Operator deception is the deliberate manipulation of displays, alarms, trends, or status fields so a human controller sees a false picture of what a system is doing. In industrial environments, that can mean an HMI showing normal readings while a PLC or process is actually unsafe, or alarms being delayed, hidden, or falsified. The goal is to interfere with situational awareness rather than only with the machine itself.
This matters because operators make safety and recovery decisions based on what they see. If telemetry is manipulated, they may ignore a real fault, take the wrong corrective action, or lose time during an incident. Attackers use this tactic in OT intrusions by tampering with SCADA/HMI data, modifying engineering projects, or intercepting status feeds. Defenders counter it with independent telemetry, integrity monitoring, segmented access, and cross-checks between control screens and raw process data. Any mismatch between screens and reality should be treated as a compromise signal.