A security monitoring device that can be externally attached to a control device having a program execution portion that executes a program produced in accordance with a control target, to control the control target, the security monitoring device comprising: a communication port for connection with the control device, wherein the security monitoring device is configured to communicate with a CPU unit of the control device via the communication port; a network interface for connection with a network; wherein the security monitoring device is configured to mediate between network and control device so that the CPU unit can perform data communication with a device connected to the network through the security monitoring device; and the security monitoring device is configured to communicate with the CPU unit of the control device via the communication port, to acquire a CPU unit state information of the CPU unit; and a detection portion configured to detect a security event by determining whether or not data to be exchanged with the device connected to the network via the network interface and/or the CPU unit state information matches a condition for the security event; and a notification portion configured to provide a notification, upon detection of the security event, to a notification destination corresponding to the generated security event, wherein the security monitoring device is configured to monitor a connection to a port of the control device by monitoring the CPU unit state information, the port being provided for connection with the network but network port is an unused port and is disabled during operation of control device, and the security event includes that, when the port is a disabled port, the port is connected to the network; and/or the security monitoring device is configured to monitor a connection to a second port of the control device by monitoring the CPU unit state information, the second port being provided for connecting a support device capable of developing the program to be executed in the control device, and the security event includes that the support device capable of developing the program to be executed in the control device is connected to the control device. a communication port for connection with the control device, wherein the security monitoring device is configured to communicate with a CPU unit of the control device via the communication port; a network interface for connection with a network; wherein the security monitoring device is configured to mediate between network and control device so that the CPU unit can perform data communication with a device connected to the network through the security monitoring device; and the security monitoring device is configured to communicate with the CPU unit of the control device via the communication port, to acquire a CPU unit state information of the CPU unit; and a detection portion configured to detect a security event by determining whether or not data to be exchanged with the device connected to the network via the network interface and/or the CPU unit state information matches a condition for the security event; and a notification portion configured to provide a notification, upon detection of the security event, to a notification destination corresponding to the generated security event, wherein the security monitoring device is configured to monitor a connection to a port of the control device by monitoring the CPU unit state information, the port being provided for connection with the network but network port is an unused port and is disabled during operation of control device, and the security event includes that, when the port is a disabled port, the port is connected to the network; and/or the security monitoring device is configured to monitor a connection to a second port of the control device by monitoring the CPU unit state information, the second port being provided for connecting a support device capable of developing the program to be executed in the control device, and the security event includes that the support device capable of developing the program to be executed in the control device is connected to the control device.