A system for virtual patching of security vulnerabilities in an industrial production environment with a plurality of industrial automation devices, the system comprising: A security operations center to deploy virtual patches to at least one of a plurality of industrial automation devices, with each of the industrial automation devices being a programmable logic controller PLC, and with each industrial automation device comprising: an app container comprising a virtual patching engine security application configured to: collect system information generated by the industrial automation device during operation, and apply the one or more virtual patches to the system information to identify one or more security attacks, wherein the security operations center is built as a centralized security operations computer connectable to the multiple industrial devices and is configured to: Receive an indication of one or more security vulnerabilities exploitation methods applicable to industrial control systems; reproduce the one or more security vulnerabilities exploitation methods using a simulated industrial environment; generate a vulnerability exploitation detection signature corresponding to the one or more security vulnerabilities exploitation methods; identify one or more industrial automation devices to which the vulnerability exploitation detection signature is applicable; and for each identified industrial automation device, generate a virtual patch operable to detect attempted execution of the one or more security vulnerabilities exploitation and distribute the virtual patch to the identified industrial automation device, wherein the security operations center further comprises an Analytics Cloud, and wherein the Analytics Cloud is configured to correlate threat intelligence information, product information, security vulnerability information, production process data, process configuration information, network topology information and security configuration information to identify attack vectors applicable to the plurality of automation devices based on said correlated information, and wherein virtual patches are generated based on the attack vectors. collect system information generated by the industrial automation device during operation, and apply the one or more virtual patches to the system information to identify one or more security attacks, Receive an indication of one or more security vulnerabilities exploitation methods applicable to industrial control systems; reproduce the one or more security vulnerabilities exploitation methods using a simulated industrial environment; generate a vulnerability exploitation detection signature corresponding to the one or more security vulnerabilities exploitation methods; identify one or more industrial automation devices to which the vulnerability exploitation detection signature is applicable; and for each identified industrial automation device, generate a virtual patch operable to detect attempted execution of the one or more security vulnerabilities exploitation and distribute the virtual patch to the identified industrial automation device, wherein the security operations center further comprises an Analytics Cloud, and wherein the Analytics Cloud is configured to correlate threat intelligence information, product information, security vulnerability information, production process data, process configuration information, network topology information and security configuration information to identify attack vectors applicable to the plurality of automation devices based on said correlated information, and wherein virtual patches are generated based on the attack vectors.