Manufacturing & OT security
Manufacturing has been the most-attacked industry for five years running, and most of those attacks never touch a controller. They start in the office, cross a boundary that was supposed to be there, and stop the line by encrypting the servers that run it — or by forcing you to shut everything down to contain them. This page is about that path, what a stopped day costs you, and how to test it without stopping anything.
Reviewed 24 September 2026 · 14 sources cited
The short answer
Manufacturing cybersecurity is mostly about the boundary between the office network and the plant. Most attacks that stop production start in IT — a phished login or an unpatched VPN — and reach the servers, historians and engineering workstations that run the line. Report incidents to CERT-In within six hours; OT and SCADA attacks are on the list. Start by mapping every path from IT into OT, then test those paths, passively where the equipment is live.
Why manufacturing
IBM’s 2026 X-Force Threat Intelligence Index put manufacturing at 27.7% of the incidents it responded to in 2025 — the most-targeted industry for the fifth consecutive year. In Asia-Pacific the share was far higher: manufacturing accounted for 65% of the incidents X-Force handled in the region. In India, CERT-In’s ransomware report found the same thing from the other side: manufacturing was the sector most targeted by ransomware in 2024.
The reason is not that attackers understand ladder logic. It is that a manufacturer cannot tolerate downtime, so the pressure to pay — or to restore at any cost — is unusually high. Dragos tracked 119 ransomware groups hitting 3,300 industrial organisations in 2025, more than two-thirds of them manufacturers, and noted how often these incidents are logged as “IT only” because the machine that was encrypted was a Windows server running SCADA software or an engineering workstation.
The clearest recent example is Jaguar Land Rover, part of the Tata group. A cyberattack announced on 2 September 2025 shut production at its major plants and sent staff home; the company put the cost at £196 million in that quarter alone. The UK’s Cyber Monitoring Centre estimated the wider damage at £1.9 billion across more than 5,000 UK organisations — most of them suppliers who could not ship to a customer that could not build. Closer to home, Tata Technologies disclosed a ransomware attack to the National Stock Exchange in January 2025 and suspended some IT services while it recovered.
For an Indian supplier the question is therefore two-sided: what happens to your own line, and what your customers now require of you because of what happened to theirs. Both lead to the same place — the boundary between IT and OT, and whether you can prove it holds.
Evidence
From IBM’s X-Force incident response work, Dragos’s industrial threat intelligence, CERT-In’s ransomware analysis and the Jaguar Land Rover disclosures. Each figure is linked in the sources.
CERT-In’s India Ransomware Report for 2024 names manufacturing as the most-targeted sector in India, ahead of finance and IT. IBM’s 2026 India study found offensive security testing to be the single largest factor reducing the cost of a breach.
The attack path
The composite path behind most manufacturing incidents. Each step is a place to test — and a place the attack can be stopped.
A phished login, reused credentials, or an internet-facing VPN or remote-access tool with a known, unpatched flaw. Vulnerability exploitation was the leading cause of the attacks IBM saw in 2025.
External perimeter and phishing resilience
Weak Active Directory permissions turn one account into control of every Windows machine on the network — including the ones on the plant floor that were joined to the office domain for convenience.
Active Directory privilege paths
A dual-homed server, a historian replicating into the office, a jump host with saved credentials or a vendor remote-access tool that bypasses the firewall. This is where “segmented” turns out to mean “mostly”.
Firewall rules and routes between IT and OT, tested from the IT side
MES, SCADA servers, HMIs and engineering workstations — ordinary Windows machines that happen to hold production. Ransomware here stops the plant without touching a controller.
Configuration and architecture review; active tests only on replicas, with written instruction
Either the encrypted servers take the line down, or the company switches production off to stop the spread — which is what a responsible plant does, and why the cost lands either way.
The controllers usually survive untouched. What fails is the assumption that the office and the plant were separate. Finding the real paths between them — before an attacker does — is most of the work.
Your numbers
Put in your own figures — the defaults are placeholders, not benchmarks. Nothing you enter leaves this page.
Cost of this stoppage
—
This is a floor, not a forecast: it leaves out ransom, regulatory exposure, lost customers and the cost to your own suppliers. Jaguar Land Rover’s single quarter came to £196 million.
