> ## Content Index
> Fetch the complete content index at: https://www.thecybersignal.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Unprotected TSN Protocols Could Disrupt Physical OT Processes, Nozomi Research Shows
- URL: https://www.thecybersignal.com/tsn-industrial-protocol-ot-risk-2026/
- Published: 2026-08-23T13:58:00.000Z
- Updated: 2026-08-24T02:58:07.000Z
- Description: New Nozomi Networks research, unveiled at Black Hat, shows how unprotected TSN (Time-Sensitive Networking) protocols could let attackers disrupt or manipulate physical processes in OT networks. It is lab research, not an active campaign, and segmentation is the first defense.
- Author: Nicholas Robert
- Tags: Industrial Control Systems (ICS), Critical Infrastructure, Vulnerabilities

An OT networking protocol built to guarantee that safety-critical messages always arrive on time can, if it is left unprotected, become the thing that strips those guarantees away. That is the uncomfortable takeaway from new research that [Dark Reading surfaced on August 21](https://www.darkreading.com/ics-ot-security/how-emerging-industrial-protocol-family-put-ot-at-risk?ref=thecybersignal.com), showing how attacks against some unprotected TSN (Time-Sensitive Networking) protocols could allow attackers to disrupt or manipulate physical processes in operational technology (OT) environments.

The work comes from Nozomi Networks. Senior security researcher Luca Cremona and colleagues presented it at [Black Hat USA](https://blackhat.com/us-26/briefings/schedule/?ref=thecybersignal.com#deterministic-chaos---exploiting-and-securing-predictable-timing-in-tsn-industrial-networks-on-demand-only-51885) this month in a recorded, on-demand session. TSN is an emerging IEEE 802.1 family of amendments that adds deterministic, real-time communication to ordinary Ethernet, and it is spreading through industrial and automotive networks as plants push control traffic and IT traffic onto shared wiring. The team showed that when one TSN protocol runs without its full set of cyber controls, an attacker already positioned inside the network can tamper with the process variables the protocol is meant to carry safely.

## Why TSN Puts Availability First

TSN exists because industrial networks value availability above almost everything, and that priority is exactly where the security gap opens. When safety signals, synchronized control messages, and ordinary IT packets share the same Ethernet plumbing, a collision between two of them is not a harmless retransmit. In an OT setting it can trip watchdog timers and drop machines into protective shutdown, so TSN acts as a traffic-flow orchestrator that guarantees the highest-priority messages, an emergency-stop signal for example, pass within microseconds no matter what else is congesting the network.

The trouble is that the same mechanism that guarantees delivery can be turned against the process if nothing authenticates it. "Availability and security are very close to one another," Cremona told Dark Reading. "A protocol that is not secured is not guaranteed to be available." A reliability feature with no integrity checks, in other words, is a single point of failure wearing a safety badge.

## What the Nozomi Team Studied

The research is deliberately narrow. It centers on one protocol, CC-Link IE TSN, a Mitsubishi Electric technology that is among the more widely deployed TSN implementations. There is a corporate wrinkle worth stating plainly: Mitsubishi Electric completed its roughly $1 billion acquisition of Nozomi Networks in January 2026, six months before this Black Hat session, so the protocol under the microscope belongs to Nozomi's own parent. Nozomi says it operates independently as a wholly owned subsidiary and keeps a vendor-neutral roadmap. Having a working CC-Link IE TSN installation in the lab is part of what made the study possible.

As the team analyzed the protocol's traffic, Cremona noticed a resemblance to GOOSE, an electrical-substation protocol with a long-known weakness in its predictable timing sequences. Following that hunch, the researchers found a flaw that lets specially crafted signals land in the correct time slot and be accepted as legitimate scheduled communications. That underlying weakness was flagged in a [CISA ICS advisory published July 30](https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-07?ref=thecybersignal.com). (CISA has issued a run of OT network advisories this year, including one for a data-theft flaw in an [NSA-built OT monitoring tool](https://www.thecybersignal.com/cisa-nsa-grassmarlin-ot-data-theft-cve-2026-6807/).) The most important entry point, Cremona said, is the management interface of the TSN switch, and the team also reported previously undiscovered bugs in Phoenix Contact TSN switches, for which a firmware patch is already available. The protocol does ship with a security model and optional cryptographic protection of user data, but shortcomings in its Layer 2 safeguards give an attacker an easier path into the communication stream.

