately or by accident.
The consequences are practical rather than abstract:
- Availability. A changed setpoint or a stop command can starve production of air.
- Integrity. Wrong data on a dashboard can lead to wrong decisions, such as ignoring a real temperature rise.
- Safety. A remote start while a technician is working inside the canopy is dangerous.
- Confidentiality. Production and energy data can reveal operating patterns a plant may not want to share.
This page sets out practical principles. It is general guidance, not a security certification or a design for any specific site.
Who owns what
Most problems start with unclear ownership. Before connecting anything, agree roles in writing.
| Role | Typical responsibility |
|---|---|
| Plant owner / asset owner | Decides what is acceptable risk; owns the compressors and the data |
| OT / controls owner | Control architecture, PLCs, sequencers, BMS/SCADA |
| IT / network owner | Networks, firewalls, accounts, remote-access tools |
| Maintenance | Day-to-day use, alarm response, local isolation |
| Service provider (such as us) and equipment makers | Configuration and service access only as authorised, logged and time-limited |
Know what is connected: the asset inventory
You cannot protect devices you do not know about. A compressed-air inventory should list:
- each compressor controller, its make and firmware version;
- sequencers or master controllers;
- VSD drives with communication cards;
- gateways, protocol converters and cellular modems, including any fitted by a manufacturer or service company;
- dew-point, flow and energy meters with network connections;
- the systems they talk to: BMS, SCADA, historian, cloud platforms;
- default passwords that have not been changed, and who knows the current ones.
Plants are often surprised to find a modem added years ago for a trial that still has a working SIM card.
Practical principles for a secure compressor network
- Segment the network. Keep compressor controllers and other plant equipment on an OT network separated from the office network, with controlled, documented connections between them.
- Prefer read-only. Most needs are met by reading data. Allow write commands only where designed, approved and tested.
- Least privilege. Each user or system gets only the access it needs. Operators view; engineers change settings; nobody shares one admin login.
- Change default passwords on controllers, web interfaces, gateways and modems.
- Control remote access. Service connections should be enabled on request, used under supervision, logged and closed afterwards, not left open permanently.
- Disable what is not used. Unused ports, web servers and protocols on gateways and controllers.
- Manage changes. Firmware updates, parameter changes and new connections go through change control with a backup of settings first.
- Keep local control. A local emergency stop and local/remote switch at each machine override all remote functions.
International frameworks such as the IEC 62443 series describe these ideas in depth for industrial automation. Your IT/OT team or a specialist should apply them to your site.
Monitoring, control and remote service compared
| Connection type | What can go wrong | Typical safeguards |
|---|---|---|
| Read-only monitoring | Data seen by the wrong people; false values shown | Accounts, encryption where available, data-quality flags |
| Supervisory commands (enable, setpoint) | Air supply stopped or pressure changed without authority | Approved design, limited commands, logging, fail-safe defaults |
| Remote start/stop/reset | Machine started during maintenance; trip reset without inspection | Local lock-out overrides, interlocks, written procedures, usually avoided |
| Remote service and configuration | Unlogged changes; permanent open access | On-request access, supervision, logging, backups before change |
| Manufacturer cloud link | Unclear data ownership; outbound connection outside site control | Contract terms, IT approval, ability to disconnect |
Availability and recovery
Security also means being able to recover. Plan for the day a controller is replaced, a gateway fails or settings are lost.
- Keep a backup of every compressor and sequencer parameter set, dated, stored off the device.
- Record pressure settings, rotation order and fallback settings on paper in the compressor room.
- Make sure each compressor can run on local pressure control if all networks are down.
- Know how to restore a controller after replacement and who holds the configuration tools.
- Have a plan for temporary air: a standby compressor, or a rental machine with prepared connection points.
Common weak points we come across
- Controllers and gateways with factory-default passwords.
- A cellular modem installed by a past supplier that nobody manages.
- Compressor network on the same flat network as office PCs.
- Remote reset enabled for convenience.
- No backup of controller settings, so a replacement controller is set up from memory.
- Service laptops connected directly to the OT network without checks.
A step-by-step review for an existing compressor room
Most plants are not starting from a blank sheet. They already have a mix of connected and unconnected machines, added over years by different suppliers. A short structured review brings this under control without stopping production.
- Walk the room. Photograph every controller, drive, gateway, modem and network cable. Note anything with an antenna or a SIM slot.
- Trace each connection. For every cable or wireless link, record where it goes and who installed it. Unknown connections are disconnected or documented, never left as they are.
- Classify each function. Mark each link as read-only, supervisory, full remote control or service access. Most should be read-only.
- Check credentials. Change default passwords, remove accounts belonging to people or companies no longer involved, and record who holds the current ones.
- Back up settings. Save the configuration of each compressor controller, sequencer and drive where the equipment allows, and write down the key pressure and protection settings.
- Test fallback. With production agreement, disconnect the network link and confirm each compressor carries on under local control and that a communication alarm appears.
- Write the rules. A one-page procedure covering who may connect, how remote sessions are approved and how changes are recorded.
