ENES
Book a testBook a test

What we test

What we test, system by system

We know what your plant runs on. So do criminals.

Built only from public sources: rules, standards, official advisories, research and press reports.

Refrigeration controllers

Controllers hold each cold room’s temperature, defrost and alarms, and your refrigeration contractor may watch them from outside.

What Cantic does In one authorised engagement, Eclipse found a way to switch a food supplier’s fridges off remotely. Every engagement is under NDA, so no client is named.

Technical detail and sources

Central management units control temperatures, defrost cycles and alarms for every chiller and freezer, and internet connectivity “has long been a supported option” so contractors can diagnose faults and adjust settings remotely (Euronews). These supervisors can change defrost schedules, temperature setpoints and alarms, and with responsibility split between contractor, site and IT, “no single party may have complete visibility into the exposed service” (Forescout). Researchers counted 12,976 internet-exposed service observations of refrigeration management systems, on 6,017 public IP addresses in 99 countries and territories (Forescout, October 2026).

Who connects from outside
Your refrigeration contractor, through a web page, a vendor portal or a remote connection, to diagnose faults and adjust settings without a site visit.
How it ends up reachable from the internet
Internet access is switched on for remote maintenance and the management page ends up on a public address, sometimes behind a default or weak password, sometimes on models that no longer receive security updates. In France, ANSSI’s director told the Senate the attackers exploited equipment exposed directly to the internet, administered without particular protection, and weak passwords.

The rules

  1. CERT‑FR: exposing a management interface on the internet is contrary to good practice. After the October 2026 attacks it told operators to check the whole configuration, especially defrost schedules. 5
  2. France’s cyber security agency called it urgent to disconnect such systems from the internet, or at least to filter access very tightly. 6

Sources

  1. Euronews, Why are supermarket fridges connected to the internet?, . Read on .
  2. Forescout (Vedere Labs), Cold chain, open control: exposed refrigeration systems reveal global risk, . Read on .
  3. franceinfo, Un piratage pas si sophistiqué que ça : ce que l’on sait de la cyberattaque qui a fait monter en température les frigos de supermarchés, . Read on .
  4. Public Sénat, Des défauts de sécurisation élémentaire et des mots de passe faibles ont permis la cyberattaque contre les frigos de supermarchés, . Read on .
  5. CERT‑FR (ANSSI), Alerte CERTFR‑2026‑ALE‑012, . Read on .
  6. Public Sénat, Cyberattaque contre des frigos connectés de supermarchés : des systèmes de réfrigération exposés sur internet, alertent des experts en cybersécurité, . Read on .

Engine rooms

Where industrial cold is made: compressors, a plant controller and gas detectors, maintained by an authorised refrigeration company.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

Ammonia (R-717) and CO2 (R-744) plants are spreading in European industry and retail: 111,650 transcritical CO2 installations and 4,100 low-charge ammonia industrial sites at the end of 2025 (ATMOsphere data, reported by Cooling Post). Spain’s refrigeration safety regulation classes ammonia as B2L, in group L2; where alarms warn of a leak they must also alert an authorised person, and CO2 detectors alarm at 5,000 and 10,000 ppm (RSIF). INCIBE‑CERT lists an advisory on an industrial refrigeration plant controller, published on 27 February 2026, on its food sector page.

Who connects from outside
The authorised refrigeration company that maintains the plant under contract and, on some systems, receives its leak alarms.
How it ends up reachable from the internet
Alarms and fault reports have to reach the maintenance company at any hour, so the plant controller is linked out through a gateway, a modem or a remote monitoring service. Where that link can be reached from the internet, it is a way in.

The rules

  1. Level 2 installations: more than 30 kW of compressor power in one system, more than 100 kW in total, cooling controlled-atmosphere rooms, or using L2 or L3 refrigerants such as ammonia (Article 8). 2
  2. Owners of Level 2 installations must keep a maintenance contract with an authorised refrigeration company; those using L2 or L3 refrigerants need civil liability insurance of at least €500,000 (Article 18). 2
  3. Sites holding 50 tonnes or more of anhydrous ammonia fall under the major-accident (Seveso) rules, with an upper tier at 200 tonnes. 4

Sources

  1. Cooling Post, Retail CO2 systems in Europe exceed 100,000, . Read on .
  2. Boletín Oficial del Estado (BOE), Real Decreto 552/2019, de 27 de septiembre, por el que se aprueban el Reglamento de seguridad para instalaciones frigoríficas y sus instrucciones técnicas complementarias, . Read on .
  3. INCIBE‑CERT, Alimentación. Read on .
  4. Boletín Oficial del Estado (BOE), Real Decreto 840/2015, de 21 de septiembre, por el que se aprueban medidas de control de los riesgos inherentes a los accidentes graves en los que intervengan sustancias peligrosas, . Read on .

