While AI has realized numerous benefits for manufacturers, it has also generated cybersecurity concerns, especially regarding the convergence of IT and OT environments. It’s no surprise that the Rockwell Automation 2025 State of Smart Manufacturing Report cites cybersecurity as the #2 external risk for manufacturers, and more than a third of manufacturing executives said that strengthening their IT/OT security architecture over the next five years is a top priority.
The surge in AI adoption has inadvertently created a cybersecurity paradox for manufacturers. To fully extract all the benefits of this game-changing technology, both sides of the technology house need to be united. And yet, doing so presents tremendous security risk to the OT environment.
Further, AI has emboldened would-be adversaries, who now have access to advanced tools available on the dark web for anyone with a credit card and basic software skills, leading to a rise in security threats.
To combat this, manufacturers should examine modern, AI-driven defense strategies such as Network Detection and Response. This category of highly intelligent threat detection helps manufacturing security teams quickly identify suspicious behavior across the IT/OT converged infrastructure and thwart attacks before they disrupt production.
IT/OT Convergence: Increased Attack Surface
Historically, manufacturing OT environments were more secure than their IT counterparts due to proprietary systems and air-gapped networks. However, IT/OT convergence, driven by AI, digital transformation, and IoT, has blurred these boundaries, exposing operational systems to the internet. While this convergence boosted efficiency and the manufacturing attack surface. OT environments are no longer air-gapped and share IT vulnerabilities.
Meanwhile, threat actors have been mastering and weaponizing AI, leveraging it to deliver more potent and elusive attacks due to its capabilities in pattern recognition, automation, and predictive analytics. One of the more troubling aspects of AI's application by cyberattackers is its potential for reconnaissance and automated vulnerability detection.
In the past, this was a time-consuming manual process for attackers that required sifting through public information and network scanning, often taking hours, days, or even weeks. AI and automation enable adversaries to dramatically expedite this process. AI accelerates their network scanning and reconnaissance, including port scanning, protocol fuzzing, or device enumeration. AI can even map out a manufacturing plant’s OT topology.
For OT systems in manufacturing, this is a whole new world of risk. And today’s cybercriminals are savvy enough to know that the OT environment is where the real “crown jewels” of a manufacturing business are.
Fire With Fire: AI and Network Traffic Monitoring
NDR uses AI to quickly identify anomalous patterns and indicators of compromise (IOCs) that would otherwise go unnoticed. Machine learning models can identify deviations from previously determined baseline network behavior, detecting potential zero-day attacks, ransomware, insider threats, and lateral movement.
Examples of IOCs in an OT setting can include:
- Unusual network traffic patterns to or from OT devices such as PLCs and SCADA systems.
- Unexpected or unauthorized attempts at external IP connections from OT systems.
- Unauthorized protocols being used on OT networks, such as SSH or RDP on a controller.
- Unusual or unauthorized changes in control logic or firmware on a connected device.
- Logins from unexpected locations, times, or user accounts.
- Attempted use of default, generic, or expired credentials.
- New user accounts suddenly appearing on OT systems.
- Equipment suddenly behaves erratically or inconsistently without a mechanical cause.
AI-driven NDR solutions have the ability to detect all of these anomalies and more because they continuously monitor network traffic to detect, investigate, and respond to threats in real-time. Unlike traditional security tools that rely on predefined signatures or endpoint-based detection, NDR leverages machine learning (ML), behavioral analytics, and anomaly detection to identify both known and unknown threats moving laterally within an organization’s network.
NDR is crucial to securing modern IT/OT converged infrastructure because the network today, whether cloud or physical, is the single source of truth for a manufacturing organization. All information passes through the network, making it a critical protection point against cyber attacks.
By analyzing live network traffic, NDR solutions provide deep visibility into cyber threats, uncovering malicious activity that may bypass traditional security measures like firewalls and endpoint detection & response (EDR) solutions. These insights enable security teams to rapidly contain and neutralize threats before they can cause widespread damage.
NDR solutions operate by collecting and analyzing network traffic data to detect anomalies and suspicious behavior. The architecture typically consists of:
- Sensors and Packet Capture: Passive network sensors (virtual or physical) are deployed across the manufacturing organization’s environment, both IT and OT, to collect network flow data, deep packet inspection (DPI), and metadata from network communications.
- Behavioral Analytics and Machine Learning: Once the sensors are in place and collecting data, NDR systems use AI and statistical models to establish baselines of normal activity and flag deviations that could indicate a cyber threat.
- Threat Intelligence Integration: NDR systems use contextual data to enrich security alerts, giving the analyst a more detailed picture of the suspicious behavior. This enhances detection accuracy and minimizes false positive alerts that can burn through resources.
- Incident Correlation and Automated Response: NDR’s AI ability correlates events across different data sources and triggers automated actions (e.g., isolating compromised devices, blocking malicious traffic, or escalating incidents to security analyst). Think of it as a highly intelligent security research assistant that investigates and provides suggestions on next steps after suspicious activity.
By deploying an NDR solution, manufacturing organizations can detect threats that bypass traditional security. They can identify lateral movement, insider threats, and supply chain attacks that evade firewalls and endpoint security. In particular, the onset of phishing, ransomware and malware infections, NDR helps see the signs of these attacks very early through spotting the signs of account takeovers, corrupted credentials, and anomalous “lateral movement” traffic flows as attackers attempt to move between IT and OT systems.
For the manufacturing industry to thrive in the AI era, its security must be proactive. This approach will allow it to withstand current threats and anticipate and neutralize future attacks, ensuring continued productivity and resilience.
