What is a hypervisor?
A hypervisor is a software or firmware layer that divides the processor, memory, storage and network interfaces of a physical server among multiple virtual machines (VMs), each running its own operating system in isolation from the others. The hypervisor, also called a virtual machine monitor, is therefore the core of virtualisation. In OT and industrial automation environments, SCADA servers, historians, MES, engineering stations and even soft PLCs increasingly run on a hypervisor cluster instead of on individual PCs. That makes the hypervisor a building block of OT convergence, but also an attractive target.
🧠 How does a hypervisor work?
A hypervisor intercepts every attempt by a guest operating system to access the hardware and gives each VM its own set of virtual hardware. The theoretical foundation was laid in 1974 by Popek and Goldberg, who set out the conditions under which a processor architecture can be virtualised efficiently. Since Intel VT-x (2005) and AMD-V (2006), x86 processors support virtualisation in hardware, which has made the overhead for ordinary server workloads small.
The hypervisor handles:
- CPU scheduling - which virtual processor may run on which physical core, and when
- Memory management - allocating and isolating memory per VM
- Storage - virtual disks on local drives, a SAN, NAS or software-defined storage
- Networking - virtual switches and VLANs that connect VMs to each other and to the outside world
- Interrupts and devices - passing through or sharing physical devices such as network cards and USB dongles
| Virtual component | Function | OT consideration |
|---|---|---|
| vCPU | Virtual processor | No overcommit for critical VMs |
| vRAM | Virtual memory | Reserve memory, avoid swapping |
| vNIC | Virtual network interface | Correct VLAN and zone per VM |
| vDisk | Virtual disk | Latency determines historian performance |
| Virtual switch | Network between VMs | Must not bridge zones unintentionally |
| Snapshot | Point-in-time image of a VM | Is not a backup |
🔄 What is the difference between a Type 1 and a Type 2 hypervisor?
The Type 1 / Type 2 classification goes back to Robert Goldberg’s 1973 doctoral thesis. A Type 1 hypervisor (bare-metal) runs directly on the hardware; a Type 2 hypervisor runs as an application on a regular operating system.
| Characteristic | Type 1 (bare-metal) | Type 2 (hosted) |
|---|---|---|
| Runs on | Physical hardware | Windows, Linux or macOS |
| Examples | VMware ESXi, Microsoft Hyper-V, Xen, KVM, Proxmox VE | VMware Workstation, VirtualBox, Parallels |
| Overhead | Low | Higher, the host OS competes for resources |
| Isolation | Strong | Depends on the host OS |
| Typical OT use | Production servers, SCADA clusters | Labs, training, simulation, FAT/SAT preparation |
The boundary is not always sharp. KVM, part of the Linux kernel since 2007, turns Linux itself into a hypervisor and is usually considered Type 1. Hyper-V arrived in 2008 with Windows Server 2008; once enabled, Windows becomes a “parent partition” running on top of the hypervisor. For production OT you almost always choose a Type 1 hypervisor; a Type 2 hypervisor has higher latency and less deterministic behaviour.
🏭 Which OT workloads can you virtualise?
Most systems at levels 2 and 3 of the Purdue Model are ordinary Windows or Linux servers and virtualise well. The closer you get to the physical process, the stricter the timing requirements become.
| Workload | Virtualisable? | Note |
|---|---|---|
| SCADA server and HMI clients | Yes | Vendors publish supported hypervisor versions |
| Historian | Yes | Watch storage IOPS and latency |
| MES | Yes | Often already in the data centre |
| OPC UA servers and MQTT brokers | Yes | Also on edge hypervisors |
| Engineering stations | Yes | Useful for old software versions of legacy systems |
| OT domain controller | Yes | At least two, on different hosts |
| Soft PLC / virtual PLC | Depends on real-time requirements | See below |
| Safety PLCs and safety functions | Usually not | Certified, dedicated hardware |
A typical SCADA cluster consists of three or more hosts running the SCADA server, a redundant second server, the historian, an alarm server, an OPC server and engineering VMs. Virtualisation speeds up recovery and simplifies lifecycle management, because a server is no longer tied to specific hardware.
