> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# T0814 — Inhibit Response Function

> Preventing safety or protection systems from responding — a high-impact ICS technique.

**T0814 Inhibit Response Function** covers adversary actions that prevent a controller, protection relay, or safety system from performing its expected response — alarming, shutting down, or protecting equipment.

## Why it matters

Triton/TRISIS showed that attackers will target **safety instrumented systems**, not only production setpoints. Inhibiting response can leave a plant running while protections are blind — the worst outcome for physical safety.

## Typical manifestations

* Suppressing alarms or forcing “healthy” status to HMIs
* Blocking protective trip logic or watchdog responses
* Flooding or disconnecting links so RTUs cannot report (**related to availability attacks**)
* Malware that replaces legitimate firmware/logic paths (historical SIS cases)

## How Reyhford uses the technique

When honeypot traffic or enrichment suggests attempts to disable monitoring, block responses, or abuse protocol features associated with inhibit/stop behaviors (notably on S7 and IEC 104), indicators may carry **T0814** tags alongside protocol context.

Analysts should correlate T0814-tagged IoCs with [real incidents](/threat-landscape/real-incidents) (Triton) and with [T0855](/mitre/t0855) write activity on the same sources.