Delivering Automation with Confidence in a Cloud-Enabled World
Industrial automation is shifting from the one-programmer, one-system, hardware-defined world of yesterday to a collaborative, AI-assisted, software-defined model built for IT-OT convergence and remote fleet management. Powered by tools like the cloud and edge devices, that shift only works if customers trust the platform underneath it. This article makes the case that Rockwell Automation is giving engineers the confidence to design, deploy, and operate automation systems using modern, cloud-enabled tools-without compromising the security rigor the OT world increasingly requires.
Why Rockwell and Our Partners
Rockwell Automation has a long history in both OT cybersecurity as well as manufacturing. Our core security capabilities are built on decades of cybersecurity expertise but grounded in over 100 years of industrial automation and manufacturing development. Our security pedigree is evident throughout our corporate culture, our certified security products and into our world class cybersecurity solutions where we apply practical risk management practices and manage the complexity of OT environments within modern operations.
Microsoft brings global-scale cloud infrastructure, identity, security, compliance, and AI platform capabilities through Azure. For Rockwell Automation services like FactoryTalk Hub and FactoryTalk Design Studio (FTDS), Azure provides a trusted foundation for cloud-native delivery, including application-layer protection capabilities such as Azure Application Gateway and Azure Web Application Firewall, which help protect web applications from common exploits such as SQL injection and cross-site scripting. Azure also provides the platform services, encryption capabilities, monitoring integrations, and compliance portfolio needed to support secure cloud operations at scale.
Together, Rockwell and Microsoft help customers modernize industrial design and operations on a cloud foundation that combines Azure’s security and compliance capabilities with Rockwell’s OT-aware product experience.
Rockwell Thought Leadership: Cloud-First, Not Cloud-Retrofitted
Rockwell Automation has been leading the way in delivering cloud technology to industrial automation, beginning with the FactoryTalk Hub, a set of services that deliver a unified experience for all Rockwell Automation SaaS products. FactoryTalk Hub enables users to control access to services and data in the cloud, including services like FactoryTalk Design Studio, a cloud-based integrated development environment for control systems.
Rather than retrofitting cloud capability onto legacy desktop software, Rockwell Automation built FactoryTalk Design Studio cloud-first, then extended it outward-the reverse of how most of the industrial automation industry has approached SaaS. That architecture allows FTDS to leverage cloud-native capabilities for resiliency, scalability, centralized security controls, and managed operations. In fact, FTDS launched in October 2022, and it stands out as one of the leading cloud-native industrial design products to achieve Functional Safety TÜV certification, an important proof point that cloud delivery and functional safety are not mutually exclusive.
That same cloud-first foundation is what lets Rockwell back this thought leadership with substance rather than just messaging: FTDS shows that a system built for the cloud from day one is well positioned to meet the trust and safety bar OT teams have always demanded-and the sections below lay out exactly how.
Going to the Cloud Unlocks AI-Starting with FactoryTalk Design Studio
Cloud delivery is what allows Rockwell Automation to capture and integrate the full power of generative AI directly into FactoryTalk Design Studio workflows. FTDS Copilot acts as a product expert (answering functionality and error-guidance questions), a project researcher (summarizing projects and code, surfacing device information), and a build partner (generating and modifying Logix code from natural language). New AI Agent Workflows go further: a Plan Agent explores projects and uploaded design assets to build implementation plans, and a Build Agent can execute those plans autonomously - creating programs, routines, tags, and Logix code directly in the project.
Critically, this AI capability is delivered with strong data protection commitments. FactoryTalk Design Studio uses Azure OpenAI capabilities through Microsoft Azure. Under Microsoft’s Azure OpenAI data, privacy, and security commitments, customer prompts, completions, embeddings, and training data are not made available to OpenAI or other customers, and are not used by OpenAI to improve its models or services, and are not used to train generative AI foundation models without the customer’s permission or instruction.
Customer data remains customer-owned. Rockwell Automation does not use customer prompts, generated code, or project content to train AI services unless the customer has expressly authorized that use. Your intellectual property is always yours.
FactoryTalk Design Studio Security: Defense in Depth
FTDS security is built in layers:
- User Access – FTDS authenticates users through Rockwell Accounts and FactoryTalk Hub, with authorization available for general user management as well as detailed service levels. This provides a first layer of data access control and tenant-level segregation, identifying who has access to what.
- Network Communications - the connectivity between the cloud and the physical network - are customer-authorized, on-demand VPN connections from cloud to on-prem, with endpoint features that keep the control system aware of any access. No persistent cloud connection is required to keep the system running.
- Product Infrastructure - FTDS benefits from Azure platform security capabilities, encrypted communications, application-layer protections, and monitored service operations. Under the shared-responsibility model, Microsoft secures the Azure cloud platform, while Rockwell Automation is responsible for securely configuring, operating, and monitoring the FTDS service. Within FTDS, each tenant operates in its own dedicated storage boundary, with customer project data encrypted at rest and access to persistent storage enforced over TLS; network policies further restrict communication between the components, including those involved in on-premises VPN connections. The underlying infrastructure is defined as code and deployed through a GitOps pipeline with automated drift correction, receives regular patching and Azure Policy governance, and is monitored through centralized logging and gateway access logs that give visibility into traffic and service health.
