Factories were intended to build things, not defend them. But the reality is that cyber attacks continue to target the manufacturing industry at a much higher rate than other sectors, and the potential for disruption remains very real.
When ransomware is involved, these incidents can often result in a “kiss of death” in terms of halted operations, financial losses and reputational damage.
For an illustrative example, look no further than last year’s attack on England-based Jaguar Land Rover (JLR), in which a cybercriminal collective of three hacker groups known as Scattered Spider, Lapsus$ and ShinyHunters deployed ransomware and malicious software to disrupt global operations. This forced JLR to shut down its global IT systems, halt production for five weeks and send 30,000 employees home.
The incident is estimated to have cost $2.5 billion, affected an estimated 5,000 organizations, and is considered the costliest cyber attack in British history.
While it was one of the more impactful incidents, the JLR situation was hardly an isolated case: The industry has landed on the "top three” list of targeted sectors since 2022, trailing only finance and public administration, according to Verizon’s 2026 Data Breach Investigations Report. Ransomware accounts for 61 percent of manufacturing breaches.
Symptoms of an At-Risk Industry
So why has the industry emerged as so vulnerable? Because factories are built with efficiency in mind, and not necessarily security. As a result, there are a number of “perfect storm” factors in play:
- Factories still rely on legacy security systems, which lack the visibility of modern solutions.
- In pursuit of the highly sought efficiencies, the industry is adopting advanced technologies and interconnected systems running 24/7, increasing the attack surface area and opportunities for cybercriminals to take aim.
- Supply-chain partners and additional third-party organizations add even more systems and tools to a factory operation’s attack surface.
- Smaller manufacturers remain especially vulnerable, because they typically can’t afford the resources required to effectively monitor and defend their entire cyber ecosystem.
- As with virtually all other sectors, manufacturers are moving toward the large-scale adoption of artificial intelligence (AI). Three of ten, in fact, are deploying AI/machine learning at the facility and/or network level, and one-quarter are using generative AI at the same scale, according to Deloitte. But AI acts as a double-edged sword -- it enhances efficiencies, but it also allows cyber criminals to do the same at machine speed, dramatically elevating the volume, velocity and efficacy of their attacks. Subsequently, 44 percent of manufacturing executives believe they will encounter AI-enabled threats, but only 32 percent feel they are prepared.
Key Mitigation Strategies
The lack of visibility – paired with insufficient response plans – creates a troublesome dynamic that organizations must address by acquiring the ability to “see” their entire production + IT landscape and understand which tools/capabilities will better fortify their networks. Specifically, they need to strongly consider the following components of an ideal cyber protection plan:
- Network Segmentation: Separate OT from IT networks to prevent lateral movement.
- Continuous Monitoring: Implementing 24/7 monitoring to detect anomalies on plant floor.
- Employee Training: Conducting regular, advanced phishing simulations.
- Robust Backups: Maintain regular, offline backups to recover from ransomware w/o paying.
- Enforce Zero Trust Network Access: Replace permanent VPNs w/ session-based, timed-out access.
- Develop an AI usage policy and governance.
- Implement a data loss prevention (DLP) program.
- Deploy AI-driven detection tools to identify anomalies in machine behavior at machine speed: Nearly nine of ten organizations encountered an AI-driven cyberattack in the last year.
These trends indicate that 2026 and beyond requires a threat intelligence-led defense that goes beyond traditional perimeter security to focus on identity, user activity and AI-speed response capabilities. Manufacturers need a set way of knowing their systems are always secure- a threat-led defense strategy gives organizations that were not built with security in mind a way to perform continuous cyber hygiene checks and close the gaps before they cause an issue.
With the constant risk that the manufacturing sector is facing, sector leaders can no longer afford to shortchange protection. By developing threat-led defense strategies, AI-armed responses and continuous visibility, they will mitigate the risk posed by ransomware attacks and additional compromises.
