A security controller for an industrial control system comprising: (a) a network port for communicating with other control elements of the industrial control system; (b) at least one processor communicating with the network port; and (c) an electronic memory system accessible by the processor and holding a security program executing on the processor to: receive from at least one other given control element of the industrial control system a security thumbprint providing an encrypted compressed representation of a current state of the given control element; analyze the security thumbprint against a stored benchmark thumbprint representing a security thumbprint of the given control element when the given control element is properly operating; when the security thumbprint does not match the stored benchmark thumbprint , assess the mismatch to produce a severity assessment having a multi-value range; and implement a security response action selected from among multiple security response actions to respond to the mismatch based on the severity assessment, wherein the security thumbprint designates a set of thumbprint source data comprising a control program of the at least one other given control element and environmental data held in the at least one other given control device , wherein the environmental data comprise wire connection states of the at least one other given control element . (a) a network port for communicating with other control elements of the industrial control system; (b) at least one processor communicating with the network port; and (c) an electronic memory system accessible by the processor and holding a security program executing on the processor to: receive from at least one other given control element of the industrial control system a security thumbprint providing an encrypted compressed representation of a current state of the given control element; analyze the security thumbprint against a stored benchmark thumbprint representing a security thumbprint of the given control element when the given control element is properly operating; when the security thumbprint does not match the stored benchmark thumbprint , assess the mismatch to produce a severity assessment having a multi-value range; and implement a security response action selected from among multiple security response actions to respond to the mismatch based on the severity assessment, wherein the security thumbprint designates a set of thumbprint source data comprising a control program of the at least one other given control element and environmental data held in the at least one other given control device , wherein the environmental data comprise wire connection states of the at least one other given control element . receive from at least one other given control element of the industrial control system a security thumbprint providing an encrypted compressed representation of a current state of the given control element; analyze the security thumbprint against a stored benchmark thumbprint representing a security thumbprint of the given control element when the given control element is properly operating; when the security thumbprint does not match the stored benchmark thumbprint , assess the mismatch to produce a severity assessment having a multi-value range; and implement a security response action selected from among multiple security response actions to respond to the mismatch based on the severity assessment, wherein the security thumbprint designates a set of thumbprint source data comprising a control program of the at least one other given control element and environmental data held in the at least one other given control device , wherein the environmental data comprise wire connection states of the at least one other given control element . <EOS>