⏱️ Why is real-time difficult on a hypervisor?
A hypervisor adds an extra scheduling layer. A VM that briefly gets no physical core sees its timing shift. That affects latency, jitter and interrupt response, as does network congestion on shared network cards, and therefore mainly motion control, fast IO and high-speed fieldbuses. Real-time behaviour has to be engineered, not assumed.
| Technology | Why it is sensitive |
|---|---|
| EtherCAT | Cycle times well below 1 ms, distributed clocks |
| ProfiNET IRT | Reserved time slots for isochronous communication |
| TSN | Strict time scheduling in the network |
| SERCOS III | Low jitter required for drives |
Even so, the boundary is moving. Siemens offers the SIMATIC S7-1500V, a virtual PLC that according to Siemens achieves real-time behaviour with standard Linux mechanisms and supports PROFINET RT with a 1 ms cycle time; safety support is still on the roadmap. Techniques that make real-time possible on a hypervisor:
- CPU pinning - binding a vCPU to a physical core that nothing else uses
- Memory reservation - no overcommit, no ballooning or swapping
- Passthrough and SR-IOV - giving the VM direct access to a network card
- Real-time kernels and real-time hypervisors - designed specifically for deterministic tasks
For hard real-time and safety, dedicated controllers remain the norm for now.
🔐 What security risks does a hypervisor introduce?
For cybersecurity, the hypervisor is a critical part of the OT infrastructure. Whoever controls the hypervisor controls every VM on it. That is why hypervisors are a favourite target of ransomware groups: one encrypted ESXi datastore takes down SCADA, historian and domain controller in one go. In February 2023 the ESXiArgs campaign encrypted thousands of ESXi servers worldwide through a long-patched vulnerability in OpenSLP. In March 2025 Broadcom published advisory VMSA-2025-0004 on three zero-days in ESXi (CVE-2025-22224, -22225 and -22226) that, according to Broadcom, had already been exploited in the wild; chained together they enabled a VM escape, in which an attacker with administrative rights inside a VM breaks out to the hypervisor. Patching was the only remedy.
| Risk | Consequence | Measure |
|---|---|---|
| Vulnerable hypervisor | Entire environment compromised | Timely patching, track CVEs |
| VM escape | Lateral movement between zones | Separate clusters per security level |
| Abuse of management interface | Unauthorised management, mass encryption | Separate management network, MFA, jump server |
| Virtual switch bridges zones | Segmentation bypassed | Enforce zones with an firewall |
| Leaked snapshots or VM files | Theft of credentials and data | Encrypted storage, restricted access |
Key hardening measures are RBAC, Secure Boot, disabling unused services (such as SSH and SLP), central logging with audit trails, security monitoring and application whitelisting inside the VMs. NIST SP 800-125A Rev. 1 (2018) gives specific recommendations for server hypervisors. From an IEC 62443 perspective, a virtual switch is also a conduit, so network segmentation and the zones and conduits model must hold inside the hypervisor too, including the DMZ.
🛡️ How do you ensure high availability?
Consolidation means that the failure of one host affects multiple systems. A hypervisor cluster absorbs this with high availability and redundancy.
| Function | What it does | Recovery time |
|---|---|---|
| HA restart | Restarts VMs from a failed host on another host | Minutes (VM boot time) |
| Fault tolerance | Keeps a shadow copy of a VM in sync | Virtually no interruption |
| Live migration | Moves a running VM without downtime | Planned maintenance without a stop |
| Replication | Copies VMs to a second site | Depends on interval |
| Backup | Independent copy, preferably immutable | Hours, but resilient to ransomware |
In a hyperconverged architecture (HCI), every node combines compute, storage and networking, as in VMware vSAN, Nutanix and Azure Local (formerly Azure Stack HCI). This simplifies management and scalability, but also makes the cluster dependent on a well-designed storage network. Also plan disaster recovery and business continuity: what do you do when the entire cluster is unusable?
