It was a Tuesday morning, and nothing was on fire. A facilities manager I know called me about his generator — not because it had failed, but because his IT team had found it. They ran a routine network scan over the weekend and hit an unknown device with an open web port and a login page. The “unknown device” was his new generator’s remote monitoring gateway. The login still had the factory password on it.
Honestly? That’s not a rare story anymore. In the last five or six years, almost every industrial genset I’ve commissioned has grown a little black box bolted to the side — a cellular modem, an IoT gateway, a remote monitoring module that phones home with oil pressure, battery voltage, and run hours. I argued in an earlier piece that remote monitoring is worth the money. It is — I’d spec it on every new set. But here’s the thing nobody told the buyer: that little box just put your generator on the network. And anything on the network can be reached by the wrong people.
I’ve walked enough sites to know the pattern by heart. And yes, I know senior techs who roll their eyes at this — “it’s a generator, not a bank, who’d bother hacking it?” Fair. Right up until the week their IT department shows them the scan results. These are the five mistakes I keep finding. Usually all five at the same site.
Mistake number one is the dumbest, which is exactly why it’s everywhere. The gateway ships with a factory username and password — sometimes literally admin/admin — and the commissioning engineer leaves it there. In one of my projects, the same default login was on every gateway across fourteen sites, because one guy set them all up in 2019 and nobody wrote the password down anywhere. The first site to change it would have been fine. None of them did.
Look, I get it. Changing it feels like paperwork. It takes thirty seconds. Do it before the box goes live, write it in the maintenance log where the next engineer can actually find it, and give each site its own password. A default password on a networked device isn’t a password. It’s a welcome mat.
This one makes IT people twitch. The installer runs a cable from the nearest switch to the monitoring gateway, the gateway grabs a DHCP address, and now your generator controller is sitting on the same flat network as the office PCs, the printers — and, at one site I won’t name, the break room’s smart coffee machine. Any device on that network can reach the gateway’s web interface and its Modbus port. Anyone who pops a receptionist’s PC through a phishing email is suddenly one hop away from your backup power.
The fix isn’t exotic. Put the monitoring equipment on its own VLAN, or better, let the gateway talk outbound only — to your monitoring server or the vendor’s cloud — and block everything inbound. A generator gateway has no business answering questions from the accounting department’s laptops.
Remote sites — pump stations, telecom shelters, construction compounds — get cellular modems because there’s no wired internet. Fine. But some of those modems come up with publicly reachable IP addresses, and some installers, meaning well, set up port forwarding so the vendor can “check in” on the unit. So now your generator’s controller web page is facing the raw internet, and automated scanners find open ports within hours. Not targeted hackers. Bots. They knock on every door, all day.
In one of my projects, an operator’s “convenient remote access” meant the controller’s start and stop commands were reachable with no encryption at all — plain Modbus over the open internet. He went pale when I showed him. If the modem must be reachable from outside, put it behind a VPN. If it doesn’t need inbound access, close every port and let it phone out only.
Controllers and gateways get firmware updates. Manufacturers publish them — security fixes, patched libraries, closed holes. And in the field? Almost nobody installs them. I’ve opened gateway cabinets and found firmware from 2016 still running, with publicly documented flaws anyone can look up in an afternoon. The attitude is “if it ain’t broke, don’t fix it,” which works great right up until the thing you didn’t fix is the lock on the door.
Add firmware to the maintenance schedule, same as the oil and the filters. Check for updates once a year while the service tech is already on site. Test the update on one unit before rolling it out to fourteen. Boring? Yes. That’s the point.
This is the mistake I find when I ask the question and get silence. The vendor set up remote access during commissioning. The dealer who sold the unit has a login. Maybe a service contractor got one in 2021 and kept it. Shared logins, no names attached, no record of who changed a setpoint last. When something goes wrong at 2 a.m., nobody can tell you who touched the machine last — and when an employee leaves the vendor, their access only leaves with them if someone remembers to revoke it.
Give every person their own login. Revoke access the day a contract ends, not “when we get around to it.” Turn on the audit log — most decent controllers keep one — and actually glance at it now and then. Accountability isn’t paranoia. It’s maintenance.
You don’t need a cybersecurity department for any of this. You need one afternoon, a laptop, and a notepad. Change the default password. Move the gateway off the office network. Kill the port forwarding, or wrap it in a VPN. Update the firmware. Write down who has access, and take the keys back from everyone who shouldn’t.
The little black box that watches your generator is also a little black box the internet can watch back. Lock it the way you’d lock the generator room door — because that’s exactly what it is now. A door. And if you’re not sure where to start, talk to someone who commissions these boxes every week.
Email：[email protected]
Work：Monday to Friday,9:30-18:30