- Repeat yearly, and after any new installation, controller replacement or change of service provider.
Rental and temporary compressors
Temporary machines are easy to overlook. A rental compressor brought in during an overhaul or a shutdown may carry its own telematics, and connecting it to a plant sequencer or BMS for a few weeks still creates a real connection. Treat it the same way: agree what it reports, who can see the data, whether any remote command is possible, and disconnect it cleanly when the machine leaves site. On our own hire jobs, running hours and fault history feed the service plan, with machines serviced every 300 running hours.
How we work on connected compressors
When our engineers work on compressors with communication or remote features, we follow your site rules. We connect service tools only with permission, record parameter changes, back up settings before changing firmware or configuration where the controller allows, and leave remote functions as we found them unless you authorise a change. We do not install modems or open remote access without your written approval.
How Reddy Compressors helps
We are an independent multi-brand compressed-air specialist at Tarnaka, Secunderabad, serving industry since 2002. We service and supply ELGi, Atlas Copco, Ingersoll Rand, KAESER, Chicago Pneumatic, Sullair, Doosan, Kirloskar, Gardner Denver and other makes, and are not an authorised dealer for any brand. We have tie-ups with all major and reputed brands. We are compressor engineers, not a cybersecurity certification body; our role is the compressed-air side.
- We list which controllers, drives and gateways in your compressor room have communication features and what they can do.
- We help your IT/OT team understand which points are read-only, which accept commands and what the safe fallback is.
- We back up and document compressor and sequencer settings during service and AMC visits.
- We supply new and used compressors and controls, and rental units from our own fleet as cover during changes.
Our service teams cover all of Telangana and Andhra Pradesh, and we supply across India.
What to send us
- Make, model, serial and nameplate photos of compressors, dryers and drives.
- Photos of controller displays and any network ports, modems or gateways.
- A sketch of what connects to what: BMS, SCADA, cloud, laptops.
- Your site rules for contractor access and remote connections.
- Contact details for your IT/OT owner.
Frequently asked questions
Can an air compressor be hacked?
A compressor with a network connection, web interface or modem can in principle be accessed by someone who should not have access, especially if default passwords are unchanged or the network is not segmented. The risks are stopped air supply, changed settings or misleading data. Reducing them is mostly basic practice: an inventory, changed passwords, segmented networks, read-only monitoring and controlled remote access.
Is it safe to connect my compressor to the manufacturer’s cloud?
It can be, if your IT team approves the connection and you understand what data leaves the site, who owns it and whether the platform can send commands. Prefer read-only connections, check the contract terms, and make sure you can disconnect without affecting the compressor’s local operation. Keep the device on a separated network rather than the office LAN.
Should remote service access be left open for the compressor supplier?
Generally no. Remote service access should be enabled when needed, used under your supervision or agreement, logged and closed afterwards. Permanent open access is a common weak point. Agree the process in writing, including who approves a session and how changes are recorded.
What is the safest way to monitor compressors remotely?
Use read-only monitoring through a segmented OT network or a managed gateway, with individual accounts and changed default passwords. Keep start, stop, setpoint and reset functions local unless they have been formally designed and approved. Make sure compressors continue on local control if the link is lost, and that a communication failure raises an alarm.
What happens if a compressor controller is replaced and settings are lost?
Without a backup, settings must be rebuilt from manuals and memory, which risks wrong pressure bands, protection limits or sequencing. Keep a dated backup of every controller and sequencer configuration, plus a paper record of key settings in the compressor room. After replacement, re-check communication points and alarms before returning the machine to automatic service.
Does a firewall make my compressor network secure?
A firewall helps, but it is only one part. Security also depends on knowing every connected device, changing default passwords, keeping monitoring read-only where possible, controlling remote service sessions, managing firmware and setting changes, and being able to restore controller settings after a failure. A firewall with permanent open rules or an unmanaged modem behind it gives a false sense of protection.
Related pages
Field guide
Connected compressors: Data ownership and cybersecurity
Once a compressor or controller is connected to a network or the internet, it becomes part of the plant’s IT and operational technology (OT) estate. That brings benefits and responsibilities.
Questions to answer
- Who owns the data? Agree with the supplier what is collected, where it is stored and who can access it.
- Who can change settings remotely? Limit write access to named people, and log changes.
- How is it connected? Prefer outbound-only connections through a managed gateway, separated from production control networks.
- How are passwords and updates managed? Change default passwords, keep firmware current and remove access when people leave.
- What happens if the connection fails? Machines must continue to run safely under local control.
Keep a simple register of connected devices, their purpose and the person responsible for each.
What to send for a quotation
- Make, model and serial number of every compressor and dryer in the station.
- Running hours and a typical week of operation (shifts, weekends).
- Current pressure settings and controller type on each machine.
- Any alarm or fault history you have.
Send it through find my part or the spare parts enquiry, or call +91 99590 60718 or +91 92468 88812.
Technical content reviewed by D. Srinivas Reddy, Managing Partner and service engineer, Reddy Compressors. Last updated 17 October 2026. How our engineering content is reviewed.