Stop Debating Modbus vs. OPC UA: The Real Protocol Problem Is You

You've probably typed this into a search bar: "Modbus vs. OPC UA—which is better?" It's the wrong question. The real problem isn't the protocol; it's how you configure it. I'm going to say it plainly: if you're still treating protocol selection as a winner-take-all cage match, you're already behind. The smart move is to layer them, and then—this is the part everyone skips—secure that configuration.

The Holy War Is a Distraction

Modbus has been around since the late 1970s, and it's still everywhere because it works. It's master-slave, register-based, and runs over serial or Ethernet. PROFINET and EtherNet/IP are the modern real-time contenders, each with their own ecosystem. But here's the thing: these protocols aren't competitors; they're tools for different jobs. According to the OPC Foundation, Modbus, PROFINET, and EtherNet/IP connect field devices and PLCs, while OPC UA and MQTT carry data securely to SCADA, MES, and cloud systems. That's a layering strategy, not a choice.

The market is exploding—the global industrial automation market was valued at about $184.43 billion in 2025 and is projected to reach $326.48 billion by 2032 (Maximize Market Research). You're going to have more devices, more data, and more complexity. If you're still arguing about which protocol is "best," you're wasting time that could be spent on security.

OPC UA and MQTT Are Not Replacements—They're the Top Layer

OPC UA is vendor-neutral, platform-independent, with built-in encryption and authentication—it's the backbone for IIoT and IT/OT integration. MQTT is a lightweight publish/subscribe messaging transport standardized in ISO/IEC 20922, designed for constrained M2M and IoT environments. These aren't meant to replace Modbus or PROFINET on the plant floor; they're meant to carry data up to the cloud.

Here's a concrete example: You have a legacy Modbus RTU network running a packaging line. You can't rip that out—it's reliable and cheap. Instead, you put an OPC UA gateway on top that reads the Modbus registers and publishes them to MQTT for your cloud dashboard. You get secure, scalable data flow without touching the field wiring. That's layering done right.

Your Security Problem Is Configuration, Not Protocol

Now, the uncomfortable truth. CISA's Secure by Demand guidance warns that threat actors exploit weak authentication, insecure settings, and outdated protocols. Notice what's on that list? Not "Modbus is insecure." It's "weak authentication" and "insecure settings." That's configuration. NIST SP 800-82 Rev. 3, the Guide to OT Security, covers securing OT systems including ICS, SCADA, DCS, and PLCs. It doesn't tell you to abandon Modbus; it tells you to secure it properly.

ISA/IEC 62443 defines requirements for securing industrial automation and control systems, bridging the gap between OT and IT. It sets benchmarks across industries. But here's the thing: you can have the most secure protocol in the world and still get hacked if your firewall rules are a mess. The protocol is just a pipe; the configuration is the lock.

The Counter-Argument: "But Modbus Is Insecure"

I hear it all the time: "Modbus has no security, so we need to replace it." Fair point—Modbus has no built-in security. But here's the reality: you can run Modbus over a secure VPN or with a firewall that only allows specific IPs. You can put it on a separate VLAN. You can use an OPC UA gateway that adds encryption. The protocol isn't the weak link; your network design is.

And let's not pretend that newer protocols are automatically safe. OPC UA has encryption, but if you leave the default certificates or use weak passwords, it's just as vulnerable. MQTT supports TLS and OAuth, but how many of you have actually configured that? The issue is human, not technical.

What to Do: A Blunt Action Plan

• Stop choosing. Layer Modbus, PROFINET, or EtherNet/IP for field devices; OPC UA for IT/OT integration; MQTT for cloud and IoT.
• Secure the configuration. Follow ISA/IEC 62443 and NIST SP 800-82 Rev. 3. Change default credentials, disable unused services, segment your network.
• Audit your current setup. If you have a Modbus network, ask: "Is it isolated? Are the gateways patched?"

This isn't about buying new hardware; it's about fixing what you have. The market is growing—IIoT alone is projected to reach $301.38 billion by 2032 (Maximize Market Research)—and the attack surface is growing with it. You can't afford to ignore configuration any longer.

Bottom Line

Your single best move is to stop debating protocols and start layering them, then apply ISA/IEC 62443 and NIST SP 800-82 Rev. 3 to secure every layer. The protocol doesn't matter if your configuration is a sieve. Fix that first.

Sources

• OPC Foundation - https://opcfoundation.org/
• Maximize Market Research - https://www.maximizemarketresearch.com/
• NIST SP 800-82 Rev. 3 - https://csrc.nist.gov/pubs/sp/800/82/r3/final
• ISA/IEC 62443 - https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards
• CISA Industrial Control Systems - https://www.cisa.gov/topics/industrial-control-systems