A method for detecting an endpoint security threat to a programmable logic controller comprising: storing a baseline PLC program time signature (105A, 105B) representative of a first set of one or more scan cycle times (110, 155) of a control program stored in a memory and executed by a central processing unit of the PLC, the one or more of the scan cycle times of the first set being representative of the operating conditions of the PLC; during operation of the PLC, generating an operational program time signature representative of a second set of one or more scan cycle times of a PLC program executing on the PLC; comparing the operational program time signature to the stored baseline PLC program time signature, wherein exceeding a predetermined threshold between the operational program time signature and the stored PLC baseline program time signature identifies an endpoint security threat to the PLC indicative of reprogramming of the PLC; and if, in the comparing step, it is determined that the predetermined threshold has been exceeded, responding by notifying a user, or instructing the PLC to shut down, or changing to a fail-safe mode; wherein the stored baseline PLC program time signature is formed by: during a training period, collecting one or more averages of two or more of the scan cycle times of the first set of the control program executing on the PLC; and calculating one or more baseline parameters derived by evaluation of one or more of the scan cycle times of the first set of the control program executing on the PLC; wherein the baseline PLC program time signature comprises: a first portion representing commonly executed program paths and derived from one or more of the baseline parameters; and a second portion representing undetected program paths and derived from one or more of the collected scan cycle times of the first set of the control program executing on the PLC. storing a baseline PLC program time signature (105A, 105B) representative of a first set of one or more scan cycle times (110, 155) of a control program stored in a memory and executed by a central processing unit of the PLC, the one or more of the scan cycle times of the first set being representative of the operating conditions of the PLC; during operation of the PLC, generating an operational program time signature representative of a second set of one or more scan cycle times of a PLC program executing on the PLC; comparing the operational program time signature to the stored baseline PLC program time signature, wherein exceeding a predetermined threshold between the operational program time signature and the stored PLC baseline program time signature identifies an endpoint security threat to the PLC indicative of reprogramming of the PLC; and if, in the comparing step, it is determined that the predetermined threshold has been exceeded, responding by notifying a user, or instructing the PLC to shut down, or changing to a fail-safe mode; wherein the stored baseline PLC program time signature is formed by: during a training period, collecting one or more averages of two or more of the scan cycle times of the first set of the control program executing on the PLC; and calculating one or more baseline parameters derived by evaluation of one or more of the scan cycle times of the first set of the control program executing on the PLC; wherein the baseline PLC program time signature comprises: a first portion representing commonly executed program paths and derived from one or more of the baseline parameters; and a second portion representing undetected program paths and derived from one or more of the collected scan cycle times of the first set of the control program executing on the PLC. during a training period, collecting one or more averages of two or more of the scan cycle times of the first set of the control program executing on the PLC; and calculating one or more baseline parameters derived by evaluation of one or more of the scan cycle times of the first set of the control program executing on the PLC; wherein the baseline PLC program time signature comprises: a first portion representing commonly executed program paths and derived from one or more of the baseline parameters; and a second portion representing undetected program paths and derived from one or more of the collected scan cycle times of the first set of the control program executing on the PLC. a first portion representing commonly executed program paths and derived from one or more of the baseline parameters; and a second portion representing undetected program paths and derived from one or more of the collected scan cycle times of the first set of the control program executing on the PLC.