| ● TSN Hardening Layers High-level defender controls for an unprotected TSN network. No exploit detail shown.                                                         |
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Segregate TSN Traffic Keep TSN and non-TSN traffic on separate networks. Nozomi says segregation is currently the only reliable protection.                          |
| Authenticate the Control Plane Treat the switch management interface as a crown-jewel asset. Keep it off broader networks and enable any integrity options on offer. |
| Monitor Timing and Sync Baseline normal synchronization and alert on anomalous clock drift or unexpected changes to scheduled traffic.                               |
| Patch and Coordinate Keep OT network device firmware current and ask TSN vendors what integrity protections their implementation supports.                           |
| The Gap That Remains A flat TSN network with a reachable switch management interface is where the risk of disrupted or manipulated physical processes concentrates.  |
| Source: Nozomi Networks research presented at Black Hat USA 2026, via Dark Reading. Defender view only; no exploitation detail shown.                                |

The high-level hardening layers OT teams control for an unprotected TSN network, and the gap that remains without them. Illustration: The CyberSignal.

## What Is Confirmed, and What Is Not

The specifics here are on the record, which is worth stating because early OT stories often are not. Confirmed: the research is from Nozomi Networks, presented at Black Hat USA; the protocol studied is CC-Link IE TSN; the named vendors are Mitsubishi Electric and Phoenix Contact; and a related CISA ICS advisory exists.

What is not confirmed matters just as much. This is lab research and a conference demonstration, not evidence of an active campaign or in-the-wild exploitation, and no victim organizations are named. The headline risk also generalizes from a single protocol: Cremona calls the work nascent and limited to CC-Link IE TSN, while noting it is a starting point for probing other protocols that rely on the same TSN primitives. So treat "TSN is broken" as an overreach. The accurate reading is narrower and still serious: one widely used TSN protocol, left unprotected at Layer 2, was shown to be manipulable by someone already on the network.

## What OT Operators Should Do Now

The defender takeaway is unglamorous and, for once, close to complete agreement between the researcher and the standard OT playbook. It is the same lesson US agencies pushed in their August warning that an AI-assisted campaign was targeting internet-exposed [Siemens S7 PLCs](https://www.thecybersignal.com/nsa-fbi-cisa-siemens-s7-plc-ai-water-critical-infrastructure-2026/): the fix for an OT exposure is almost always reachability control, not a silver bullet. In priority order:

- **Segment TSN and non-TSN traffic.** Keep the deterministic control network physically or logically separate from IT and best-effort traffic. "Right now, the only way to protect the network is through network segregation," Cremona said. Reachability is the precondition for every scenario in the research.
- **Verify authentication on the TSN control plane.** Treat the switch management interface as a crown-jewel asset. Confirm it is not reachable from a broader network, require strong authentication, and turn on any integrity or cryptographic options the protocol offers rather than leaving them switched off by default.
- **Monitor for anomalous timing and synchronization.** The quieter scenario in the research is a small, hard-to-see clock drift whose effects surface much later, when it is difficult to trace back. Baseline your normal sync behavior and alert on unexpected changes to scheduling or time sources.
- **Coordinate with equipment vendors and patch.** Keep the firmware on OT network devices current (the Phoenix Contact switch fix is already out), and ask your TSN vendors directly what integrity protections their implementation supports today and what is on the roadmap.

## My Read

**My read:** the story is not that TSN is doomed, it is that a protocol family sold on determinism has been quietly carrying the same trust-the-network assumption that has burned OT for decades. Cryptographic fixes are coming, Nozomi says it is working with Mitsubishi on primitives fast enough for sub-microsecond timing, but that is a multi-year effort, and until it lands the defense is the boring one: segregation. If you are deploying TSN because a vendor promised deterministic reliability, treat that reliability as unproven until the control plane is isolated and authenticated. The demonstration happened in a lab. The design assumption it leans on is in production now.

## Primary Documents

- [Dark Reading: How an Emerging Industrial Protocol Family Could Put OT at Risk](https://www.darkreading.com/ics-ot-security/how-emerging-industrial-protocol-family-put-ot-at-risk?ref=thecybersignal.com)
- [Black Hat USA 2026 session: Deterministic Chaos, Exploiting and Securing Predictable Timing in TSN Industrial Networks (recorded)](https://blackhat.com/us-26/briefings/schedule/?ref=thecybersignal.com#deterministic-chaos---exploiting-and-securing-predictable-timing-in-tsn-industrial-networks-on-demand-only-51885)
- [CISA ICS Advisory ICSA-26-211-07 (July 30, 2026)](https://www.cisa.gov/news-events/ics-advisories/icsa-26-211-07?ref=thecybersignal.com)