Development and Validation of an Automation Engineers Risk Exposure (AERE) Taxonomy for Industrial Control Systems

Industrial automation systems are increasingly targeted by cyber-physical threats, with engineers often serving as the first line of defense. The constrained interfaces of Human-Machine Interfaces (HMIs), coupled with operational urgency, amplify vulnerability to social engineering and misconfiguration risks. This paper reports the development and empirical validation of the Automation Engineers Risk Exposure (AERE) taxonomy, a 2×2 framework that positions individuals by (i) general susceptibility to industrial control system (ICS) risks; and (ii) ability to detect automation-specific threat cues. We followed a sequential three-phase design: (1) a Delphi study with cybersecurity and automation experts to validate ICS-relevant threat indicators and components of a susceptibility index; (2) a pilot to refine instruments and procedures; and (3) a large-scale study (N=250 automation engineers) using scenario-based assessments on simulated ICS environments. We present the construction of the Automation Engineers Control Risk Susceptibility Index (AECRSI), reliability/validity evidence, and statistical analyses relating AERE placement to role, experience, department, prior training, and demographic indicators. Results show significant heterogeneity across departments and experience bands; detection ability does not uniformly correlate with general susceptibility. We discuss implications for targeted Security Education, Training, and Awareness (SETA) programs in industrial automation.