What Is a Denial-of-View Attack in OT Systems?

A denial-of-view attack is one where operators lose the ability to see what an industrial process is actually doing, even if the process keeps running. In operational technology (OT), the screen, alarm or sensor reading that tells staff the temperature, pressure or flow goes dark, freezes or stops updating. The November 2026 US fact sheet on refrigeration controller attacks lists denial of view as one of two impacts of a compromised cold-chain controller, alongside direct temperature changes.

What is a denial-of-view attack?

A denial-of-view attack is any attack that blocks operators from monitoring a physical process in real time. The process may keep running normally, drift on its own or be changed by the attacker, but the people responsible cannot see it happen.

MITRE ATT&CK for ICS treats this as a family of impacts. Denial of View describes a temporary loss of the operator's display or data. Loss of View describes a lasting one. Manipulation of View, the most dangerous of the three, means the operator still sees values, but they are false.

How is denial of view different from denial of control?

Denial of view takes away the operator's eyes, while denial of control takes away their hands. In a denial-of-control attack, staff can see the problem but cannot change setpoints or stop equipment from the usual interface.

The two often appear together. In the European supermarket attacks, controllers were forced into continuous defrost and heating. If the same controller also feeds the temperature display and alarm, operators lose both the ability to see the temperature rise and the ability to correct it from the panel.

Why does losing visibility matter so much in cold storage?

Cold storage is a slow-failure environment. A freezer that stops cooling does not fail in seconds. Product warms over hours. That delay is the window in which staff can move stock, call a technician or switch to manual control. Visibility is what turns that window into a response.

Take away visibility and the window closes unnoticed. Staff find the problem at the next shift or the next manual check, when the product is already outside its safe range. For food, that means discarded inventory. For blood products, vaccines or lab samples, it can mean a regulated loss with mandatory reporting and patient impact.

The CISA, FBI, HHS, USDA and DOT fact sheet names this effect directly: a compromised controller can cause loss of visibility into current temperatures, which the agencies call a denial-of-view condition.

Where denial of view comes from

Not every loss of view is an attack. The same symptom can come from:

• A compromised controller. The attacker changes settings, disables alarms or stops the device from reporting.
• Network disruption. The link between the controller and the monitoring server is cut or flooded.
• Ransomware on the monitoring server. The controllers keep working, but the Windows host that runs the dashboard and sends alerts is encrypted.
• Ordinary failure. A dead sensor, an expired cellular plan on a remote gateway or a cloud monitoring outage.

The response is the same in each case: someone has to notice that data stopped arriving, then check the physical process another way. Telling an attack from a fault comes later.

How do you detect a denial-of-view condition?

You detect it by alerting on missing data, not only on bad data. A monitoring system that alarms when a temperature crosses a threshold stays silent when readings stop altogether, so add a check that fires when a sensor has not reported for a set period.

Practical detection steps:

1. Alert on stale readings. Set a heartbeat or "no data" alarm per sensor, sized to the product's tolerance. A freezer of plasma needs a shorter window than a cooler of bottled drinks.
2. Alert on alarm changes. Treat a disabled alarm, a changed alarm threshold or a muted notification as a security event, not a configuration detail.
3. Compare against an independent sensor. A battery-powered data logger or a second monitoring system that does not depend on the controller shows whether the controller's reported value matches reality.
4. Watch the network. The fact sheet advises capturing network traffic to and from OT assets that lack usable logs. A controller that stops talking to its monitoring server, or starts talking to a new address, is worth a call.

These checks pair well with tight setpoint limits. Our guide on how to set refrigeration setpoint limits and alerts covers the deviation side; stale-data alerts cover the silence.

Reducing the impact

The goal is to make sure that losing one view never means losing all of them.

• Separate monitoring from control. Where possible, the system that records and alarms on temperature should not be the same device an attacker would compromise to change it.
• Keep a manual reading path. Dial thermometers, standalone loggers and scheduled walk-through checks are slow but hard to attack remotely.
• Route alerts to people who can act. An alert that lands in a shared mailbox overnight is a denial of view of its own.
• Write down what staff do when the screen goes blank. That plan is the subject of why cold storage sites need a manual fallback plan.

Denial of view rarely makes headlines on its own, because the damage is reported as spoiled stock or a failed process. Treat it as an impact you plan for, and the controller attacks of 2026 become a recoverable event instead of a discovery the next morning.