- Intellectual Property - customer project data - is protected through a zero trust model, where no user, device, or service is implicitly trusted and every access request is authenticated and authorized. This is enforced through user group and service-level access controls, encrypted storage, and additional key-based access protections layered on top of the platform's integrated file storage and version control capabilities.
This layered approach to FactoryTalk Design Studio security is supported by third-party assurance and regulatory alignment, including:
- SOC 2 (System and Organization Controls 2) is an independent attestation report based on American Institute of Certified Public Accountants (AICPA) Trust Services Criteria covering areas such as security, availability, processing integrity, confidentiality, and privacy. FactoryTalk Design Studio (FTDS) and its underlying FactoryTalk Hub cloud services are included within Rockwell Automation's SOC 2 audited environment. Following an initial SOC 2 Type 1 assessment, the service now undergoes yearly recurring SOC 2 Type 2 audits that evaluate both the design and ongoing operation of the controls governing the security and management of the SaaS platform. This provides independent validation that the service is operated in accordance with established security and control practices. You can access the full report through our resource portal at Rockwell Automation Trust Center.
- FactoryTalk Design Studio (FTDS) operates on the FactoryTalk Hub platform, which is covered by Rockwell Automation's ISO/IEC 27001-certified Information Security Management System (ISMS). ISO/IEC 27001 is an internationally recognized standard for information security management that requires organizations to identify, manage, and continuously improve controls designed to protect information assets. The certification provides independent validation that the security governance, risk management, and operational processes supporting FTDS are managed within a structured and audited framework. You can download a copy of the certificate from our resource portal at Rockwell Automation Trust Center.
- IEC 62443-4-1. FactoryTalk Design Studio (FTDS) is developed in accordance with Secure Development Lifecycle (SDL) practices based on IEC 62443-4-1, the internationally recognized standard for the secure development of Industrial Automation and Control System (IACS) products. The standard establishes requirements for integrating cybersecurity into product development activities, including security requirements definition, secure design, implementation, testing, defect management, and long-term maintenance. Applying these practices helps Rockwell Automation build security into FTDS from the earliest stages of development through ongoing operation and support.
- Privacy and Data Protection Regulations. FTDS is designed with privacy and data protection considerations that support customers operating under GDPR and other applicable privacy and data protection regulations. While GDPR is one of the most widely recognized privacy frameworks, organizations around the world may also be subject to regional, national, or industry-specific requirements governing the collection, processing, storage, and transfer of personal information. Through security controls, access management, data handling processes, and governance practices implemented across FTDS and FactoryTalk Hub, Rockwell Automation helps customers manage their information securely while supporting their broader privacy and regulatory objectives. To learn more about Rockwell Automation data processing, please visit the Data Processing Addendum under our Legal Notices.
Together, these controls help make secure operation a built-in part of the FTDS service model - reducing risk, supporting compliance needs, and helping customers modernize while maintaining OT expectations for safety, availability, and control.
Interested in diving deeper into FactoryTalk Design Studio’s security strategy? Check out the Secure PLC Design Software with Cloud and AI webinar!
Lower cost of ownership coupled with increased security capabilities
A cloud platform such as Microsoft Azure brings security investment and operational scale that individual manufacturers and plant environments typically cannot reproduce on their own. Microsoft processes trillions of security signals daily, operates one of the world’s largest security research and engineering organizations, and continues to invest through the Secure Future Initiative to improve security, resiliency, and engineering discipline across Microsoft products and services.
For customers, the value is not that cloud removes security responsibility; it changes where that responsibility sits. Under the shared-responsibility model, Microsoft secures the Azure cloud platform, Rockwell secures and operates the FTDS SaaS application, and customers retain responsibility for their identities, access decisions, endpoint hygiene, data governance and OT operating practices. This shared responsibility model reduces the burden of customer-managed infrastructure, patching, and upgrade cycles while improving resiliency, consistency, and security.
And the data proves it - the costliest, slowest-to-contain breaches come not from cloud itself but from fragmented hybrid environments left half-managed (IBM 2024). For manufacturers, the winning move is to consolidate onto a well-managed platform, close the shared-responsibility gaps, and partner for the OT innovation Rockwell is providing with FTDS.
As a SaaS service, FTDS can help reduce the burden associated with self-managed deployment and update cycles. Security patches and product improvements can be delivered through the service rather than waiting for every customer environment to plan, test, and deploy manual upgrades. Combined with defense-in-depth architecture, third-party assurance, and Azure’s security foundation, FTDS helps make secure modernization more achievable for industrial organizations.
Rockwell is Your Trusted OT/IT Partner
With FactoryTalk Design Studio, Rockwell Automation gives OT teams a modern engineering environment that brings together security, innovation, and more efficient use of scarce domain expertise. The defense-in-depth approach, a third-party assurance, IP protections, and cloud-native operating model help address the trust expectations OT engineers have traditionally associated with on-premises systems, while enabling a more collaborative, AI-assisted, and scalable design experience.
Backed by Microsoft Azure’s global cloud infrastructure and grounded in Rockwell Automation’s OT domain expertise, FTDS shows that security and innovation do not have to compete. They can reinforce each other when cloud, AI and industrial engineering are designed together from the start. With Rockwell Automation, you get all three from a partner you already trust.
Ready to see it for yourself? Try it now for free.
