A stopped line is the real incident. Manufacturers do not measure a breach in records exposed. They measure it in shifts lost, orders missed and, for regulated producers, batches that cannot be released because the records cannot be trusted. This guide covers the four problems that show up in nearly every mid-market plant we assess, and what a right-sized program looks like.
Why manufacturers get hit
Manufacturing is the most attacked sector in most ransomware surveys because the incentives line up for the attacker. Downtime is expensive and visible, so victims pay. Plants run older systems that cannot be patched on a schedule. The office network and the production network were joined years ago for convenience and never separated. And most mid-market plants have an IT team of two to five people who also run the ERP and the phones.
The numbers from 2025 tell the story. In Sophos's survey of 332 manufacturing and production organizations, exploited vulnerabilities were the leading root cause of ransomware attacks at 32 percent, compromised credentials and malicious email followed, and respondents named a lack of in-house expertise as a contributing factor in 42 percent of attacks. The mean cost to recover, excluding any ransom, was 1.3 million dollars.
Problem one: the plant and the office share a network
The single most consequential finding in a manufacturing assessment is flat connectivity between the corporate network and the systems that run production: PLCs, HMIs, historians, lab instruments, quality systems. When an accountant opens the wrong attachment, the attacker's path to the line is a lookup away.
What good looks like:
- Zoned architecture. Production, engineering, lab and office networks in separate zones with a firewall between them, following the Purdue model in spirit if not in full. Traffic between zones is allowed by rule, not by default.
- No direct internet from production. Vendors reach equipment through a controlled remote-access path with MFA and session logging, not a modem on the panel or a TeamViewer install on the HMI.
- A conduit for the data that has to move. ERP orders down, production data up, through a defined path that can be monitored.
- An asset inventory of what is actually on the plant floor. Most plants cannot produce one. It is the first thing we build, because you cannot segment what you cannot list.
Segmentation is a project, not a purchase. It is also the single control that turns a ransomware event from a plant shutdown into an office inconvenience.
Problem two: surviving ransomware without stopping the line
Prevention matters, but the plan for the day it fails matters more. The measures that decide whether a manufacturer recovers in hours or weeks:
- Backups that survive the attacker. An offline or immutable copy of the systems that run production and quality, not just the file server. Attackers delete the backups they can reach first.
- Restore tests measured in line-downtime hours. A backup that has never been restored is a hypothesis. Test the restore of the ERP, the MES, the historian and the domain, and time it.
- Recovery runbooks per system. Who rebuilds what, in what order, from which image, with which credentials. Written before the incident.
- Identity hardening. MFA on every remote access path and every administrative account. Attackers do not break in; they log in.
- Patch cadence for what can be patched, compensating controls for what cannot. A twenty-year-old controller will not be patched. It can be isolated.
- Monitoring that someone watches. Endpoint detection on the office and engineering networks, and at minimum network monitoring on the production zone, with a party accountable for responding at 2 a.m.
The cost question is straightforward once downtime has a number. A plant that earns 80,000 dollars a day in gross margin and would be down seven days has a 560,000 dollar exposure before recovery costs. A 100,000 dollar investment that cuts that probability sharply is a good decision, and framing it that way is how it gets funded.
Problem three: the customer audit and CMMC
Manufacturers are now audited by their customers the way they should audit their suppliers. Automotive, aerospace, medical device and defense supply chains send questionnaires, and increasingly on-site assessors.
For defense work, CMMC 2.0 turns the questionnaire into a requirement. Contracts that involve controlled unclassified information require Level 2, which is the 110 controls of NIST SP 800-171, assessed by a third party for most contracts. Level 1, for federal contract information only, is 17 practices with a self-assessment.
What to do:
- Scope before you spend. Identify which contracts carry CMMC or DFARS 7012 clauses, and which systems touch that data. Most plants can shrink the assessment boundary to an enclave and avoid gold-plating the whole business.
- Gap assessment against 800-171. An honest score, a plan of action with milestones, and a system security plan. These are required artifacts, not paperwork.
- Remediate to evidence. Assessors test that controls operate. Configuration screenshots, access reviews and logs matter more than policy prose.
