A ransomware incident rarely begins with a dramatic warning on the factory floor. It may start with a convincing email, a reused password or a remote connection left exposed. By the time files are encrypted, the impact can spread from office systems to ERP or MRP data, warehouse terminals, planning stations and the equipment needed to keep orders moving. Effective ransomware protection for factories is therefore about more than antivirus. It is about protecting production continuity.
Why ransomware hits factories differently
A production business has little room for uncertainty when systems fail. If drawings, schedules, stock records or machine programs cannot be accessed, teams may be forced into manual workarounds. Those workarounds can help for a short period, but they quickly introduce errors, delays and traceability problems.
Manufacturers also tend to have a more complex mix of technology than a typical office. A site may combine modern cloud services with older PCs attached to machinery, shared shop-floor terminals, specialist engineering software and vendor-managed industrial equipment. Some of these assets cannot simply be patched or replaced without considering safety, validation, machine warranties and planned production downtime.
This does not mean older equipment has to remain an unmanaged risk. It means the controls around it need to be designed for how the factory actually operates.
Ransomware protection for factories starts with knowing what stops production
The first question is not which security product to buy. It is which systems, data and connections are essential to producing, despatching and invoicing goods.
For one business, the priority may be an ERP platform that holds works orders and material availability. For another, it may be the engineering file server, a production scheduling system, label printing, or a specific PC that transfers programs to a CNC machine. Mapping these dependencies reveals where an attack would cause the most costly interruption.
A useful assessment should identify who owns each system, where its data sits, how it connects to the network and whether a practical recovery method exists. It should include external supplier access too. A remote support connection may be necessary for a machine vendor, but it should not provide unrestricted access to the wider business network.
The result is a recovery priority order based on operational impact, rather than an assumption that every device needs identical treatment. That helps focus budget and effort where downtime would be most damaging.
Separate office IT from the shop floor
Network segregation is one of the most effective ways to limit the spread of ransomware. Put simply, an infection on an office laptop should not be able to move freely to production devices, and a compromised legacy machine should not have open access to finance files or cloud administration accounts.
A well-designed factory network separates business systems, guest Wi-Fi, servers, production equipment and high-risk legacy devices. Access between these areas is permitted only where there is a clear operational need. For example, an ERP system may need to exchange data with a production application, but that does not mean every workstation should be able to communicate with every machine.
Older operating systems often need particular care. Replacing them may be the right long-term decision, but immediate replacement is not always viable. Compensating controls can reduce exposure in the meantime: isolate the device, remove unnecessary internet access, restrict who can log on, tightly control removable media and monitor its network activity.
For machinery requiring vendor support, a managed jump machine is often safer than allowing direct remote access to the equipment. The vendor connects to a controlled, monitored device, then reaches only the approved system. This preserves support access while reducing an avoidable route into the factory.
Backups must be recoverable, not merely present
Ransomware operators know that backups are valuable. They frequently try to encrypt, delete or steal backup data before making their demand. A backup that is permanently connected to the same network, protected by the same administrator account or never tested may provide false reassurance.
Factories need backups that are separated from day-to-day systems and protected by different access controls. Copies should be retained in more than one location, with at least one immutable or otherwise protected copy that cannot be altered by a compromised account. The exact approach depends on the volume of data, recovery targets and the applications involved, but the principle is consistent: an attacker must not be able to destroy every route back to operation.
Recovery also needs to be tested against the systems that matter. Restoring a file is not the same as restoring an operational service. Can the restored ERP database open correctly? Can users access the application? Can production orders be processed and labels printed? Is the data recent enough to avoid days of rekeying?
Testing exposes problems while there is time to fix them. It also gives senior leaders a realistic view of how long recovery will take, rather than relying on assumptions made during a crisis.
Control identities, remote access and everyday permissions
Many ransomware attacks succeed because an attacker gains legitimate-looking access. That makes identity security a core production-continuity control.
Multi-factor authentication should protect email, cloud applications, remote access and administrator accounts. Shared accounts, particularly on shop-floor devices, should be reduced wherever practical. Where shared access is unavoidable, it needs clear accountability and tightly limited permissions.
Administrative access deserves separate treatment. Staff who carry out everyday tasks should not routinely use accounts with the authority to install software, change security settings or access every server. Privileged accounts should be used only when required, protected with stronger controls and reviewed regularly.
Patching remains essential, but it must be planned around production. Office systems can often be updated quickly. Machines, industrial controllers and specialist applications may require a maintenance window, supplier confirmation or testing first. A managed patching process records these exceptions instead of silently leaving them exposed.
Prepare the first hours of an incident
When ransomware is suspected, speed and calm decision-making matter. The initial goal is to contain the attack without accidentally destroying evidence or taking down systems that are still operating safely. Teams should know in advance who has authority to make decisions and who to contact.
An incident plan should set out four practical actions:
- isolate affected devices and remove unnecessary network connections;
- contact the responsible IT and security specialists immediately;
- preserve logs, alerts and other evidence for investigation;
- switch to agreed manual procedures only where they can be operated safely and accurately.
The plan should also define how production, leadership, customers, insurers and key suppliers are updated. Conflicting messages waste valuable time. So does uncertainty over whether a third-party IT provider, software supplier or machine vendor is responsible for a particular system.
A manufacturing-focused managed IT partner can help establish those responsibilities before an incident occurs. For businesses across Hampshire, West Sussex and Surrey, Syn-Star provides the specialist support needed to secure mixed office and industrial environments while keeping accountability clear.
Train people without blaming them
Technology reduces risk, but people still receive the emails, answer calls and use the systems attackers target. Training works best when it is relevant to the roles people perform. A finance colleague may need to recognise invoice fraud. An engineering team may need guidance on removable media and supplier files. Managers need to understand why an urgent request to reset a password or approve a payment deserves verification.
The aim is not to catch people out. It is to make reporting easy and prompt. A colleague who reports a suspicious email within minutes can prevent a wider incident. Clear reporting routes, regular short training and realistic phishing simulations are generally more effective than an annual presentation nobody remembers.
Make resilience a routine production decision
Ransomware protection is not a one-off project completed when new security software is installed. Networks change, new equipment arrives, suppliers need access and old systems remain in service longer than planned. Regular reviews keep security aligned with operational reality and support wider requirements such as Cyber Essentials, ISO standards and customer assurance requests.
The most useful measure of protection is simple: if one user account or device is compromised tomorrow, how far can the attack spread, and how quickly can production recover? Answer that question honestly, test it regularly and improve the weak points before they become a costly stoppage.
