Virtualization

What is virtualisation?

Virtualisation is a technology in which physical hardware resources such as processor, memory, storage and network are abstracted by software, so that multiple isolated virtual systems can run simultaneously on the same physical infrastructure. Within OT and industrial automation, virtualisation is increasingly applied to SCADA, historians, MES, HMI, Soft PLC platforms, engineering stations and industrial edge environments. Where OT traditionally ran on dedicated hardware, architectures are shifting towards software-defined infrastructure, and with it towards closer integration within OT convergence.

Virtualisation delivers hardware consolidation, scalability, redundancy, fast provisioning, snapshots and fast recovery. At the same time, it introduces new challenges around real-time behaviour, availability, cybersecurity and operational complexity.

🧠 What forms of virtualisation exist?

Virtualisation is an umbrella term. The best-known form is server virtualisation with a hypervisor, but a modern OT environment combines several layers. The basic building blocks are always the same: a physical host, a virtualisation layer that allocates CPU time, memory, storage access and network, guest operating systems inside the virtual machines, virtual switches and usually shared storage.

Server virtualisation distinguishes type 1 hypervisors (bare-metal, running directly on the hardware) from type 2 hypervisors (running as an application on Windows or Linux, such as VMware Workstation and VirtualBox). In production OT, type 1 hypervisors dominate; type 2 suits labs, training and simulation, but not production processes because of additional latency and the dependency on the host operating system. The hypervisor article covers that distinction in more depth.

🔄 What is the difference between virtual machines and containers?

A virtual machine contains a complete guest operating system; a container shares the host kernel and only isolates processes. Docker made containers widely accessible from 2013, and Google released Kubernetes in 2014 as an open-source orchestrator, handing it over to the Cloud Native Computing Foundation in 2015. Kubernetes is not a container runtime but the platform that distributes, monitors and restarts containers across multiple nodes. For small edge nodes, lighter distributions such as K3s exist.

In practice, OT combines both: containers often run inside a VM, so the strong isolation of the hypervisor is retained.

🏭 Which OT systems can you virtualise?

Most systems at levels 2 and 3 of the Purdue Model are ordinary Windows or Linux servers and virtualise well. The closer to the physical process, the stricter the timing requirements.

The emphasis differs per sector. In manufacturing, SCADA clusters, MES platforms, quality systems and historians are virtualised. In energy supply it concerns substation servers, energy management systems and central monitoring. Water utilities virtualise telemetry, pumping station monitoring and redundant SCADA. In building automation, BMS, HVAC and alarm servers often run as VMs.

⚡ Why is real-time behaviour a challenge?

OT systems often require deterministic behaviour. Virtualisation places extra layers between the application and the hardware: application, guest operating system, hypervisor and physical hardware. Each layer can affect latency, jitter, interrupt handling and scheduling. Problems arise particularly with motion control, safety systems, turbine control, high-speed IO and real-time fieldbuses.

Virtualised OT systems usually communicate via OPC UA, MQTT, Modbus TCP, ProfiNET or IP. The virtualisation layer affects that network traffic:

Real-time protocols such as EtherCAT and TSN networks are difficult to virtualise fully because of their strict timing. Still, the boundary is moving. Since Linux 6.12 (November 2024), PREEMPT_RT has been part of the mainline kernel, making real-time behaviour on standard Linux easier to achieve. At Hannover Messe 2023, Siemens presented the SIMATIC S7-1500V, a virtual PLC deployed via Industrial Edge and programmed with TIA Portal. In March 2025 Siemens announced the fail-safe variant S7-1500V F, with TÜV approval to IEC 61508 for safety functions up to SIL 3; at that point it was running with pilot customers. CODESYS runtimes are also available for virtual and container environments. For hard real-time with very short cycle times, dedicated hardware remains the norm for now.

🔐 What cybersecurity risks does virtualisation bring?

Virtualisation significantly changes the OT attack surface. Whoever controls the hypervisor or the management platform controls every VM on it. In February 2023 the ESXiArgs ransomware campaign encrypted thousands of ESXi servers worldwide. On 4 March 2025 Broadcom published advisory VMSA-2025-0004 on three actively exploited zero-days in ESXi (CVE-2025-22224, -22225 and -22226) that together enabled a VM escape. There was no workaround; only patching helped.

Additional attack surface comes from management interfaces, orchestration layers, APIs, storage fabrics and virtual switches. Key hardening controls are network segmentation, an industrial firewall, dedicated management VLANs, MFA, RBAC, encrypted storage, central logging and security monitoring. Keep production OT, management environments, engineering and the backup infrastructure strictly separated. From an IEC 62443 perspective, a virtual switch that connects zones is effectively a conduit too: the zones and conduits model must hold inside the host as well.

🔄 How does virtualisation provide high availability?

Consolidation turns a single host into a single point of failure: its loss hits several SCADA systems, historians, OPC servers and engineering stations at once. A cluster absorbs that with high availability.