Production lines

Small industrial computers run every machine on the line, and its builder or integrator may connect in for support.

What Cantic does With Fortify, we review the systems that run your operations and plan for the day they go down.

Technical detail and sources

A PLC is “a solid-state control system that has a user-programmable memory”, an HMI is the hardware or software through which an operator interacts with a controller, and SCADA gathers data and applies controls across the plant (NIST SP 800-82r3). “Many OT protocols have no authentication at any level”, and most vendor default passwords are easy to find in product manuals (NIST). Between November 2023 and January 2024, state-linked actors took over at least 75 internet-exposed PLC and HMI units of a type used in food and beverage manufacturing, among other sectors, through default or missing passwords (CISA advisory AA23‑335A).

Who connects from outside
Machine builders and system integrators, who connect remotely for maintenance and support; NIST says that access should follow least privilege.
How it ends up reachable from the internet
A remote support link, a 4G router or a forwarded port puts a panel or controller on the internet, sometimes still with the maker’s default password. The FBI also warns that attackers may move from the office systems to the plant.

The rules

  1. The EU Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and adds cyber-safety provisions for safety control systems; machinery placed on the market before then follows the old directive. 4
  2. The Cyber Resilience Act’s design rules apply in full to products placed on the market from 11 December 2027; controllers already installed are generally covered only if they are substantially modified. 5
  3. US agencies’ first steps for plant systems: remove connections to the public internet, change default passwords, secure remote access, separate IT from OT, and practise manual operation. 6

Sources

  1. NIST, NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, . Read on .
  2. CISA et al., Cybersecurity Advisory AA23‑335A, . Read on .
  3. FBI, Private Industry Notification 20210901‑001: Cyber Criminal Actors Targeting the Food and Agriculture Sector with Ransomware Attacks, . Read on .
  4. European Commission, Machinery. Read on .
  5. European Commission, The Cyber Resilience Act: Summary of the legislative text, . Read on .
  6. CISA, FBI, EPA, DOE, Primary Mitigations to Reduce Cyber Threats to Operational Technology, . Read on .

Building management

Heating, ventilation, lighting, doors and alarms: one more network of controllers, which another contractor may look after.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

A building automation system “is a type of OT used to control” HVAC, fire, electrical, lighting, physical access control and other utility systems; it records history such as temperature and humidity, alerts staff to failures and alarms, and talks to controllers and gateways over wired or wireless links (NIST SP 800-82r3, section 2.3.5).

Who connects from outside
The building services contractor, which may connect remotely for maintenance, as vendors and integrators do across plant systems.
How it ends up reachable from the internet
A gateway that lets the contractor in from outside, or a management page left reachable from the internet.

The rules

  1. NIST says remote access by vendors and integrators should follow least privilege. 1
  2. Know what you have: keep an inventory of every controller with its protocols, addresses and models. 2

Sources

  1. NIST, NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security, . Read on .
  2. CISA et al., Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators, . Read on .

Temperature recorders

Probes in rooms, trucks and cabinets record temperatures for inspectors and customers, and alert phones when something drifts.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

A typical chain is wireless probes, a gateway on site and a cloud dashboard with SMS or app alerts. Remote monitoring lets supermarkets keep food-safety temperature records automatically instead of staff checking each cabinet by hand up to four times a day (Euronews). INCIBE‑CERT notes that attacks also target the operational technology and Internet of Things systems the food industry uses for sensing and process automation.

Who connects from outside
The monitoring provider’s cloud service, the staff who receive alerts on their phones, and whoever installed and maintains the gateway.
How it ends up reachable from the internet
Cloud dashboards and the gateways that feed them are on the internet by design, so the login is the door.

