A survey of integrated multi-layer security for continuous-process industrial control systems: Insights from a steel manufacturing sector

Continuous-process industries such as steel operate under tight safety and availability constraints while facing a rapidly expanding attack surface across device, network and behavioural layers. This survey consolidates evidence on legacy endpoints, protocol exposures, and process-level risks in steel manufacturing, and organises it in a structured, multi-layer taxonomy that clarifies how local faults can escalate to plant-wide disruption. Using a transparent literature search and screening protocol, the survey synthesises prior work on device hardening, network segmentation, and anomaly detection, and foregrounds what is distinctive about steel, including near-zero downtime operations and multi-vendor operational technology ecosystems. Building on this synthesis, the survey grounds actionable guidance in established industry standards by linking security controls to recognised programme requirements and mapping adversary techniques to an industrial control systems-focused attack framework, thereby providing plant-ready implementation cues. The survey also distils a phased integration workflow that locates analytics at the industrial edge and couples them with existing safety interlocks and operational change control. Case evidence from steel incidents is used to illustrate typical intrusion chains and to motivate layered mitigations. The review concludes by identifying priority research needs in data governance and benchmarking, as well as the edge-centric and safety-cased deployment of AI models, and supply-chain-aware machine learning operations. Taken together, these contributions provide a domain-grounded roadmap for strengthening resilience in steel-manufacturing industrial control systems while preserving operational continuity, and a transferable template for other continuous-process sectors.