The vulnerabilities of modern cyber defence were recently exposed during a simulated cyberattack on NATO. While the alliance managed a narrow victory, the exercise revealed an unsettling reality for the industrial sector: If a heavily fortified military alliance with vast resources struggles to withstand a coordinated digital assault, what does that mean for the average plant floor?
This simulation should serve as an urgent wake-up call to manufacturing companies that haven’t taken cyber security seriously so far.
Manufacturing plants have become primary targets for state-sponsored cyber actors who understand very well that halting a production line or disrupting a supply chain inflicts immediate financial and societal damage, making them a high-value target in geopolitical conflicts.
This heightened risk profile is a direct result of the convergence between Operational Technology and Information Technology and the still heavy reliance on legacy systems, programmable logic controllers, and assembly line machinery that were built for longevity and operational reliability but not for standing up to today’s cyber threat landscape.
And as we connect these fragile legacy environments to corporate IT networks to gather data analytics, we create a massive, complex attack surface.
Many organizations attempt to secure this environment by placing firewalls between the IT and OT domains or putting in place other segmentation methods. While that is better than nothing, it can create a false sense of security.
Aggressive cyber simulations routinely demonstrate that adversaries will exploit the subtle configuration gaps, unpatched vulnerabilities, and credential weaknesses that exist precisely where IT and OT systems interconnect. Once inside, an attacker can pivot across the network, moving from an office computer straight to the factory floor.
But even an attack that doesn’t penetrate into OT can completely disrupt production, as we have seen many times. Without an operational MES, companies could produce in theory, but don’t have the order flow to produce to.
The Traditional Flaws
The current approach to cyber security within the manufacturing sector relies heavily on static, compliance-driven methodologies. Most organizations evaluate their defensive posture through annual audits, scheduled penetration testing, and tabletop compliance exercises. These framework checkboxes satisfy regulatory requirements, but don’t always replicate the reality of a live cyberattack.
High-stakes simulations solve this problem by forcing a company to hunt for its absolute breaking points. Rather than looking at a list of assets, these exercises test the detection capabilities, decision-making speed, and communication pipelines of the entire business before a real threat actor forces them to do so under duress.
An effective pressure test for a manufacturing business should go beyond standard IT testing and should include the deployment of independent red teams, instructed to mimic actual adversary playbooks (like what we saw with the Russia-style adversary in the recent NATO exercise). These red teams must remain unpredictable, gathering intelligence and mapping organizational architecture to force the defending blue teams to remain constantly vigilant and forward-planning.
The exercise should test whether the plant manager knows how to safely isolate a compromised assembly line without shutting down the entire facility. It should evaluate whether the C-suite can make rapid, informed decisions when confronted with incomplete information and falling operational telemetry.
And it should acknowledge that an IT emergency is also a business emergency and should induce cross-functional stress across the enterprise. When an incident occurs, the operational consequences impact plant managers, supply chain directors, legal counsel, and the C-suite. A high-stakes simulation forces these disparate business units to collaborate under conditions of simulated chaos.
Lastly, these exercises should incorporate supply chain dependencies and supply chain driven attacks. Modern manufacturing relies on an interconnected ecosystem of third-party vendors, maintenance contractors, and component suppliers that cyber criminals frequently use to bypass strong corporate perimeters by compromising a smaller, less secure partner who possesses trusted access to the primary network.
