40,000 ICS interfaces are on the public internet. Most have no password.

Shodan's industrial index and recurring CISA scanning exercises find the same thing year after year: HMIs running on port 80, engineering workstations with RDP exposed, historians accessible over default credentials, and PLCs responding to Modbus queries from any IP. None of this requires an exploit. A browser and a search query are enough to reach operational technology that controls physical processes — water treatment, energy generation, manufacturing lines.

The 40,000 figure is a floor, not a ceiling. It counts devices that respond to known industrial protocols. It does not count devices behind misconfigured firewalls that still allow inbound traffic on specific ports, or devices exposed only through vendor remote access portals that are themselves internet-facing. The actual exposure surface is larger than what any public scan can see.

The Human Machine Interface was designed to sit on a private network, operated by trained personnel, in a physically secured facility. Its authentication model reflects that assumption: many run with no password at all, or with factory defaults that have not changed since commissioning. Adding an internet-facing connection to a device that was designed around physical access controls does not make it secure — it removes the only layer of security the manufacturer planned for.

The most common path to exposure is not a deliberate decision. It is an IT team that added a remote monitoring solution for operational convenience, a vendor that required internet-facing access as a condition of support, or a network change that broke an assumed isolation boundary without anyone in OT being told. The device did not move. The boundary moved around it.

The first step is a scan of your own perimeter — not waiting for CISA to send a notification. Tools like Shodan, FOFA, and Censys will show you what your OT environment looks like from the outside, often within minutes. If you find your HMI before an attacker does, you have a remediation window. If you find it after, you are already in incident response.

Removal from the internet is the remediation. Not a firewall rule, not a VPN in front of an already-exposed interface — removal. Where remote access is genuinely required, it belongs behind an OT-specific access gateway with MFA, session recording, and least-privilege controls. The vendor who needs to reach your PLC does not need to reach your entire control network. Scope the access to the system, and monitor the session.