On 22 October 2026 in Tokyo, Mitsubishi Electric announced a plan to place operational-technology (OT) security monitoring directly inside industrial equipment, including controller products. Built around technology from Nozomi Networks’ Arc endpoint sensor, the proposed system would watch USB activity, detect or quarantine malicious files, observe software changes and help correlate device evidence with plant-wide network activity. A reference exhibit was planned for JIMTOF in Tokyo on 26–31 October, while commercial availability is targeted for the financial year ending March 2028. This was a development announcement, not proof of production installations in 2026.
The unusual part is where the detector lives. A passive security monitor on an industrial network sees communications crossing its observation point. It does not ordinarily know that somebody has inserted a USB drive into an engineering workstation or made an offline configuration change until that action causes network-observable activity. Monitoring the endpoint itself can reveal those local events, provided the machine supports the software and logging permissions.
What the wire cannot tell you
Imagine a CNC machine receiving a new programme through removable media during a scheduled maintenance visit. Its network connections are carefully segmented and its PLC communications appear normal. An engineer might still load an incorrect or unauthorised file locally. That is a hypothetical risk scenario, not a reported incident at Mitsubishi Electric. Network intrusion detection and endpoint inspection answer different questions: one watches traffic, the other can observe activity on the device.
Mitsubishi’s official announcement describes USB monitoring, malware detection, quarantine and removal, software management and centralised visibility through Nozomi’s broader OT/IoT security tools. Nozomi Arc, the established host-based product underlying the proposal, offers local behavioural analysis, asset inventory and endpoint-to-network correlation. An OEM implementation may make those capabilities available on certain industrial products where conventional IT antivirus is unsuitable; it will not make every PLC capable of running a host agent.
Original vendor video: Nozomi Networks — “Continuously Monitor OT Endpoints with Nozomi Arc”, published 18 July 2023. The manufacturer’s own product demonstration covers USB monitoring and configuration checks. It documents the earlier Nozomi Arc technology, not Mitsubishi’s newly announced 2026 implementation, and does not verify detection performance on Mitsubishi hardware. We found no independently authenticated video of the specific new equipment.
A malware alarm is not a machine-stop command
Endpoint security can operate in detection-only, quarantine or deletion modes. In an industrial cell these choices cannot be treated as equivalent. Quarantining an executable, preventing a service from starting or removing a file during a production sequence might unexpectedly disrupt a machine or make restart harder. A security integration therefore needs known-good software baselines, a controlled update and rollback procedure, testable alarms, named responsibility for response and a documented recovery route.
Many older PLCs have tight CPU and memory budgets, a proprietary runtime and limited access to filesystem events. Host agents may simply not be possible. For these systems, boundary firewalls, removable-media controls, secure engineering laptops, approved firmware tools, access management and network monitoring remain important. The most defensible architecture is layered rather than pretending one sensor can see everything.
Before any machine maker adopts embedded security code, engineers should ask about worst-case CPU and memory overhead during cyclic control tasks, watchdog behaviour, time synchronisation, logs when offline, diagnostic storage endurance, firmware signing and update validation, false-positive handling and safe failure modes. These are qualification questions, not test results Mitsubishi has published.
What is confirmed — and what remains to be demonstrated
The 22 October Mitsubishi release confirms its development work with technology from Nozomi Networks, a wholly owned subsidiary since January 2026. It says the first incorporation was due to be shown as a reference exhibit during JIMTOF 2026 (26–31 October). Control.com reporting on 5 November 2026 separately discussed the initiative alongside Mitsubishi’s distinct humanoid/CNC work.
Neither that announcement nor the product website establishes field-proven detection rates, zero false positives, support for every machine controller, pricing or actual customer results for the upcoming extension. A target of the fiscal year ending March 2028 is not a 2026 general-availability announcement. Mitsubishi’s proposal is noteworthy precisely because endpoint evidence may complement network monitoring; the implementation still requires OEM testing and sensible security policy.
How a CANS solution could help a comparable plant
CANS is not claiming to have supplied this technology, worked with Mitsubishi on it, or deployed Nozomi at any site. For a factory with mixed PLC, CNC, robot and engineering-station brands, CANS industrial automation and embedded engineering could support an independent inventory of local software-change paths and machine communications, then specify which evidence can actually be collected without disrupting the control system.
Early detection: where a supported device or its OEM security product provides them, capture USB-usage events, approved software or firmware revisions, engineering-logon history, remote sessions and endpoint alerts. Correlate those records with the machine ID, production batch, maintenance permit and PLC/SCADA state. Our PLC/SCADA integration services and CansNEXUS monitoring platform could display this time-aligned context and preserve diagnostic history. A CansNEXUS dashboard is not itself malware-detection software: reliable security events must originate from an appropriate sensor or security system.
Risk reduction: engineer OT network segmentation against the plant’s real data flows, control access from engineering laptops and remote vendors, record firmware baselines, test backups and establish an authorised update process. Where supported, alert on a new configuration outside its maintenance window. The response should go to a named engineer, not an unreviewed automated intervention.
Containment and recovery: an approved incident procedure may isolate a suspect workstation or network segment without disabling an independent machine-protection system. Combine authorised security investigation with CansNEXUS event history, machine downtime and engineering risk assessment to reconstruct what changed and which production lots may require review. CMMS work orders can track inspections and controlled return to service.
Safety limits: general-purpose security agents, AI, trends, alarms and supervisory dashboards cannot guarantee that an industrial cyber incident, equipment failure or injury will be prevented. Certified interlocks, hardwired stops, protective relays, physical safeguards and validated safety procedures must remain independent. A badly planned automatic quarantine can itself cause lost production; any active security response needs risk assessment and acceptance testing.
The engineer’s takeaway
Network monitoring tells you what moved across a wire. Endpoint monitoring may tell you what changed inside the machine before anything interesting reached that wire. Joining the two is valuable; doing so without disturbing deterministic control is the difficult work.
For a practical assessment of industrial communications, controlled engineering access or CansNEXUS diagnostic integration, contact CANS or send us a WhatsApp enquiry.
Original sources, video and image rights
- Mitsubishi Electric press release, 22 October 2026 — announced functions, JIMTOF reference exhibit and target launch window.
- Nozomi Networks, Arc product details — vendor-described host detection, USB monitoring and quarantine choices; not independently measured results.
- Original Nozomi Arc product video — 18 July 2023, not footage of the new Mitsubishi system.
- Control.com, 5 November 2026 — independent industry coverage.
Featured photograph: Industrial machinery control cabinets photographed by Poly-protech on 9 April 2014, Wikimedia Commons, CC BY-SA 4.0. Unmodified, illustrative only; not Mitsubishi Electric or Nozomi equipment. The featured image is not repeated within the article.
Recent Comments