The rules

  1. Transport, warehousing and storage of quick-frozen food need recorders meeting EN 12830, EN 13485 and EN 13486, with recordings dated and kept for at least a year; retail display cabinets need only a visible thermometer. 3
  2. Since 1 August 2025, cybersecurity requirements apply to defined categories of internet-connected radio equipment; the EN 18031 standards give no presumption of conformity where a product lets the user skip setting a password. 4

Sources

  1. Euronews, Why are supermarket fridges connected to the internet?, . Read on .
  2. INCIBE‑CERT, Alimentación. Read on .
  3. EU Official Journal (legislation.gov.uk), Commission Regulation (EC) No 37/2005 on the monitoring of temperatures in the means of transport, warehousing and storage of quick-frozen foodstuffs intended for human consumption, . Read on .
  4. European Commission, Guidance on the application of the harmonised standards series EN 18031:2024 in support of Commission Delegated Regulation 2022/30. Read on .

Remote access

The firms that keep your plant, cold and computers running can log in from outside. Each connection is a door.

What Cantic does Your IT company runs your systems; we attack them. Findings and fixes go to your own team or your IT provider.

Technical detail and sources

VPNs, remote desktop, remote monitoring and management (RMM) tools, vendor cloud portals, 4G routers and port forwarding. RMM software has “significant capabilities to monitor or operate devices and systems”, attracts attackers, “especially ransomware groups”, and often does not trigger antivirus or EDR, while compromising one managed service provider can reach many of its customers (CISA and partners, June 2023). In July 2021 a US bakery was shut for about a week by ransomware deployed through software used by its IT provider (FBI).

Who connects from outside
Line integrators, refrigeration contractors, building services firms and IT providers, from their own offices and phones.
How it ends up reachable from the internet
A remote desktop port open to the internet, a VPN without multi-factor authentication, a vendor portal with a shared or stale contractor login, or a 4G router added for support. Joint advisory AA25‑343A, from 26 agencies including Spain’s Guardia Civil and Policía Nacional, names food and agriculture among the sectors attacked through minimally secured, internet-facing remote access (VNC) connections.

The rules

  1. NIS2 Article 21(2)(d) requires supply chain security, including the relationships between each company and its direct suppliers or service providers. 4
  2. Secure remote access: a private connection or a VPN with phishing-resistant multi-factor authentication. 5
  3. Replace shared or stale contractor credentials with named identities, multi-factor authentication, least privilege and session logging. 6
  4. Spanish rules require ammonia plants and other large refrigeration installations to have a maintenance contract with an authorised refrigeration company. 7

Sources

  1. CISA, NSA, FBI, MS-ISAC, INCD, Guide to Securing Remote Access Software, . Read on .
  2. FBI, Private Industry Notification 20210901‑001: Cyber Criminal Actors Targeting the Food and Agriculture Sector with Ransomware Attacks, . Read on .
  3. CISA, FBI, NSA et al., Cybersecurity Advisory AA25‑343A, . Read on .
  4. EU Official Journal (publications.europa.eu), Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), . Read on .
  5. CISA, FBI, EPA, DOE, Primary Mitigations to Reduce Cyber Threats to Operational Technology, . Read on .
  6. Forescout (Vedere Labs), Cold chain, open control: exposed refrigeration systems reveal global risk, . Read on .
  7. Boletín Oficial del Estado (BOE), Real Decreto 552/2019, de 27 de septiembre, por el que se aprueban el Reglamento de seguridad para instalaciones frigoríficas y sus instrucciones técnicas complementarias, . Read on .

Warehouse systems and cranes

Knows where every pallet is and drives the scanners, the docks and, in automated freezer stores, the cranes.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

A WMS with warehouse control and PLCs for conveyors and stacker cranes, RF terminals and label printers. In one published automated deep-freeze warehouse, the WMS “takes full control of all transport and storage systems”, and the automation supplier took a maintenance contract with round-the-clock standby (Logistics Matters). In 2025 ransomware made up around half of recorded incidents against logistics firms, including cold-chain and third-party logistics providers (ENISA Threat Landscape 2026).

Who connects from outside
The automation supplier on a round-the-clock maintenance contract, the WMS vendor’s support team, and customers and hauliers through portals.
How it ends up reachable from the internet
Support connections for the automation supplier and the WMS vendor, and portals for customers and carriers. ENISA lists third-party platforms, managed file-transfer systems, shipment data and public-facing portals among logistics firms’ exposure points.

The rules

  1. IFS Logistics version 3 requires the product defence plan to include “IT (cyberattack)”, with an alert system defined and tested. 3

Sources

  1. Logistics Matters, Automated deepfreeze. Read on .
  2. ENISA, ENISA Threat Landscape 2026, . Read on .
  3. IFS, IFS Product and Food Defence Guideline, version 2, . Read on .

