Cybersecurity in Manufacturing: IT/OT Threats and Defenses

Cybersecurity in manufacturing is the practice of protecting factories, production lines, and the industrial systems that run them from cyberattacks. It differs from cybersecurity in most other sectors in one decisive way: an attack on a manufacturer does not just expose data, it can stop production, damage equipment, and endanger people. That impact is why manufacturing has become the world's most-attacked industry. 

According to the IBM X-Force Threat Intelligence Index, manufacturing accounted for 27.7 percent of all cyberattacks in 2025, the most of any sector and the fifth consecutive year in the top spot.

What makes manufacturing cybersecurity distinct is the mix of two worlds: the information technology (IT) systems that run the business and the operational technology (OT) that runs the plant floor. Securing both at once, across legacy machines never built for the internet, is the central challenge. 

This guide explains why manufacturers are targeted, why cybersecurity for manufacturing matters, how IT and OT differ, the top threats and real incidents that define the field, the frameworks that govern it, and how to secure production.

Why Manufacturing is the Most-Attacked Industry

Attackers choose targets by leverage, and manufacturing offers more of it than any other sector. Production cannot pause without immediate financial damage, with unplanned downtime costing manufacturers roughly $260,000 an hour on average, so attackers know a ransomware victim is likely to pay quickly to restore operations. 

That pressure shows in the numbers: Dragos attributes about 68 percent of all industrial ransomware to manufacturing, and the average manufacturing ransomware incident costs around $8.7 million, most of it from downtime rather than the ransom itself, which makes paying look cheaper than waiting even when it is not.

Three structural factors compound the pressure. Manufacturers hold valuable intellectual property, from product designs to proprietary processes, and IBM X-Force found that most attacks on the sector targeted data theft of trade secrets and financial assets. They run legacy operational technology that was never built for security, with most plants still operating decades-old industrial control systems that cannot be easily patched. And each manufacturer sits inside a dense global supply chain, where one compromised plant ripples outward to every customer and partner that depends on it, which draws nation-state actors seeking espionage or disruption.

Importance of Cybersecurity for the Manufacturing Industry

For manufacturers, cybersecurity is no longer an IT cost center but a condition of staying in business. Because operational technology controls physical processes, a breach reaches further than data, and the stakes span the entire operation:

• Production continuity. A single intrusion can halt a line or an entire plant, and lost output, missed deliveries, and broken supply commitments often dwarf the ransom or recovery cost.
• Worker and physical safety. OT governs machinery, temperature, and pressure, so a manipulated control system can cause equipment damage, environmental harm, or injury, a risk no data-only sector faces.
• Intellectual property and competitiveness. Stolen designs, formulas, and processes hand rivals and nation-states a manufacturer's hard-won advantage, with damage that lasts long after the breach.
• Supply chain reliability. Manufacturers are nodes that others depend on, so an attack on one plant disrupts customers and partners.
• Financial and regulatory exposure. Incidents carry multimillion-dollar costs, and standards such as IEC 62443 and CMMC, along with customer security demands, increasingly make strong cybersecurity a contractual requirement.

In short, manufacturing cybersecurity protects not only data but production, safety, and the trust that keeps a manufacturer in its customers' supply chains. For an industry where a single outage can ripple across an entire market, that protection is now inseparable from operational resilience.

IT/OT Convergence: What Makes Manufacturing Cybersecurity Different

Every manufacturer runs two technology environments. Information technology handles email, enterprise software, and business data, where the priority is confidentiality. Operational technology, including industrial control systems (ICS), supervisory control and data acquisition (SCADA) systems, and programmable logic controllers (PLCs), runs the physical production process, where the priorities are availability and safety. These worlds were historically separated, and the table shows why they demand different security thinking.

IT/OT convergence has erased the old gap. Industry 4.0, the Industrial Internet of Things, cloud analytics, and remote monitoring connected once-isolated systems to corporate networks and the internet to gain efficiency. The benefit is real, but so is the cost: legacy controllers that were never designed for cybersecurity are now reachable, and an attacker who lands in the IT network can often pivot into OT. 

This convergence is the core reason manufacturing cybersecurity is harder than securing a typical enterprise, because defenders contend with modern IT and fragile, unpatchable, safety-critical OT at the same time.

Top Cybersecurity Threats in Manufacturing

Manufacturers face a distinct threat set, shaped by downtime pressure, valuable IP, and exposed OT. The table pairs each threat with its main defense, and the sections that follow add detail.

Ransomware and Production Downtime

Ransomware is the single most damaging threat to manufacturers because it strikes at availability, the thing a plant cannot lose. Attackers encrypt systems and increasingly steal data first, using double and triple extortion to add pressure. 

The 2019 LockerGoga attack on aluminum producer Norsk Hydro forced a return to manual operations and cost more than $70 million, and the 2021 attack on meat producer JBS Foods halted plants and ended in an $11 million ransom. 