Level by level
Organised by the Purdue reference model, the layering most plant networks are designed — or supposed to be designed — around. The line between active and passive is agreed in writing before anything runs.
| Level | What lives there | How we test it | Not without your written instruction |
|---|---|---|---|
| Levels 4–5 · enterprise IT | Email, ERP, the office network, Active Directory, cloud | Active — full penetration testing, as for any corporate network | — |
| Level 3.5 · the IT/OT DMZ | Jump hosts, historian replicas, patch and antivirus relays, vendor remote access | Active, from the IT side — can anything in IT reach past this layer? | Testing from inside the DMZ towards the plant |
| Level 3 · site operations | MES, historians, engineering workstations, domain controllers for the plant | Mostly passive — configuration and account review; active tests in agreed windows or on replicas | Any test that could restart a service during production |
| Level 2 · supervisory control | SCADA servers, HMIs, alarm systems | Passive — traffic capture, protocol inventory, configuration review | Any active scan or exploit |
| Level 1 · basic control | PLCs, RTUs, drives, safety instrumented systems | Passive only — asset and firmware inventory from observed traffic, logic backup review | Anything at all that sends traffic to a live controller |
| Level 0 · the process | Sensors, actuators, motors, valves | Architecture and physical review | Not tested |
Where active testing below Level 3 is genuinely needed, it is done on a spare controller or a test bench, with your automation engineers present. ISA/IEC 62443 is the standard family most OT security programmes are built against; SemperWise is not an IEC 62443 certification body.
Next step
A 30-minute call with a practitioner who scopes around live production. No charge, and no obligation.
Through your customers
Most of these do not bind an Indian manufacturer directly. They bind your customers — who then write them into your contracts and questionnaires.
Binds you directly. Listed incidents — including attacks on SCADA and operational technology — must be reported within six hours, and logs kept for 180 days in India.
Manufacturers of electrical equipment, machinery, motor vehicles and other listed products are “important entities” in the EU, and must manage supply-chain security — which reaches their Indian suppliers through contracts and audits.
The automotive industry’s shared assessment and exchange mechanism, run by the ENX Association: a third-party audit whose result an OEM can check instead of sending its own questionnaire. Increasingly a condition of doing business with European carmakers.
US defence contracts started carrying Cybersecurity Maturity Model Certification requirements, flowed down from prime contractors to their suppliers — Level 1 self-assessment against 15 requirements, Level 2 against 110.
Employee, dealer and customer personal data becomes subject to the Act’s security safeguards and 72-hour breach reporting.
SemperWise is not a TISAX audit provider, a CMMC third-party assessment organisation or an IEC 62443 certification body. We prepare you for those assessments, test what they will look at, and you appoint the accredited party directly.
In the room
An OT security programme fails when it is owned by one of these people and ignored by the other three.
Where SemperWise fits
Services are people doing the work; SemperWise One is the platform that keeps the evidence current between engagements. Each row says which.
“Can the office network reach the plant?”
External perimeter, Active Directory and IT/OT segmentation testing — active on the IT side, from the IT side, in agreed windows.
Network testing“What is actually on the plant network?”
A passive OT assessment: asset and firmware inventory from observed traffic, architecture and configuration review, and a prioritised list of boundary fixes. Nothing sent to a live controller.
“Our VPN and vendor remote access face the internet.”
Continuous discovery of internet-facing services, so a new remote-access portal or an exposed remote desktop is noticed the day it appears.
Attack surface management“Our ERP, MES and supplier portals are web applications.”
Authenticated testing of the applications that hold orders, drawings and supplier data.
Web application testing“Our OEM wants TISAX, NIS2 or CMMC evidence.”
Readiness against the customer’s rulebook, built on ISO 27001, so one programme answers several customers. You appoint the accredited assessor; we get you ready for them.
ISO 27001 as the base“Every customer sends a different questionnaire.”
Answer once, with the control and the dated evidence behind every answer, and reuse it — answers retire themselves when the evidence expires.
Questionnaire automation“One control set for ISO 27001, TISAX, NIS2 and CMMC.”
