Production lines now rely on networked machines, building systems, and cloud software that keep materials, people, and data moving. That connectivity drives efficiency, but it also links digital failures to physical consequences on the floor.
Manufacturing accounts for approximately 22 percent of all cyberattacks, and 55 percent of organizations report operational outages tied to cyber incidents. Additionally, 43 percent have lost critical data or intellectual property as a result of those attacks.
Recent breaches affecting major automakers and tire manufacturers have illustrated these risks, triggering shutdowns, halting logistics, and forcing manual workarounds. Although attackers often target data, increasingly they aim for operations.
Separately managed IT, OT, and physical security can allow downtime to spread quickly and incur higher costs. The sequence from breach to significant financial loss can unfold through a series of cascading events, with financial impacts extending beyond immediate disruption to include subsequent supply chain aftershocks.
The New Attack Surface: Where IT, OT, and the Plant Meet
A factory’s “system” is bigger than its network. Card readers control access to production areas; safety controllers and human-equipment interfaces coordinate personnel and machinery; cameras monitor lines, yards, and loading docks; and maintenance tablets update firmware, collect sensor data, and open service tickets.
When authentication fails or a single compromised device talks to the wrong controller, the impact is tangible. Doors don’t open, programs don’t load, and conveyors stop.
For this reason, more than half of manufacturers now treat cybersecurity as an extension of physical security. This recognizes a practical truth: a digital problem can knock out a press or lock out a shift just as quickly as a tripped breaker.
The critical thread through such incidents is the increasing influence of digital controls over physical outcomes in the plant. Seeing the floor through this lens brings the real attack surface into focus and sets the stage for understanding risk.
What Goes Wrong When Security is Siloed
Organizations get into trouble when teams see only their slice of the picture.
- IT responds to alerts from identity systems, endpoints, and the network, but may not see the badge denials piling up at an exterior gate.
- OT monitors line performance, but might not be aware that a credential stuffing attack has just disabled a partner portal that dispatch uses for loads.
- Physical security watches cameras and incident logs, but may not see the malware beacon that explains why a machine stopped accepting commands.
Each group works hard, but the problem is that their tools don’t talk, so they discover the same incident three different ways and lose time coordinating by phone and email. Meanwhile, production slips, overtime accrues, and the root cause becomes increasingly challenging to prove.
A Connected Operations Model
The fix is to converge signals and actions. With budgets tight and headcount flat, leaders are taking steps that demonstrate value quickly and lay a foundation for future security planning. Here are some steps to add to your daily operational rotation:
- Unify incident intake. Route alerts from access control, cameras, network tools, and line sensors into one case record. If an equipment alarm and a badge exception occur simultaneously in the same area, treat them as a single event by default.
- Standardize playbooks with OT in mind. Define joint runbooks for loss of badge service, site network degradation, or unexplained line stoppage. Specify who owns the first 10 minutes, which systems to check, and when to default to manual procedures.
- Instruct the handoff to the floor. Provide guards and supervisors with mobile workflows that capture the necessary evidence on the spot (including time, location, photo, video, and asset ID) and automatically transmit it to IT and OT without requiring rekeying.
- Rehearse like safety drills. Simulate a cyber-physical scenario each quarter. Cycle through a badge outage, a remote access compromise, and a controller lockdown. Practice the decision points that shorten recovery.
- Close the loop with metrics. Finally, make the program measurable. Track mean time to detect, isolate, and recover for cross-domain incidents, and keep a simple downtime ledger tied to each case. When leaders can identify which controls are hindering recovery and by how much, priorities become clearer and funding conversations become easier.
Metrics will also surface a common weak spot: partners. Many disruptions start off-site and spread through shared credentials, VPNs, or unmanaged devices. Addressing these gaps means treating supplier access like your own, with unique logins, least-privileged access, and change alerts.
If a vendor portal or integration goes down, plants should see it within minutes, not discover it at shift change. Shoring up partner access is only half the fix; the other half is ensuring your own people recognize and respond to the same warning signs these controls reveal.
Putting People First
Even with strong technology in place, now is not the time to become complacent. Technology only works if people know how to use it. Crosstrain guards, operators, and technicians to spot both digital and physical warning signs. Provide short, role-based guides on how to identify tampered readers, escalate unusual login patterns, and capture machine-state details for root-cause analysis. Aim for confidence throughout the organization, not just at the SOC.
Attackers aim at disruption, shifting cybersecurity from a data issue to a production issue. A practical fix is within reach: connect what you already have, agree on playbooks, measure handoffs that cut response times, and keep partners and people in scope. That discipline helps manufacturers reduce downtime and protect production as the digital and physical converge.
