Various embodiments of the present technology generally relate to industrial automation environments. More specifically, embodiments include systems and methods to detect malicious behavior in an industrial automation environment. In some examples, a security component generates feature vectors that represents inputs and outputs to a data pipeline and supplies the feature vectors to a machine learning engine. The security component processes a machine learning output that indicates when anomalous behavior is detected in the operations of the data pipeline. When anomalous behavior is detected in the operations of the data pipeline, the security component generates and transfers an alert that characterizes the anomalous behavior.