Rockwell Automation

What is Rockwell Automation?

Rockwell Automation is an American industrial automation manufacturer based in Milwaukee that supplies PLCs, I/O, drives and network components under the Allen-Bradley brand and software for HMI, SCADA, historians and MES under the FactoryTalk name. In fiscal year 2025 the company reported revenue of about 8.3 billion dollars with roughly 26,000 employees, led by CEO Blake Moret. In North America Rockwell is the PLC market leader; in Europe you mainly find its technology at American multinationals, in food and beverage and pharmaceuticals, and on machines from OEM machine builders. Because its products run from field devices to ERP integration, Rockwell touches almost every layer of OT, ICS and IT OT Convergence.

🕰️ How did Rockwell Automation originate?

Its roots lie in the Compression Rheostat Company, founded in Milwaukee in 1903 by Lynde Bradley and Stanton Allen and renamed the Allen-Bradley Company in 1909. Rockwell International, then known mainly for aerospace, bought Allen-Bradley in 1985. When Rockwell International split in 2001, the avionics business continued as Rockwell Collins and the automation business remained as Rockwell Automation.

The direction is clear: from hardware supplier to a provider of software, cloud and services, with cybersecurity as a fixed component.

🏭 How is the company organised?

Since fiscal year 2021 (which began in October 2020), Rockwell has reported in three segments. Externally it uses three brands: Allen-Bradley (hardware), FactoryTalk (software) and LifecycleIQ Services (services).

Rockwell positions itself around Industry 4.0, the Industrial Internet of Things, Smart Industry, digital twins, Industrial AI and Edge Computing. To do so it partners with Microsoft (cloud and AI in FactoryTalk) and Cisco (networking), among others. In 2019 it was a founding member of the ISA Global Cybersecurity Alliance.

⚙️ Which products does Rockwell Automation supply?

The hardware is sold under Allen-Bradley. The Logix family shares one programming environment, one tag-based memory model and CIP as a common language.

The software is branded FactoryTalk or Studio 5000:

This software links control to MES, ERP, cloud platforms and IIoT applications.

🌐 What role do EtherNet/IP, CIP and CPwE play?

Rockwell is one of the founders of ODVA, the organisation behind IP and the Common Industrial Protocol. EtherNet/IP runs over standard Ethernet with TCP and UDP: explicit messages (configuration, programming, HMI reads) over TCP port 44818 and cyclic I/O traffic over UDP port 2222, often multicast, at an interval (RPI) of a few to tens of milliseconds.

The ecosystem also uses DLR for ring redundancy, PTP (as CIP Sync) for motion, VLANs and QoS for separation and priority, CIP Safety for safety functions and, in time, TSN. Because it is all standard Ethernet, the platform aligns well with IT networks. That also increases the need for network segmentation, an industrial firewall, IDS and monitoring.

Together with Cisco, Rockwell publishes the Converged Plantwide Ethernet (CPwE) design guidance. It covers industrial network architecture, segmentation, redundancy, wireless, remote access and the IDMZ between the office and plant networks, in line with Defense in Depth and Zero Trust.

🧱 Where does Rockwell sit in the Purdue Model?

The OT network thus consists of a control network at level 1 and a supervisory network at level 2, separated from the office network according to the Purdue Model and ISA-95.

🔐 Which cyber risks apply to Rockwell environments?

Logix controllers are deployed so widely around the world that they are an attractive target. Classic CIP has no authentication: anyone with network access can write tags or download a program. Typical threats are ransomware and other malware coming from IT, living-off-the-land attacks using legitimate engineering tools, misuse of shared accounts, a compromised engineering workstation and supply-chain attacks.

Key measures:

CIP Security adds certificate-based authentication, integrity checks and optional encryption through TLS and DTLS. You configure it with FactoryTalk Policy Manager. Newer modules such as the 1756-EN4TR and controllers such as CompactLogix 5380 and ControlLogix 5580 support it; older equipment does not, because of limited processing power, legacy firmware and determinism requirements. The result is hybrid environments in which compensating controls remain necessary. CIP Security aligns with IEC 62443, NIS2, the Dutch Cybersecurity Act and Zero Trust Architecture.

⚡ Why is network design crucial for performance?

A flat network without IGMP snooping lets multicast I/O traffic flood everywhere. The results are packet loss, delayed I/O, frozen HMIs, production stops and even safety risks. Segregated OT networks with managed industrial switches, QoS, redundant rings and multicast optimisation prevent this.

🔧 How do you approach a Rockwell environment in practice?

