Cyber Security for Manufacturing

Two risks, not one

Stoppage. A line that stops costs money by the hour, and ransomware operators price accordingly. Recovery is slower than in an office environment because reinstating control systems is not the same as restoring a file server.

Intellectual property. Designs, tooling, process parameters, tender pricing. Theft here is quiet — there is no encryption event, no ransom note, just a competitor who is suddenly better informed. Most manufacturers have no way of detecting it and no idea whether it has already happened.

Operational technology needs a different approach

This is where most generic providers get manufacturing wrong. Conventional active scanning can and does knock over legacy PLCs and HMIs — devices that were never designed to receive unexpected traffic and that fail closed, or fail loudly, when they do.

We scope OT-adjacent work conservatively. The usual approach is assessing the IT/OT boundary, reviewing network segmentation, examining remote access paths used by equipment vendors, and testing the corporate network properly — because that is where a realistic attack actually starts. Where genuine active OT testing is warranted, we will tell you that specialist OT expertise is the right answer rather than take the work.

What we consistently find

• Flat networks where an office laptop can reach the plant floor.
• Vendor remote access — permanent, unmonitored connections for equipment suppliers, often the single largest hole in the estate.
• Unsupported operating systems running machine controllers, unpatched because the vendor will not certify updates.
• Engineering workstations holding CAD and process data with no access control and no backup.
• Shared accounts on the shop floor, unavoidable in practice and rarely compensated for elsewhere.

Supply chain pressure

Large manufacturers have pushed security requirements down their supply chains substantially, and tier two and tier three suppliers who were never previously asked anything now receive detailed requirements with contractual deadlines. Cyber Essentials is normally the entry requirement; evidence of independent testing follows for larger contracts.

Where to start

Cyber Essentials, external infrastructure testing, and a segmentation review at the IT/OT boundary. Then vendor remote access — inventory every permanent connection into your network and justify each one. That exercise costs nothing and routinely finds connections nobody could account for.

Common questions