An automation system comprising: a local threat information server; a plurality of field devices (105, 110, 115, 120, 125, 130) operating at a control layer of the automation plant, wherein each respective field device comprises: a processor; and a non-volatile memory having a self-defending security application stored thereon, wherein upon execution by the processor, performs steps comprising: receiving an indication of a threat level for the automation plant, wherein the threat level is based on threat information from the local threat information server, identifying one or more security operations corresponding to the threat level, and executing the one or more security operations; and performing deep packet inspection on one or more received communication packets in response to the one or more security operations wherein the local threat information server comprises: a processor; and a non-volatile memory having a program stored thereon, wherein upon execution by the processor, performs steps comprising: receiving the threat information from one or more external sources (180, 185); receiving plant information from one or more internal sources (155, 160, 170, 175); and setting the threat level according to one or more of the threat information and the plant information, and distributing the indication of the threat level to the plurality of field devices (105, 110, 115, 120, 125, and 130). a local threat information server; a plurality of field devices (105, 110, 115, 120, 125, 130) operating at a control layer of the automation plant, wherein each respective field device comprises: a processor; and a non-volatile memory having a self-defending security application stored thereon, wherein upon execution by the processor, performs steps comprising: receiving an indication of a threat level for the automation plant, wherein the threat level is based on threat information from the local threat information server, identifying one or more security operations corresponding to the threat level, and executing the one or more security operations; and performing deep packet inspection on one or more received communication packets in response to the one or more security operations wherein the local threat information server comprises: a processor; and a non-volatile memory having a program stored thereon, wherein upon execution by the processor, performs steps comprising: receiving the threat information from one or more external sources (180, 185); receiving plant information from one or more internal sources (155, 160, 170, 175); and setting the threat level according to one or more of the threat information and the plant information, and distributing the indication of the threat level to the plurality of field devices (105, 110, 115, 120, 125, and 130). a processor; and a non-volatile memory having a self-defending security application stored thereon, wherein upon execution by the processor, performs steps comprising: receiving an indication of a threat level for the automation plant, wherein the threat level is based on threat information from the local threat information server, identifying one or more security operations corresponding to the threat level, and executing the one or more security operations; and performing deep packet inspection on one or more received communication packets in response to the one or more security operations wherein the local threat information server comprises: receiving an indication of a threat level for the automation plant, wherein the threat level is based on threat information from the local threat information server, identifying one or more security operations corresponding to the threat level, and executing the one or more security operations; and performing deep packet inspection on one or more received communication packets in response to the one or more security operations wherein the local threat information server comprises: a processor; and a non-volatile memory having a program stored thereon, wherein upon execution by the processor, performs steps comprising: receiving the threat information from one or more external sources (180, 185); receiving plant information from one or more internal sources (155, 160, 170, 175); and setting the threat level according to one or more of the threat information and the plant information, and distributing the indication of the threat level to the plurality of field devices (105, 110, 115, 120, 125, and 130). receiving the threat information from one or more external sources (180, 185); receiving plant information from one or more internal sources (155, 160, 170, 175); and setting the threat level according to one or more of the threat information and the plant information, and distributing the indication of the threat level to the plurality of field devices (105, 110, 115, 120, 125, and 130).