Network segmentation, immutable and tested backups, rapid patching, and endpoint detection and response, supported by malware monitoring, keep an incident from becoming a prolonged shutdown.

Intellectual Property Theft and Industrial Espionage

Manufacturing runs on intellectual property, and designs, formulas, and proprietary processes are exactly what competitors and nation-states want. Around 40 percent of attacks on the sector aim at data theft, and stolen IP can erase years of research advantage with no visible disruption to tip off the victim.

Unlike ransomware, espionage aims to stay hidden, so a manufacturer can lose its edge for months before noticing. Strong encryption, strict access controls on engineering and design systems, data loss prevention, and monitoring for unusual data movement reduce the risk of quiet, long-term theft.

OT and ICS Attacks

Attacks aimed directly at operational technology are the most dangerous because they can cause physical consequences. Stuxnet, discovered in 2010, manipulated PLCs to damage centrifuges and proved that code can break machines, and the 2017 Triton malware targeted the safety systems of a petrochemical plant, a step toward attacks that endanger lives. These attacks are rarer than ransomware but carry the highest stakes, since they can injure workers or damage the plant. 

Defending OT calls for network segmentation, OT-aware monitoring that understands industrial protocols, strict control of remote access, and alignment to the IEC 62443 standard built for industrial control systems.

Supply Chain Attacks

Manufacturers depend on suppliers, software vendors, and contract partners, and a supply chain attack on any of them can stop production without touching the manufacturer directly. Vendor security due diligence, contractual security requirements, least-privilege access for partners, and continuous third-party monitoring contain this fast-growing risk.

CloudSEK SVigil continuously monitors vendor security posture and third- and fourth-party dependencies, helping security teams identify exposures that could become indirect entry points into the manufacturing environment.

Public-Facing Exploitation and Credential Theft

One of the most common ways attackers get into manufacturing is the simplest: exploiting an exposed public-facing application or using stolen credentials. 

Leaked credentials sold by access brokers give attackers a quiet way in, and remote-access tools left exposed are a frequent entry point. The pattern is consistent across breach data: attackers favor the easy, exposed path over sophisticated OT exploits. Reducing the external attack surface, patching exposed systems quickly, and enforcing multi-factor authentication can close these gaps.

Phishing and Social Engineering

Phishing remains a reliable first step into manufacturing networks, since a single employee clicking a malicious link can hand attackers the foothold they need to reach IT and then OT. Social engineering works well against a workforce focused on production rather than security, and AI now makes lures more convincing. Continuous awareness training, phishing-resistant multi-factor authentication, and email filtering blunt these attacks.

Nation-State APTs and Sabotage

Critical manufacturing draws advanced persistent threats backed by nation-states, whose goals run from stealing intellectual property to pre-positioning for sabotage of production and infrastructure. These actors are patient, well-resourced, and increasingly willing to cause physical disruption, and ransomware groups now serve as deniable proxies for geopolitical pressure.

Recent campaigns have shown such actors pre-positioning inside critical manufacturers well before any disruptive move. Threat intelligence on the actors targeting the sector, strict segmentation, and monitoring for stealthy long-term intrusions are the practical defenses.

Insider Threats and Unpatched Legacy Systems

Not every risk comes from outside. Insiders with broad access can leak IP or disrupt operations, whether maliciously or by mistake, and the deeper structural problem is legacy OT: most plants still run unpatchable, decades-old systems with known vulnerabilities. Least-privilege access, monitoring of sensitive actions, network segmentation that isolates fragile systems, and compensating controls where patching is impossible keep both risks in check.

Major Manufacturing Cyberattacks and Their Lessons

The breaches that shaped manufacturing cybersecurity reveal how far an attack can reach, from corrupted data to broken machines and stalled supply chains. Each of the following remains a reference point for industrial defenders.

One thread connects these cases: in manufacturing, a cyberattack becomes a physical and operational event. Whether through damaged equipment, halted plants, or a supplier's failure, the consequence reaches the factory floor, which is why manufacturing cybersecurity treats production continuity and worker safety as the outcomes it exists to protect, not data alone but the factory itself.

Standards and Frameworks for Manufacturing Cybersecurity

Manufacturing cybersecurity is guided by standards built for industrial environments, several of which differ sharply from the data-privacy regimes that govern other sectors. The central one is IEC 62443, the international standard for the security of industrial automation and control systems, which defines security levels and a zones-and-conduits model for segmenting OT networks. NIST SP 800-82 provides detailed guidance for securing industrial control systems, while the broader NIST Cybersecurity Framework gives manufacturers a risk-based structure for the whole program.

Sector and regional rules add further obligations. In the United States, the Cybersecurity Maturity Model Certification (CMMC) sets requirements for manufacturers in the defense industrial base, and falling short can cost a contract. 