Reefer telematics

Reports where each truck is and how cold its load is; some systems let the office change settings from a dashboard.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

Commercial telematics platforms advertise two-way control of trailer refrigeration units: real-time temperature, out-of-range alerts, adjusting setpoints, switching units on and off and clearing alarms from a dashboard (a fleet telematics product page). Quick-frozen food in transport needs recorders meeting EN 12830 (Regulation (EC) No 37/2005).

Who connects from outside
Dispatchers and managers, through the telematics provider’s cloud platform and mobile apps, from anywhere.
How it ends up reachable from the internet
The dashboard is a cloud service on the internet by design; whoever holds a dispatcher’s login can see the fleet and, on some platforms, change unit settings.

The rules

  1. In Spain, refrigerated vehicles may only be put or kept in service after ATP inspections: the first conformity check six years after the pre-service inspection, then every three years. 3
  2. Quick-frozen food in transport needs recorders meeting EN 12830, with recordings dated and kept for at least a year. 2

Sources

  1. A fleet telematics vendor. Read on .
  2. EU Official Journal (legislation.gov.uk), Commission Regulation (EC) No 37/2005 on the monitoring of temperatures in the means of transport, warehousing and storage of quick-frozen foodstuffs intended for human consumption, . Read on .
  3. Boletín Oficial del Estado (BOE), Real Decreto 237/2000, de 18 de febrero, . Read on .

ERP

Orders, stock, lots, purchasing and invoices. If it stops, orders, dispatch and invoicing stall.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

Spanish firms run ERP families from the large vendors and many local and sector-specific ones, in a management software market described as very fragmented (Channel Partner, 2022). According to INE, 60.9% of Spanish companies with 10 or more staff use ERP software, and 68.2% in Catalonia (first quarter of 2026). Among US agricultural co-operatives, ransomware at a business management software company spread to several of its co-operative clients (FBI, 2022).

Who connects from outside
The software reseller and the IT provider, for support and updates, and staff working from home or on the road.
How it ends up reachable from the internet
A remote desktop or web login published for staff and the reseller; hosted and cloud editions sit on the internet by design. The FBI counts Remote Desktop Protocol weaknesses among the most common ransomware infection routes.

The rules

  1. NIS2 lists supply chain security, incident handling and business continuity, including backups and disaster recovery, among the minimum measures for companies in scope (Article 21(2)). 5

Sources

  1. Channel Partner, El mercado de software de gestión mueve 825 millones de euros en Iberia, . Read on .
  2. Instituto Nacional de Estadística (INE), Encuesta sobre el uso de TIC y del comercio electrónico en las empresas, . Read on .
  3. FBI, CISA, USDA, Private Industry Notification 20220420‑001: Ransomware Attacks on Agricultural Cooperatives Potentially Timed to Critical Seasons, . Read on .
  4. FBI, Private Industry Notification 20210901‑001: Cyber Criminal Actors Targeting the Food and Agriculture Sector with Ransomware Attacks, . Read on .
  5. EU Official Journal (publications.europa.eu), Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), . Read on .

Traceability

Who supplied each lot, and who received it. A recall depends on this data.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

Food businesses must identify their suppliers and the businesses they supplied, and “have in place systems and procedures” to give this to the authorities on demand (Regulation (EC) No 178/2002, Article 18). Logistic units carry an SSCC in a GS1-128 barcode with batch and expiry data, shared through EDI or EPCIS (GS1 Sweden). Weighing and labelling stations on the line feed lots and labels into the ERP.

Who connects from outside
Customers and authorities, who receive lot data, and the software and labelling suppliers who support the stations.
How it ends up reachable from the internet
Lot data leaves the plant through EDI, portals and data-sharing services, and every supplier login on the weighing and labelling systems is part of what an attacker can reach.

The rules

  1. If a food is not safe, the operator must withdraw it and inform the authorities (Article 19). 1

Sources

  1. EU Official Journal (legislation.gov.uk), Regulation (EC) No 178/2002 laying down the general principles and requirements of food law, . Read on .
  2. GS1 Sweden, GS1 Package Number (SSCC). Read on .

HACCP records

The checks and logs that prove the food is safe: temperatures, cleaning and corrective actions.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

HACCP requires monitoring at critical control points, corrective actions, verification, and documents and records “commensurate with the nature and size of the food business” (Regulation (EC) No 852/2004, Article 5). These records increasingly live in quality software, digital checklists and automated temperature logs. ISO 22000:2018 lists cybersecurity among the issues a food safety management system must consider (quoted in the IFS Product and Food Defence Guideline).