- Reuse the work. The same controls answer the automotive customer's questionnaire and the cyber insurer's application.
Problem four: regulated production and the records
Food, pharmaceutical, medical device and chemical producers carry a fourth exposure. Under FDA's current good manufacturing practice regulations, electronic records and the systems that hold them must be trustworthy. Backups for computerized systems used in production and quality must be exact, complete and protected from alteration or loss (21 CFR 211.68 for drugs; Part 820 and the Quality Management System Regulation for devices). Electronic records and signatures fall under 21 CFR Part 11. FDA's data integrity guidance expects controlled access, reviewed audit trails and restricted ability to alter records.
The security implications are concrete:
- Shared administrator accounts on lab or production systems are a data integrity finding, not just a security one.
- An IT provider with administrative access to those systems is performing quality-relevant work and needs to operate under change control and a quality or technical agreement.
- Backup and restore of validated systems must be documented and tested as part of the validated state.
- A ransomware event on a quality system is a potential product release problem, not only an IT outage.
We build the IT controls so they satisfy both the security assessment and the quality unit, instead of two teams building two overlapping programs.
Choosing and managing an IT or security provider
Most mid-market manufacturers run IT through a managed service provider, and many are choosing one now. Three rules from the engagements we have supported:
- Buy against a responsibility matrix, not a topic list. For every service, written inclusion, exclusion or time-and-materials status. Scope disputes are where MSP relationships fail.
- Keep security oversight independent of whoever runs the systems. The provider running the servers should not be the only party checking them.
- Set the uptime target before the quote. "We cannot be down" is not a specification. Recovery time and recovery point objectives per system let the provider price redundancy and let you judge the price.
What a right-sized program looks like
For a manufacturer between 20 and 200 million dollars in revenue, a defensible program has five parts:
| Part | What it includes | Owner |
|---|---|---|
| Governance | A named security owner, a risk register tied to downtime cost, quarterly reporting to leadership | Executive sponsor with vCISO or security lead |
| Architecture | Plant and office segmentation, controlled remote access, asset inventory | IT with engineering |
| Resilience | Immutable backups, tested restores, per-system runbooks, incident plan and tabletop | IT and operations |
| Identity and endpoints | MFA everywhere, privileged account control, endpoint detection, patch cadence with compensating controls | IT or MSP |
| Compliance evidence | CMMC or 800-171 where contracted, FDA data integrity controls where regulated, customer questionnaire library | Quality and IT together |
Budget benchmarks help frame it. Industrial manufacturers typically spend around 2 percent of revenue on IT overall; regulated producers run closer to 4 percent. Security runs 10 to 20 percent of IT spend, higher for smaller companies because the core controls cost the same regardless of size.
How we work with manufacturers
- Assessment. A scripted inventory of the plant and office environment, dependency mapping, control review against CIS v8.1, and where relevant 800-171 and FDA data integrity expectations. Output: a ranked plan with costs.
- Architecture and remediation. Segmentation design and implementation, remote access, identity hardening, backup redesign, done in your environment by our engineers.
- Program ownership. vCISO oversight, customer audit and CMMC support, provider management and quarterly leadership reporting.
Frequently asked questions
We are too small to be a target, aren't we? Attackers automate. They scan for exposed remote access and unpatched systems and do not check revenue first. Mid-market manufacturers are attractive precisely because downtime is costly and defenses are thin.
Can we segment without a plant shutdown? Usually, in phases. Inventory first, then a firewall between zones in monitor mode to learn the flows, then rules, then enforcement during planned maintenance windows. The work is engineering time more than hardware.
Do we need CMMC if we only supply a defense contractor's supplier? If controlled unclassified information flows down to you, the requirement flows with it. Check your contracts and purchase orders for DFARS 252.204-7012 and 7021 clauses.
Our MSP says security is included. Is it? Ask for the responsibility matrix. Endpoint protection and patching are usually included. Segmentation, backup redesign, incident response leadership and compliance evidence usually are not.
How is FDA compliance a cybersecurity issue? Because the regulation requires that electronic production and quality records be complete, accurate and protected. Access control, audit trails, backups and change control are both security controls and data integrity controls. One program should satisfy both.