The unified control model maps each control once to every framework you hold, so evidence gathered for one audit counts for the others.
Unified control model“We have no security lead for the plants.”
A named senior practitioner a few days a month, with an incident response retainer for the day a line stops.
Virtual CISOQuestions
What buyers in this sector ask us before they commit to anything.
Operational technology is the equipment and software that runs physical processes — controllers, drives, SCADA servers, HMIs and historians. IT security protects information; OT security protects a process that must keep running safely. That changes the priorities: availability and safety come before confidentiality, patching may wait years for a vendor-approved window, and testing has to be designed so it cannot disturb production. The attacks, though, are mostly the same ones seen in IT — which is why the IT/OT boundary is where an OT programme usually starts.
Yes, because most of the useful testing does not touch them. Live controllers and safety systems are passive-only for us unless you instruct otherwise in writing: we build an inventory from observed traffic, review configurations, logic backups and architecture, and test the network paths that reach the plant — from the IT side. Where active testing of a controller is genuinely needed, it happens on a spare unit or a test bench with your automation engineers present. See the level-by-level table on this page.
The Purdue reference model describes a plant network in layers — from the physical process at Level 0 up through controllers, supervisory systems and site operations to enterprise IT at Levels 4 and 5 — with a buffer zone between IT and OT. Real plants rarely match it neatly, and cloud connections and remote vendor access cut across the layers. It still matters as a common language and as the frame for deciding how each zone may be tested, which is how we use it.
Not directly, unless you operate in the EU. NIS2 binds medium and large manufacturers of listed products in the EU — electrical equipment, machinery, motor vehicles, computers and electronics, medical devices and other transport equipment among them — and it requires them to manage the security of their supply chains. That is how it reaches an Indian supplier: through contract clauses, questionnaires and audit rights from European customers. The practical response is a documented, tested programme — usually built on ISO 27001 — that can answer those customers with evidence.
TISAX is the automotive industry’s shared information security assessment, run by the ENX Association: a supplier is audited once by a third party and shares the result with the carmakers that ask for it, instead of answering each one separately. It is not a law, but for suppliers to European OEMs it is increasingly a condition of the contract. SemperWise is not a TISAX audit provider; we prepare suppliers for the assessment and test what it looks at, and the audit itself is carried out by an approved provider you appoint.
Since 10 November 2025, new US Department of Defense contracts have started to carry Cybersecurity Maturity Model Certification requirements, which prime contractors flow down to their suppliers. Level 1 is an annual self-assessment against 15 basic safeguarding requirements for federal contract information; Level 2, for controlled unclassified information, covers 110 requirements and may need an assessment by a certified third-party assessment organisation. SemperWise is not one of those organisations; we help suppliers close the gaps and assemble the evidence first.
Yes. The April 2022 CERT-In Directions apply to every body corporate in India, and their list of reportable incidents explicitly includes attacks on critical infrastructure, SCADA and operational technology systems, alongside ransomware and unauthorised access. The report is due within six hours of noticing the incident, and ICT logs must be kept for 180 days in India — including logs from the plant network, where they often do not exist. CERT-In compliance covers the full set of duties.
Only if you have tested that it is. Separation erodes quietly: a historian that replicates to the office, an engineering laptop that moves between networks, a vendor’s remote-access tool installed for one job and never removed, a server joined to the office domain for convenience. Dragos notes how often OT incidents begin on exactly these Windows machines and get recorded as IT incidents. Testing the boundary from the IT side is the quickest way to learn whether the separation you designed is the separation you have.
It depends on the number of sites and zones and on how much can be observed passively, which is why we do not publish a price list. A typical first engagement covers the IT/OT boundary and a passive assessment of one plant, and runs for a few weeks including the report. We scope it in a 30-minute call at no charge, then send a written scope and a fixed price, with a retest of every fix included.
Checked by our research desk on 24 September 2026. Regulations and figures move; where a number here matters to a decision, follow it to the source.
Next step
A 30-minute call, no charge. We agree which zones are tested actively, which passively and which not at all, then send a written scope and a fixed price — with a retest of every fix included.
