13. The security analysis tool of claim 1 , wherein the analyzer component further performs an automated action that disables network requests from at least one outside network in response to detecting that the current pattern of the data traffic deviates from the learned pattern in excess of the acceptable deviation.
1. A security analysis tool, comprising: a processor; and a memory communicatively coupled to the processor and having stored thereon computer-executable components configured to implement the security analysis tool, the computer-executable components comprising: a learning component that monitors communication of data associated with an I/O table of an industrial controller of an automation system during a training period and generates a learned pattern of communication, wherein the I/O table stores input data received by the industrial controller from a controlled device via an I/O device and output data provided by the industrial controller to the controlled device via the I/O device; and an analyzer component that monitors data traffic subsequent to the training period and generates one or more security outputs in response to a determination that a current pattern of the data traffic deviates from the learned pattern in excess of an acceptable deviation, the one or more security outputs comprising at least one output that alters the data traffic between the industrial controller and the I/O device.