A ransomware incident does not need to reach every machine to stop a factory. If it locks the ERP server, disables a shared engineering drive or takes down the network used for labels and dispatch, production can quickly become a manual, high-risk exercise. Cyber security for manufacturing companies is therefore about more than protecting files. It is about protecting output, delivery dates, traceability and the ability to recover without prolonged disruption.
Manufacturers have a difficult security balance to strike. Office systems need frequent updates and strong controls, while machinery may depend on older operating systems, specialist software or vendor configurations that cannot simply be changed during a working week. The answer is not to ignore the risk or force unsuitable changes. It is to build sensible layers of protection around the systems that keep the business moving.
Why manufacturing is a different cyber security environment
A typical manufacturing site combines office IT, warehouse devices, production equipment, remote supplier access and business-critical ERP or MRP platforms. These systems often have different owners, support contracts and tolerances for downtime. That creates gaps attackers are quick to exploit.
A phishing email sent to accounts can become a site-wide incident if the same user account can access production shares. An engineer’s laptop plugged into the wrong network segment can expose machinery to an infection originating in the office. A remote support connection left active after a contractor finishes work can become an unmanaged route into the business.
The operational cost is what makes these incidents particularly serious. Lost production time, late orders, expedited freight, wasted materials and overtime can all follow a cyber event. Even where equipment itself is unaffected, a loss of planning, quality, stock or dispatch data can leave teams unable to operate with confidence.
Start with the systems that would stop production
Security investment should follow operational dependency, not simply a checklist of fashionable tools. Begin by identifying what would prevent safe, controlled production if it failed for an hour, a day or a week.
For most businesses, this includes the ERP or MRP platform, file servers holding drawings and programmes, domain and identity services, production planning tools, warehouse scanning, label printing, backups, network infrastructure and remote access systems. Include the less obvious dependencies too, such as a single PC used to programme a CNC machine or a shared folder containing approved work instructions.
For each system, establish four things: who owns it, who supports it, what it connects to and how it would be recovered. If those answers are unclear, the risk is already higher than it needs to be. A clear asset and dependency register gives operations, IT and suppliers a common view of priorities when an issue occurs.
Treat legacy equipment as a managed risk
Older operating systems are common on shop floors because machinery has a long service life. Replacing them may require a machine retrofit, new certification work or unacceptable disruption. They should not be treated as ordinary office endpoints, but nor should they be left exposed.
The practical approach is containment. Put legacy machines on segregated networks, limit communication to only the services they genuinely need and prevent direct internet access wherever possible. Use a controlled jump machine for authorised administration rather than allowing broad remote connections into equipment. Disable unused accounts and services, keep a record of approved vendor access and test recovery procedures before an emergency forces the issue.
Whether a machine can be patched depends on the manufacturer’s guidance, the software version and the production window available. When patching is not safe, compensating controls such as network segregation, application allow-listing and restricted access become even more valuable.
Build security boundaries between office and shop floor
Flat networks make day-to-day access convenient, but they also make it easier for an attacker to move from one compromised device to another. Segregation reduces the blast radius of an incident.
At a minimum, office users, guest Wi-Fi, production equipment, servers and remote-access services should not all sit on the same unrestricted network. The exact design depends on the site, machinery and applications, but the principle remains the same: connections should be intentional, documented and limited.
A well-designed network allows a production machine to communicate with the application or file location it requires, without giving it unrestricted access to every office laptop. It also makes monitoring more meaningful. Unexpected traffic between segments can be investigated before it turns into an outage.
Wireless networks deserve the same attention. Handheld scanners, tablets and maintenance devices need reliable coverage, but a poorly secured Wi-Fi network can bypass carefully planned wired controls. Separate staff, operational and guest access, use strong authentication and review which devices are allowed to connect.
Protect identities before attackers use them
Many successful attacks begin with a legitimate username and password. Once an attacker signs in as a user, they may look like ordinary activity until they attempt to access systems they should not control.
Multi-factor authentication should protect email, remote access, cloud applications and administrator accounts as a priority. It adds a small step for users, but it is one of the most effective defences against compromised passwords. For shared shop-floor devices, use named accounts where practical and avoid a single password known by an entire shift.
Privileged accounts need tighter control than standard user accounts. Administrators should use separate accounts for elevated tasks, and access should be granted only when required. Review former employees, old supplier accounts and inactive users regularly. Removing unnecessary access is often simpler and more effective than adding another security product.
Make ransomware recovery a tested capability
Backups are essential, but a backup that has never been restored is only an assumption. Ransomware operators increasingly target backup systems because they know recovery is the point at which their leverage disappears.
Keep multiple copies of critical data, with at least one protected from normal day-to-day network access. Back up the data that matters, but also consider the systems required to use it: server configurations, ERP databases, network settings and key application licences. Recovery priorities should reflect production needs, not just the order in which servers happen to be listed.
Run planned restore tests. A useful test proves more than whether files can be retrieved. It confirms how long recovery takes, whether the restored data is usable and whether the team has the credentials, documentation and supplier support needed to complete the job. A realistic recovery exercise may reveal that a supposedly minor server is actually a dependency for dispatch, quality or production planning.
Keep routine maintenance from becoming a production risk
Patching, endpoint protection and monitoring are essential, yet manufacturing environments need a disciplined way to apply them. A rushed update to a production-connected device can cause disruption just as surely as a missed update can create exposure.
Separate systems into groups based on criticality and supportability. Standard office devices can usually follow a regular patch cycle. Production systems may need vendor approval, pre-testing or a planned maintenance slot. Record exceptions, the reasons for them and the compensating controls in place. This creates accountability rather than allowing known risks to disappear into an informal list.
Continuous monitoring helps identify suspicious activity, failing hardware and unsupported software before they become urgent problems. For manufacturers without a large internal IT team, a managed service can provide the regular attention that security controls require, alongside responsive support when operations are affected.
Give people clear, relevant security habits
Awareness training works best when it reflects the situations people actually face. Finance teams need to recognise payment-diversion requests. Engineers need to question unexpected remote-support prompts. Warehouse and production teams need an easy way to report a suspicious email, USB device or device behaviour without feeling they are causing trouble.
Keep the reporting route simple and reinforce that early reporting is valuable. A user who reports a suspicious message before clicking has helped protect the site. Short, repeated guidance generally works better than a once-a-year presentation that is quickly forgotten.
Turn compliance into evidence of control
Frameworks such as Cyber Essentials and relevant ISO requirements can provide useful structure, particularly when customers ask for assurance. They should not be treated as a paperwork exercise. The real benefit comes from the underlying disciplines: knowing what equipment exists, controlling access, managing updates, protecting data and documenting how incidents are handled.
For businesses operating CE-compliant equipment, changes to connected systems should be carefully assessed and recorded. Security improvements must not accidentally introduce safety, performance or support issues. This is where manufacturing-aware technical guidance matters: the goal is stronger protection without creating a new operational problem.
Decide who owns the response before an incident
During an outage, uncertainty between IT providers, software vendors, machine suppliers and internal teams wastes valuable time. Establish escalation contacts, support boundaries and decision-makers in advance. Your incident plan should state who can isolate a device, who communicates with customers, who authorises recovery actions and when external specialists are called.
Syn-Star works with manufacturing businesses to make these responsibilities clearer, combining day-to-day management with security improvements that support production continuity. The right level of support depends on the complexity of the site, its existing internal capability and the risk attached to downtime.
The most useful next step is not buying technology for its own sake. Walk through a realistic failure scenario with operations, engineering and IT: what stops first, what can continue manually, and how quickly can each critical system return? The answers will show where cyber security work will have the greatest operational value.