Who connects from outside
Quality software providers, and the temperature monitoring service that feeds the logs.
How it ends up reachable from the internet
Records kept in hosted quality software, or fed by cloud temperature monitoring, sit behind an internet login.

The rules

  1. Food businesses must be able to show the competent authority evidence of their HACCP measures (Article 5). 1
  2. IFS, citing published research, wrote in 2024 that the risk of cyber incidents affecting food safety “can no longer be entirely ruled out”. 2

Sources

  1. EU Official Journal (legislation.gov.uk), Regulation (EC) No 852/2004 on the hygiene of foodstuffs, . Read on .
  2. IFS, IFS Product and Food Defence Guideline, version 2, . Read on .

EDI and retailer portals

Orders, delivery notes and invoices with the supermarket chains, machine to machine. If the link stops, they stall.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

GS1 EDI (EANCOM, an application of UN/EDIFACT) lets trading partners exchange orders and invoices electronically (GS1 Sweden).

Who connects from outside
Retailers and their EDI networks, through a service provider or a supplier portal login.
How it ends up reachable from the internet
The supplier portal login and the EDI provider’s systems sit on the internet by design, so both are part of the path to your orders and invoices.

The rules

  1. Spanish food supply contracts must be in writing and state the delivery conditions, the information the parties must exchange, penalties for non-conformities, incidents or any other duly documented circumstance, and force majeure exceptions. 2

Sources

  1. GS1 Sweden, GS1 EDI. Read on .
  2. Boletín Oficial del Estado (BOE), Ley 12/2013, de 2 de agosto, de medidas para mejorar el funcionamiento de la cadena alimentaria, . Read on .

Office IT, email and payroll

Email, accounts, shared files, payroll and the bank connection. Phishing email is one of the commonest ways in.

What Cantic does Eclipse tests what you expose, from the outside; Fortify reviews the rest.

Technical detail and sources

Identity and email, endpoints, file servers, backups, payroll and banking software. The most common ransomware infection routes are “email phishing campaigns, Remote Desktop Protocol (RDP) vulnerabilities, and software vulnerabilities”, and one US farm lost about $9 million after attackers used compromised credentials to gain administrator access (FBI, 2021). Criminals have also used business email compromise to order food on credit and never pay; one attempt was worth nearly $230,000 (FBI, FDA OCI and USDA, 2022).

Who connects from outside
Staff from home and on the road, the IT provider through its remote management tools, and every supplier who sends an invoice by email.
How it ends up reachable from the internet
Email and cloud accounts are on the internet by design; remote desktop and VPN logins for staff and the IT provider add more doors.

The rules

  1. NIS2 lists multi-factor authentication, basic cyber hygiene and training, access control and secured communications among the minimum measures for companies in scope (Article 21(2)). 3

Sources

  1. FBI, Private Industry Notification 20210901‑001: Cyber Criminal Actors Targeting the Food and Agriculture Sector with Ransomware Attacks, . Read on .
  2. FBI, FDA OCI, USDA, Criminal Actors Use Business Email Compromise to Steal Large Shipments of Food Products and Ingredients (AA22‑340A), . Read on .
  3. EU Official Journal (publications.europa.eu), Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), . Read on .

Regulation

Rules that fill your plant with connected systems

Not cyber security laws, but the reason a plant is full of connected controllers, alarms and records.

RuleWhat it requires
RSIF, Spain’s safety rules for refrigeration plants (Real Decreto 552/2019)Gas detectors, leak alarms, a maintenance contract with an authorised refrigeration company, and liability insurance for ammonia plants.
Seveso rules on major accidents (Real Decreto 840/2015)Major-accident duties from 50 tonnes of anhydrous ammonia.
Regulation (EC) No 37/2005Temperature recorders for quick-frozen food in transport and storage, with recordings kept for at least a year.
Regulation (EC) No 852/2004 on food hygieneHACCP monitoring and records.
Regulation (EC) No 178/2002 on food lawTraceability systems and the duty to withdraw unsafe food.
ATP rules for refrigerated vehicles (Real Decreto 237/2000)Inspected and certified refrigerated vehicles.
Directive 98/58/EC on animals kept for farmingVentilation alarms in livestock houses.

Help

Official guidance worth keeping

Call 017, INCIBE’s free and confidential cyber security helpline for companies, from 8:00 to 23:00 every day. INCIBE

Your results in one day.

We find your weak points before a criminal does.

Book a test