Systems and methods are provided for the control of an industrial asset, such as a power generating asset. Accordingly, an interceptor module receives a state-change instruction from a state module that directs a change from a first state condition to a second state condition. The first and second state conditions direct modes of operation of at least one sub module of the controller of the industrial asset. The interceptor module then correlates the state-change instruction to a state-change classification. Based on the state-change classification, the interceptor module identifies an indication of a mode-switching attack. In response to the identification of the mode-switching attack, at least one mitigation response is implemented.