Physics Doesn't Lie: Engineering the Last Line of Defense Against Threats We Can't Tell Apart

This is Part 3 of a three-part series on Natech risk and cyber safety in critical infrastructure. Part 1 explained how natural disasters corrupt sensor data and trigger cascading failures. Part 2 examined how adversaries exploit that corruption. Part 3 lays out the practical methods to close the gap, before climate change closes the window.

Natech events are no longer a future problem for industrial risk managers. Climate change has lead to rising storm intensity, prolonged heatwaves, and shifting flood patterns while simultaneously expanding the attack surface for cyber-physical failures. The methods we use to assess and detect these risks must evolve at the same pace.

Detect contradictions, not identities

Industrial processes operate within immutable physical constraints. Massive equipment cannot accelerate instantly. Tanks cannot jump from freezing to boiling in seconds. If flow enters a pipe at one point, conservation of mass dictates it must exit somewhere else. 

A detection framework anchored in conservation principles, thermodynamic limits, inertia, and network topology can catch sensor corruption, malicious spoofing, and hidden system faults, regardless of whether the data is properly authenticated. This is the physics-based detection principle: anchor to the physical world, and anything that violates it gets flagged.

Four technical assessment methods

1. Model-Based Plausibility Checks: This is the most direct method as it compares what a sensor reports against what physics says is possible. Mass and energy balance checks catch readings that break conservation laws. These checks run continuously and require no network-level visibility, only a model of the process they monitor.
2. Redundant Sensing and Cross-Sensor Reconciliation: No single sensor should be the sole source of truth for a safety-critical measurement. Cross-sensor reconciliation compares readings from independent instruments measuring related variables. If a pressure sensor and a flow sensor on the same line disagree in ways that violate fluid dynamics, one of them is wrong, and the system knows it before operators do.
3. State Estimation with Physical Constraints: Digital operations and state observers take plausibility checking further. By maintaining a real-time physics-based model of the process, they can estimate what the state of the system should be and compare it against what sensors claim it is. When the gap exceeds what the physical model allows, the system raises an alert. This approach is particularly powerful because it catches slow drift (sensor degradation that stays within normal ranges but gradually diverges from physical reality).
4. Disaster-Mode Control Profiles and Fail-Safes: Normal operating logic assumes normal conditions. During a Natech event, control systems should switch to disaster-mode profiles that tighten plausibility bounds, increase cross-validation requirements, and default to safe states when sensor agreement breaks down. It is fundamental to recognize how the information environment has changed and automation must adapt its confidence thresholds accordingly.

The governance layer

Technical methods alone are insufficient without the organizational structure to sustain them. Four governance elements are essential:

Cross-functional oversight bridging safety and security: Natech risks live in the gap between these disciplines. Neither team owns the problem alone. A joint governance body, with authority over both physical safety systems and digital security architecture, must own the integration.

Data quality SLAs for critical instrumentation: Sensors can degrade and calibration can drifts. Organizations need enforceable standards for measurement accuracy, maintenance intervals, and replacement triggers on safety-critical instruments. These should not just be best practice, but a contractual obligation within the safety management system.

Detection in the loop before actuation: Physics-based plausibility checks must sit between sensor input and control action. If a reading fails a plausibility test, the control system should not act on it. This "detection before actuation" principle prevents automation from confidently making things worse.

Drills and tabletop exercises for Natech–cyber scenarios: Teams that have never practiced responding to simultaneous physical and digital failures will not perform well when they occur. Tabletop exercises that simulate corrupted sensor data during a natural disaster can force operators to identify which readings to trust. This builds the judgment that no automation can replace.

Revisiting winter storm Uri: what could have been

Had a physics-based detection framework been deployed across the Texas gas infrastructure during February 2021, the cascade that brought the grid within minutes of total collapse could have been intercepted at its earliest stage.

As instruments froze across natural gas wellheads and compressor stations, such a framework would have flagged the divergence between reported pipeline pressures and what thermodynamic models dictated was physically possible under the observed conditions. The system would have caught the sensor corruption before SCADA systems relayed stale or fictitious data to grid operators.

Instead of operators making blind load-shedding decisions based on instrumentation that no longer reflected reality, the framework would have isolated the corrupted signals, thus preserving the situational awareness needed to manage fuel supply shortfalls deliberately rather than reactively. The outcome might not have been comfortable, but it could have been controlled, potentially averting the $130 billion in damages and loss of at least 246 lives.

Climate risk changes the calculus

What makes this investment urgent is that climate change is increasing both the frequency of triggering events and the severity of their consequences. Rising storm intensity, prolonged heatwaves straining cooling systems, and shifting flood patterns that exceed historical design assumptions all mean that facilities engineered for a 20th-century climate are increasingly exposed to 21st-century hazards.

The IPCC's Sixth Assessment Report confirms these trends as extreme precipitation events and coastal flooding are intensifying, and the frequency of compound hazards (where multiple stressors coincide) is rising. For industrial facilities, this means the likelihood of a Natech event triggering the failure chain (physical damage, sensor corruption, confident AI acting on invalid data, system-accelerated crisis) is not static. 

Investment priorities

For decision-makers evaluating where to begin:

1. Start with the highest-consequence loops: Identify the control loops where corrupted sensor data would trigger the most dangerous automated response. These are your first candidates for plausibility checks.
2. Layer detection before actuation: Retrofit physics-based validation between sensor input and control logic on critical systems. This is the single highest-leverage intervention.
3. Build cross-functional governance: Establish joint safety-security oversight with explicit authority over Natech scenarios.
4. Invest in disaster-mode profiles: Develop and test alternative control logic that activates during environmental events, with tighter bounds, more cross-validation, and safer defaults.
5. Exercise regularly: Tabletop Natech-cyber scenarios at least annually. The gap between "we have a plan" and "we've practiced the plan" is where real incidents become catastrophes.

The bottom line

Separating safety engineering from cybersecurity was a convenience but it fails to recognize how threats actually operate. Natech events have made that separation untenable. Environmental volatility is increasing, industrial systems are more automated and interconnected, and the consequences of corrupted sensor data can rival the consequences of physical equipment failure.

Physics-based detection is the missing layer that closes the gap between authenticated data and physical reality. Organizations that embed it into their control architecture, governance, and investment strategy will be materially more resilient. Those that do not will remain vulnerable to a class of failure that firewalls cannot see and incident response teams cannot distinguish from natural damage.

The question is not whether to act, but how quickly.

Further reading

Cyber-Informed Engineering

CISA Tabletop Exercise Packages

Climate Change 2021: The Physical Science Basis

How Gas Plants Fail and Lead to Power Outages in Extreme Winter Weather