As the cloud expands into industrial environments, security can no longer be an afterthought. Access, data, monitoring, technical dependencies, business continuity: every architectural choice can create a point of vulnerability or strengthen resilience. Should we wait to make corrections after systems are deployed, or should we build security in from the design phase? A discussion on the trade-offs that must be made early on to protect industrial environments before an incident occurs.