# Why is Modbus considered insecure?

Because it has no authentication and no encryption: any device that can reach a Modbus/TCP controller can read its values and, unless the controller itself restricts it, write to its coils and registers. Modbus was designed in 1979 for serial links between trusted devices, long before control networks were joined to office networks and the internet. A secured variant with TLS exists, but few installed devices support it. In practice you protect Modbus from the outside: keep port 502 off the internet, let only named engineering and SCADA hosts reach the controllers, and use any write protection the PLC offers. Because the traffic is not encrypted, a passive sensor can read which station reads from or writes to which controller. NetSenX does that from the Pro plan and raises an alert when a host that is not allowed to write sends a write; it does not change the protocol or block the command.

FAQ: [OT and IoT](https://netsenx.com/en/faq/ot) · https://netsenx.com/en/faq/why-is-modbus-insecure

## Read next

- https://netsenx.com/en/ot-network-monitoring
- https://netsenx.com/en/compare

## Related questions

- [How do I know if an unauthorised computer writes to our PLC?](https://netsenx.com/en/faq/how-to-know-if-an-unauthorised-computer-writes-to-a-plc)
- [Which OT alerts matter most for a small factory?](https://netsenx.com/en/faq/which-ot-alerts-matter-most-for-a-small-factory)
- [How do I detect a PLC program change outside working hours?](https://netsenx.com/en/faq/how-to-detect-a-plc-program-change-outside-working-hours)
- [Can network monitoring see an S7 PLC being stopped?](https://netsenx.com/en/faq/can-network-monitoring-see-an-s7-plc-being-stopped)
- [Can network monitoring show who changed a PLC setpoint?](https://netsenx.com/en/faq/can-network-monitoring-show-who-changed-a-plc-setpoint)