A system for checking security vulnerabilities for automation system design includes a security database, an Internet crawler application, and security service application. The security database stores descriptions of known software vulnerabilities related to an automation system. The Internet crawler application is configured to systematically browse the Internet to find new software vulnerabilities related to the automation system and index the new software vulnerability into the security database. The security service application retrieves, from the security database, potential software vulnerabilities related to a hardware/software configuration of the automation system. The security service application also identifies policies related to the potential vulnerabilities. Each policy describes a potential vulnerability and action to be performed in response to detection of the potential vulnerabilities. The security service applies the policies to the hardware/software configuration and software code corresponding to an automation application to identify actual vulnerabilities that can be displayed to a user.