🧭 How do you virtualise an OT environment step by step?
- Take inventory - which systems, versions and licences are running, and which vendors support which hypervisor?
- Decide what will not be virtualised - hard real-time, safety and hardware with specific add-in cards or dongles.
- Size generously - at least N+1 hosts, no CPU or memory overcommit for critical VMs and enough storage IOPS for the historian.
- Design the network - separate networks for management, storage, migration and process traffic, mapped to your zones.
- Build an OTAP (DTAP) pipeline first - VM templates and snapshots make testing, simulation and virtual commissioning cheap, including as a digital twin.
- Organise operations - configuration management, patch windows aligned with production and offline backups.
Mind the licensing costs. After acquiring VMware, Broadcom stopped selling perpetual licences in December 2023 and moved to per-core subscriptions; in February 2024 the free ESXi edition was withdrawn as well. A free version returned in April 2025 (ESXi 8.0 Update 3e), but without support and not intended for production. Many OT users with long-running installations are therefore reviewing their choice of hypervisor, but they must follow their SCADA vendor’s support matrix when doing so. Organisations that fall under NIS2 or the Dutch Cybersecurity Act must also include the hypervisor in their duty of care for risk management and patching. NIST SP 800-82 Rev. 3 (2023), ISO 27001 and the NIST CSF provide the wider framework.
At the network edge, lightweight hypervisors and container platforms such as Docker run on edge devices for MQTT brokers, protocol converters and analytics, close to the process rather than in the cloud. In building automation, too, BMS and HVAC platforms and energy management systems often run as VMs, while telemetry aggregation for water and energy utilities is a common virtualised workload.
❓ Frequently asked questions
What is the difference between a hypervisor and a container?
A hypervisor virtualises complete hardware, so each VM runs its own operating system. A container shares the kernel of the host operating system and only isolates processes, which makes it lighter but less strictly separated. In OT, containers often run inside a VM on a hypervisor.
Can a SCADA system be virtualised safely?
Yes, SCADA systems are commonly virtualised on a Type 1 hypervisor today. The conditions are that you use a hypervisor version supported by the vendor, reserve resources for critical VMs, separate the management network and build a cluster with failover. Real-time control stays in the PLCs.
Is a snapshot a backup?
No, a virtual machine snapshot is not a backup. A snapshot lives on the same storage as the VM, is lost if that storage fails or is encrypted, and slows the VM down if it is kept for a long time. Use snapshots only briefly, for example around an update, and make independent backups as well.
What is a VM escape?
A VM escape is an attack in which code inside a virtual machine breaks out of its isolation and gains access to the hypervisor or other VMs. In March 2025, ESXi vulnerabilities enabling this were actively exploited as zero-days (Broadcom advisory VMSA-2025-0004). Patching the hypervisor quickly and separating zones with different security levels limit this risk.
Can a PLC run on a hypervisor?
A soft PLC or virtual PLC can run on a hypervisor if the real-time requirements allow it. For the virtual S7-1500V, Siemens specifies PROFINET RT with a 1 ms cycle time, based on standard real-time mechanisms in Linux. The underlying platform has to be tuned for it, for example with dedicated processor cores and reserved memory. For motion control with very short cycles and for safety functions, a dedicated controller remains common.
Which hypervisor is most common in OT?
Industrial environments mainly use VMware ESXi and Microsoft Hyper-V, because SCADA and historian vendors have supported them the longest. KVM-based platforms such as Proxmox VE and Nutanix AHV are gaining ground, partly because of the changed VMware licensing. Always check your OT vendor’s support matrix.
📌 In summary
A hypervisor divides one physical server among multiple isolated virtual machines and is therefore the foundation of virtualised SCADA, historian and MES environments. For production OT, choose a Type 1 hypervisor in a redundant cluster, reserve resources for critical VMs, separate the management network and patch quickly: whoever takes over the hypervisor holds the entire OT environment in their hands.