A typical plant running Rockwell technology has these data flows:

Common weak spots are unprotected engineering laptops, flat networks, unpatched Windows systems, shared accounts, little logging and vendor remote access. A practical approach:

1. Inventory controllers, modules and firmware versions; passive OT monitoring recognises CIP traffic automatically.
2. Segment according to the Zones and Conduits Model from IEC 62443, with an IDMZ or DMZ and firewalls between zones.
3. Set the key switch on ControlLogix controllers to RUN, so nobody can download a program remotely.
4. Control remote access through a VPN, MFA, PAM and a jump server with session recording and least privilege.
5. Patch through a tested process, with downtime planning and a rollback version.
6. Monitor changes with FactoryTalk AssetCentre and Logix Change Detection, tied to change management.
7. Plan the lifecycle: PLC-5 has not been sold since June 2017 and many SLC 500 processors have also been discontinued. Good lifecycle management means migrating before a failure forces your hand, tested with a FAT and SAT. In pharmaceuticals, changes fall under GMP and validation according to GAMP.

For new projects, Security by Design is part of the job: choose modules with CIP Security and signed firmware.

🇪🇺 What does European regulation mean for Rockwell users?

Organisations covered by the Dutch Cybersecurity Act (Cyberbeveiligingswet), in force since 15 August 2026, must demonstrably manage risks in their OT, including Logix controllers and FactoryTalk servers. The Cyber Resilience Act requires manufacturers such as Rockwell to report actively exploited vulnerabilities from 11 September 2026; from 11 December 2027 all requirements apply to new products. The Machinery Regulation, applicable from 20 January 2027, makes protection against corruption of safety functions part of CE marking, including on GuardLogix machines.

🔄 How does Rockwell compare with other vendors?

In the further convergence of IT and OT, Rockwell is betting on AI analytics, cloud, edge, integrated cybersecurity and asset intelligence. This shifts industrial automation from isolated installations to integrated ecosystems, with predictive maintenance and less downtime as benefits, but also more vendor dependency and heavier compliance demands.

❓ Frequently asked questions

Is Rockwell Automation the same as Allen-Bradley?

Allen-Bradley is the hardware brand of Rockwell Automation. Rockwell International bought Allen-Bradley in 1985, and the company has been called Rockwell Automation since 2001. Controllers, I/O and drives carry the Allen-Bradley name, while the software is called FactoryTalk or Studio 5000.

Which Rockwell Automation software do you use to program a PLC?

You program Logix controllers such as ControlLogix, CompactLogix and GuardLogix with Studio 5000 Logix Designer, the successor of RSLogix 5000. Micro800 controllers use Connected Components Workbench. You build visualisation with FactoryTalk View or FactoryTalk Optix.

Which protocol does Rockwell Automation use?

Rockwell Automation mainly uses EtherNet/IP, which carries the Common Industrial Protocol (CIP) over standard Ethernet. CIP Safety handles functional safety, CIP Sync time synchronisation and CIP Security protection. Older installations still use DeviceNet, ControlNet or Data Highway Plus.

Is Rockwell Automation common in the Netherlands and Europe?

In the Netherlands and most of Europe Siemens is the larger PLC supplier, but Rockwell Automation is well represented at American multinationals, in food and beverage, in pharmaceuticals and on machines from American builders. Many European OT teams therefore manage a mixed estate of Logix and SIMATIC controllers.

How do you secure a Rockwell Automation environment?

You secure a Rockwell Automation environment with segmentation according to IEC 62443, an IDMZ between IT and OT, remote access through a jump server with MFA and a fixed patch process. Set ControlLogix key switches to RUN and monitor changes with FactoryTalk AssetCentre. Use CIP Security wherever the hardware supports it.

What role does Rockwell Automation play in IT/OT convergence?

Rockwell Automation supplies the whole chain from PLC to cloud MES and publishes the CPwE guidance with Cisco for connecting plant and office networks. Acquisitions such as Plex, Fiix and Verve bring software, maintenance and OT security closer to control. That makes integration easier but demands strict segmentation and governance.

📌 In summary

Rockwell Automation is the American automation vendor behind Allen-Bradley PLCs, FactoryTalk software and EtherNet/IP. The company has evolved from a hardware supplier into a provider of software, cloud MES and OT security services. If you work with Rockwell, you combine the integration benefits of standard Ethernet with the duty to manage network, access, patches and lifecycle properly.

Rockwell Automation supplies the complete chain from field to cloud with Allen-Bradley and FactoryTalk; segmentation, CIP Security and lifecycle management decide whether that chain is also secure.