For the fifth year in a row, manufacturing was the single most targeted industry for ransomware, accounting for 22 percent of all ransomware victims tracked between April 2025 and March 2026, according to threat intelligence firm Black Kite (via Infosecurity Magazine). The same tracking found manufacturing incidents rose roughly 40 percent year over year in the first seven months of 2026.
Attackers aren’t choosing manufacturers because their data is unusually valuable. They’re choosing them because downtime is unusually expensive. When a line stops, orders slip, customers start calling and penalty clauses come into play. That urgency makes a fast ransom payment much more likely, and criminal groups know it.
What IT-OT Convergence Really Means
Operational technology, or OT, is the equipment that actually runs the plant: programmable logic controllers, industrial sensors, HMI panels, robotics and the software that coordinates production. For decades, OT lived on its own isolated network, separated from office IT by design. The people who ran it were engineers and maintenance techs, not IT staff, and the priority was keeping machines running, not patching them.
That isolation has steadily eroded, for good reasons. Manufacturers connect production data to ERP systems for real-time inventory and scheduling. Equipment vendors want remote access to diagnose problems without sending a technician. Leadership wants dashboards showing throughput and downtime. Each connection adds business value. Each one also creates a path from the office network, where phishing emails land, to the production floor, where downtime costs the most.
Why the Plant Floor Is Hard to Protect
OT environments come with challenges office IT doesn’t share. Controllers and HMIs often run older operating systems because the equipment they manage was certified on that version and costs six figures to replace. Patching may require a planned shutdown that production managers understandably resist. Some devices can’t run security software at all. Vendor remote access tools are frequently left always-on with shared passwords because that’s how the integrator set them up years ago.
None of this means the plant floor can’t be secured. It means OT security works differently. The goal is less about patching every device and more about controlling what can reach those devices and watching for anything unusual.
What a Real Attack Looks Like
When a 2025 ransomware attack hit Jaguar Land Rover’s production systems, the disruption was estimated to have cost the broader UK economy roughly £1.9 billion ($2.5 billion), almost entirely from halted production rather than any ransom. That’s the shape of manufacturing risk. The damage isn’t mainly about stolen data. It’s about a line that can’t run.
At a smaller scale, the pattern is familiar. An employee in purchasing opens a malicious attachment. The attacker moves through the office network and finds a file server that’s also reachable from the production network because the ERP integration needed it. From there, they reach the systems that schedule and monitor the line. On a Friday night, everything is encrypted. On Monday morning, the shift arrives to a plant that can’t start. Even manufacturers that refuse to pay can lose a week or more rebuilding systems, re-validating equipment and catching up on orders.
What Closing the Gap Actually Looks Like
Most manufacturers don’t need to rebuild their OT environment from scratch. They need the connection points between office IT and the production floor mapped and deliberately controlled, instead of assumed to be fine because “that’s how the ERP integration was set up.” A practical program usually includes:
- Network segmentation between office systems and production systems, so a compromised laptop can’t reach the plant floor directly
- Controlled vendor remote access, with MFA, individual accounts and access that’s turned on only when needed
- An asset inventory of every OT device, its software version and what it connects to
- Monitoring for unusual traffic between IT and OT, since you can’t always patch but you can always watch
- Offline backups of controller programs and configurations, so equipment can be restored without waiting on the integrator
- A recovery plan built around production, not just office data, with clear priorities for which lines come back first
Defense Suppliers Have an Extra Layer
Manufacturers in the defense supply chain face an additional requirement. Prime contractors are now flowing CMMC requirements down to their suppliers, which means protecting controlled unclassified information according to NIST 800-171 is becoming a condition of winning and keeping contracts. Many of the same controls that protect the plant floor, such as segmentation, access control, monitoring and documentation, also count toward CMMC readiness. Treating the two efforts together saves time and money.
Getting Engineering and IT on the Same Page
The hardest part of OT security is often organizational. Plant engineers worry, with good reason, that IT changes will disrupt production. IT staff may not understand why a ten-year-old controller can’t simply be updated. Successful programs start by agreeing on shared priorities: safety first, uptime second, and security as the thing that protects both. Changes get scheduled around production, tested before rollout and documented so nobody is guessing later.
OT Security Questions for Manufacturers
What is OT security?
Operational technology security protects the systems that run physical production, such as controllers, sensors and plant-floor software, from cyberattacks and disruption.
Why are manufacturers targeted by ransomware?
Production downtime is expensive, so manufacturers face pressure to pay quickly. Connections between office IT and the plant floor give attackers a path in.
What is the most important OT security control?
Network segmentation between office systems and production systems, so a compromised laptop or email account can’t reach the plant floor directly.
The Takeaway
The convenience of a connected plant is real, and so is the risk. Manufacturers don’t need to choose between them, but they do need to know exactly where office IT touches production and to control every one of those points. If you can’t draw a simple diagram showing where your office network ends and your production network begins, along with every vendor who can reach your equipment remotely, that’s the first gap to close. Attackers are counting on it staying fuzzy.
Cloud9 Tech Solutions works with Massachusetts manufacturers on IT support built around plant-floor realities, backed by the same security stack we build for every regulated client, and CMMC and NIST 800-171 guidance for manufacturers in the defense supply chain.
If you couldn’t say with confidence where your office network ends and your production network begins, that’s the gap attackers are counting on. Schedule a free security assessment with Cloud9.