Resource contention also matters: VMs share CPU, memory, storage and network. CPU starvation, memory pressure or storage congestion lead to higher latency, process delays, frozen HMI screens and SCADA timeouts. In hyperconverged infrastructure, each node combines compute, storage and networking, as in VMware vSAN, Nutanix and Azure Local (called Azure Stack HCI until November 2024). For storage, IOPS, latency, redundancy, snapshot policy and backup integration are the key design parameters.

🧭 How do you approach virtualisation in an OT environment?

1. Take inventory - which systems, versions and licences are running, and which hypervisor versions does each OT vendor officially support?
2. Decide what will not be virtualised - hard real-time, safety functions without a certified platform, and hardware with plug-in cards or dongles.
3. Size generously - at least N+1 hosts; a vSAN cluster needs at least three hosts, or two hosts plus a witness. No CPU or memory overcommit for critical VMs.
4. Design the network - separate networks for management, storage, migration and process traffic, mapped to your zones.
5. Build a test environment first - VM templates make FAT and SAT tests, cyber ranges, training, virtual commissioning and a digital twin cheap and reproducible, following a DTAP approach (OTAP in Dutch).
6. Organise management - lifecycle management, configuration management with version control of templates, patch management in agreed windows and offline backups.
7. Test recovery - define RTO and RPO and rehearse disaster recovery and business continuity, including the scenario in which the whole cluster is unusable.

Typical rules of thumb: keep snapshots for no longer than 24 to 72 hours (a snapshot is not a backup), place redundant SCADA servers and domain controllers on different hosts with anti-affinity rules, and plan capacity so the cluster can absorb the loss of one host.

In the Netherlands and the EU, licensing and legislation also play a role. After acquiring VMware, Broadcom stopped selling perpetual licences in December 2023 and withdrew the free ESXi in February 2024 (a free, unsupported version returned with ESXi 8.0 Update 3e in April 2025); many OT users are therefore reviewing their hypervisor choice, but must follow the support matrix of their SCADA vendor. Organisations in scope of NIS2 and the Dutch Cybersecurity Act (Cyberbeveiligingswet, in force since 15 August 2026) must include their virtualisation platform in their duty of care for risk management, patch management and continuity.

🛡️ Which standards and guidelines are relevant?

Safety-critical workloads face additional restrictions: a virtual PLC may only perform safety functions if the product is certified for them and the platform meets the manufacturer’s conditions.

📈 What are the trends?

Key developments are software-defined OT, containerised SCADA components, virtual PLCs, Kubernetes at the edge, hyperconverged infrastructure and the combination of control, analytics and AI inferencing on a single edge device. Edge nodes combine soft PLCs, MQTT brokers, OPC UA and protocol gateways. Virtualisation is thus becoming a fundamental building block of digital industrial architecture.

❓ Frequently asked questions

What is the difference between virtualisation and a hypervisor?

Virtualisation is the general principle of abstracting hardware and covers server, container, network, storage and desktop virtualisation. A hypervisor is the specific software layer that, in server virtualisation, divides one physical server among multiple virtual machines. Every hypervisor performs virtualisation, but not every form of virtualisation uses a hypervisor.

Can a SCADA system be virtualised safely?

Yes, SCADA servers, historians and HMI servers have been virtualised on type 1 hypervisors in OT for years. The conditions are a hypervisor version supported by the vendor, a redundant cluster, reserved resources for critical VMs and a separate management network. Real-time control stays in the PLCs.

Can a PLC be virtualised?

A PLC can be virtualised as a soft PLC or virtual PLC, provided the real-time requirements allow it. Siemens offers the S7-1500V as a virtual PLC and in 2025 announced the S7-1500V F, a TÜV-approved fail-safe variant up to SIL 3 that was first deployed with pilot customers. For motion control with very short cycle times, a dedicated controller remains common.

Are containers suitable for OT?

In OT, containers are mainly suited to lightweight, frequently changing workloads such as MQTT brokers, protocol gateways and edge analytics. They start quickly and have little overhead, but they share the host kernel and therefore isolate less strongly than virtual machines. That is why containers in OT often run inside a VM and follow the guidance of NIST SP 800-190.

Is a snapshot the same as a backup?

No, a virtual machine snapshot is not a backup. A snapshot sits on the same storage as the VM and is lost if that storage fails or is encrypted by ransomware. Use snapshots briefly around changes and also make separate, preferably offline or immutable backups.

What is the biggest risk of virtualisation in OT?

The biggest risk of virtualisation in OT is concentration: a single compromised or failed hypervisor hits many critical systems at once. Ransomware groups therefore specifically target ESXi and other hypervisor platforms. Fast patching, a separate management network, MFA and redundant clusters limit that risk.

📌 In summary

Virtualisation decouples OT systems from dedicated hardware by using software to divide processor, memory, storage and network among isolated virtual machines and containers. It enables OT convergence, edge computing and high availability, but requires a careful balance between IT flexibility and OT reliability: keep hard real-time and safety on certified platforms, segment virtual networks too, and patch the hypervisor quickly.