In the European Union, NIS2 extends cybersecurity and supply chain duties to manufacturers of essential products. CISA issues frequent advisories on industrial control system vulnerabilities, a large share of which involve critical manufacturing, and provides free guidance and tools for operators. 

Aligning to these standards signals diligence to insurers and customers. Together, these frameworks point manufacturers toward the same priorities: asset visibility, segmentation, patching, and monitoring across both IT and OT.

How to Secure Manufacturing Operations

Securing a manufacturer means protecting IT and OT together while keeping production running. The following practices map to the threats and frameworks above and form the core of a manufacturing cybersecurity program.

• Segment IT and OT networks. Separate business systems from the plant floor and divide OT into zones and conduits so an intrusion in one area cannot spread to production, the foundational control in IEC 62443, and the strongest barrier against IT-to-OT pivoting.
• Build full OT asset visibility. Maintain a live inventory of every controller, sensor, and connected device, since nothing on the plant floor can be protected if it is unknown.
• Secure remote access. Replace flat VPNs and exposed remote tools with controlled, monitored, least-privilege access for vendors and engineers.
• Patch on a risk basis with compensating controls. Prioritize exploited vulnerabilities, and where OT cannot be patched, isolate and monitor it instead.
• Monitor IT and OT for anomalies. Use detection that understands industrial protocols to spot intrusions and unusual commands before they reach production.
• Adopt zero trust across IT and OT. Verify every user and device and grant the minimum access needed, rather than trusting anything inside the network by default.
• Keep immutable, tested backups. Maintain offline backups of critical systems and rehearse recovery so ransomware cannot force a payment.
• Manage the external attack surface. Use external attack surface management to find exposed applications, services, and internet-reachable OT before attackers exploit them.
• Monitor stolen credentials and external threats: Use digital risk protection to identify leaked credentials, data exposure, impersonation and other external threats before attackers can weaponize them.
• Prepare an OT-specific incident-response plan. Plan and rehearse responses for production environments, where safety and restart procedures differ from IT recovery.
• Manage supply chain risk. Vet and monitor suppliers and software vendors, and require security standards in contracts.

How CloudSEK Maps a Manufacturer's External Attack Surface

Manufacturers cannot secure what they cannot see. CloudSEK helps security teams build an outside-in view of their digital exposure, combining external attack surface monitoring, threat intelligence, digital risk protection and third-party risk monitoring.

CloudSEK BeVigil continuously discovers, inventories, fingerprints and classifies internet-facing assets across eight attack surfaces, while identifying vulnerabilities and misconfigurations that could provide attackers with an initial foothold.

XVigil extends visibility beyond infrastructure to leaked credentials, exposed data, phishing, impersonation and other external threats that can be weaponized against employees, customers or the organization.

SVigil monitors third-party and fourth-party exposure, helping manufacturers identify supplier and dependency risks that could become indirect attack paths into the enterprise.

Combined with threat intelligence, AI attack surface monitoring and AI-powered attack-path analysis, these signals help security teams move beyond isolated alerts to understand how seemingly separate exposures can be chained together by an attacker.

Frequently Asked Questions

Why is manufacturing the most targeted industry for cyberattacks?

Manufacturing cannot tolerate downtime, holds valuable intellectual property, and runs legacy OT systems that are hard to secure. That mix makes attacks profitable and likely to succeed, which is why manufacturing has been the most-attacked sector for five straight years.

What is OT security in manufacturing?

OT security protects the operational technology that runs production, including industrial control systems, SCADA, and PLCs. It prioritizes availability and safety over data confidentiality because a failure can stop a plant or cause physical harm.

What is the biggest cyber threat to manufacturers?

Ransomware is the biggest threat because it halts production, and downtime pressure pushes manufacturers to pay. IP theft and supply chain attacks follow closely, and most serious incidents combine several techniques.

What is IEC 62443?

IEC 62443 is the international standard for the cybersecurity of industrial automation and control systems. It defines security levels and a zones-and-conduits model for segmenting OT networks, and it is the central framework for manufacturing cybersecurity.

How does ransomware affect manufacturing?

Ransomware encrypts systems and stops production, causing downtime that costs roughly $260,000 an hour on average. Recovery and lost output usually exceed the ransom, and attackers often steal data first to add extortion pressure.

How do manufacturers protect legacy OT systems?

Because old OT often cannot be patched, manufacturers isolate it through network segmentation, restrict and monitor access, and apply compensating controls. Asset visibility and OT-aware monitoring detect threats that reach these systems.

What is IT/OT convergence?

IT/OT convergence is the connection of operational technology on the plant floor to IT networks and the internet. It improves efficiency but widens the attack surface, exposing legacy systems that were never designed for connectivity.