A security system for detecting a security anomaly associated with a physical process within an industrial control system, the security system comprising: an industrial control network including a plurality of endpoint devices, and at least one programmable logic controller that communicates with the endpoint devices through the industrial control network, wherein the endpoint devices: comprise sensors that monitor the physical process, actuators, smart meters or control system devices, produce telemetry data, and transmit the telemetry data on the industrial control network; and a telemetry analytics engine configured to: receive the telemetry data from the endpoint devices, partition the industrial control network into multiple sub networks by clustering the telemetry data into multiple datasets that correspond to the multiple sub networks, wherein: each of the multiple sub networks corresponds to a respective section of the industrial control network that operates independently from other sections of the industrial control network and each of the multiple datasets comprises telemetry data produced by the endpoint devices in the respective section, and receive reference data (104a, 140b) from the at least one programmable logic controller; the telemetry analytics engine further comprising: an anomaly detection processor configured to analyze the clustered telemetry data in a dataset of the multiple datasets that corresponds to a respective sub network of the industrial control network to detect anomalies in the respective sub network that indicate a potential security compromise, a root cause analysis processor configured to execute a correlation process between the reference data (140a, 140b), and data representing detected anomalies that is output from the anomaly detection processor, wherein the correlation process identifies root causes of the detected anomalies; the telemetry analytics engine identifying the root causes of the potential security compromise with respect to the industrial control system based on the correlation process and providing a security alert to a human machine interface. an industrial control network including a plurality of endpoint devices, and at least one programmable logic controller that communicates with the endpoint devices through the industrial control network, wherein the endpoint devices: comprise sensors that monitor the physical process, actuators, smart meters or control system devices, produce telemetry data, and transmit the telemetry data on the industrial control network; and a telemetry analytics engine configured to: receive the telemetry data from the endpoint devices, partition the industrial control network into multiple sub networks by clustering the telemetry data into multiple datasets that correspond to the multiple sub networks, wherein: each of the multiple sub networks corresponds to a respective section of the industrial control network that operates independently from other sections of the industrial control network and each of the multiple datasets comprises telemetry data produced by the endpoint devices in the respective section, and receive reference data (104a, 140b) from the at least one programmable logic controller; receive the telemetry data from the endpoint devices, partition the industrial control network into multiple sub networks by clustering the telemetry data into multiple datasets that correspond to the multiple sub networks, wherein: each of the multiple sub networks corresponds to a respective section of the industrial control network that operates independently from other sections of the industrial control network and each of the multiple datasets comprises telemetry data produced by the endpoint devices in the respective section, and receive reference data (104a, 140b) from the at least one programmable logic controller; the telemetry analytics engine further comprising: an anomaly detection processor configured to analyze the clustered telemetry data in a dataset of the multiple datasets that corresponds to a respective sub network of the industrial control network to detect anomalies in the respective sub network that indicate a potential security compromise, a root cause analysis processor configured to execute a correlation process between the reference data (140a, 140b), and data representing detected anomalies that is output from the anomaly detection processor, wherein the correlation process identifies root causes of the detected anomalies; an anomaly detection processor configured to analyze the clustered telemetry data in a dataset of the multiple datasets that corresponds to a respective sub network of the industrial control network to detect anomalies in the respective sub network that indicate a potential security compromise, a root cause analysis processor configured to execute a correlation process between the reference data (140a, 140b), and data representing detected anomalies that is output from the anomaly detection processor, wherein the correlation process identifies root causes of the detected anomalies; the telemetry analytics engine identifying the root causes of the potential security compromise with respect to the industrial control system based on the correlation process and providing a security alert to a human machine interface.