A supplier logging into a CNC support PC at 7pm may be perfectly legitimate. The same connection, made from an unfamiliar device with unrestricted access to the wider network, could stop tomorrow’s production. Zero trust manufacturing is the practical discipline of checking every user, device and connection before granting only the access required. Done properly, it reduces cyber risk without turning routine work into an obstacle course.
For manufacturers, the goal is not security theatre. It is keeping machines, ERP and MRP systems, warehouse operations and design data available when people need them. Zero trust helps achieve that by replacing broad, assumed access with clear controls that limit how far an incident can spread.
What zero trust means on a manufacturing site
Zero trust does not mean trusting no one in a personal sense. It means systems do not automatically trust a user or device simply because it is inside the factory network, connected to office Wi-Fi or using a known password.
Before access is allowed, the business checks relevant signals. Is this the right person? Are they using an approved, up-to-date device? Do they need this application or machine right now? Is the connection being made in an expected way? Access is then limited to that task, rather than opening the whole network.
That matters because a manufacturing business usually has far more connected dependencies than a typical office. A production planner may need the MRP system and shared drawings. An engineer may need CAD files and a programming workstation. A machine supplier may need remote access to diagnose a fault. A warehouse scanner needs a reliable wireless connection, but it has no reason to communicate with finance systems.
If one account is compromised, or one ageing computer is infected, broad network access gives the problem room to move. Zero trust aims to contain it. Think of it as fire doors between areas of a building. You hope not to need them, but you would not replace them with curtains to save a few seconds walking time.
Why conventional factory networks leave gaps
Many sites grew in stages. Office IT was installed first, then an MRP platform, a warehouse system, newer machinery and remote support tools. Each addition may have made sense at the time. The result can be one flat network where a visitor laptop, a payroll PC and a machine-connected Windows 7 computer can all see far more than they should.
Shared accounts add another problem. They are common around production equipment because several shifts need access and the machine software may not support individual logins. But when an account is shared, there is little accountability and no easy way to remove access when someone changes role.
Remote supplier access is equally difficult. Suppliers need to resolve faults quickly, particularly when a line is down. Giving them permanent, unrestricted access is convenient until their account, laptop or remote-control software becomes the route into your systems. The answer is not necessarily to ban remote support. It is to make it controlled, time-limited and visible.
Legacy equipment needs careful treatment. Replacing a working machine controller because its operating system is unsupported may not be commercially sensible, and changing it can introduce production risk. Zero trust gives you compensating controls: isolate that device, restrict its communications, prevent web browsing and email, tightly control who can administer it, and ensure recoverable backups or system images exist. These measures improve risk management, but they do not make unsupported software supported or automatically satisfy every customer requirement.
The controls that make zero trust practical
Zero trust manufacturing works best as a series of sensible improvements, not a single product purchase. The right priority depends on your production risks, current systems and what you can change safely.
Separate office, production and visitor traffic
Network segmentation is usually the foundation. It separates areas of the network so that systems only communicate where there is a genuine operational need. A production network may need to exchange specific data with ERP or MRP, for example. It does not need open access to every desktop, guest device or wireless network.
This must be planned around real workflows. Blocking a connection between a CAM workstation and a machine because nobody documented it is not a security win if it delays a job. Start by identifying critical systems, their owners and the connections they require. Then test changes during an appropriate maintenance window, with a clear rollback plan.
Verify people and devices before access
Multi-factor authentication is a straightforward example. A password alone is no longer enough for Microsoft 365, remote access, privileged accounts and cloud applications. The additional approval step makes a stolen password far less useful.
Device management adds another layer. Managed laptops and desktops can be checked for encryption, supported software, security updates and endpoint protection before they reach sensitive services. A personally owned or unmanaged device can be given limited access, or none at all, depending on the role.
This should be proportionate. Requiring an approval prompt every time an operator scans a pallet is impractical. Protecting administrative accounts, remote access and sensitive applications is usually where the benefit is clearest.
Give access for the job, not the whole network
People should have access based on their role, and elevated access should be separated from everyday work. An administrator should not read email, browse supplier portals and make system changes from the same highly privileged account.
For suppliers, provide named accounts where possible and restrict access to agreed systems. Enable remote sessions only when needed, record them where appropriate, and remove access when work is complete. This creates a useful audit trail and avoids the awkward discovery that a former contractor still has a route into a critical server.
Monitor the connections that matter
Logs are only valuable when someone can act on them. Focus on alerts that indicate meaningful risk: repeated failed sign-ins, remote access outside approved hours, unexpected new administrator accounts, disabled security tools, or unusual movement between office and production networks.
Backups sit alongside monitoring. Zero trust can reduce the chance that ransomware reaches every system, but it does not remove the need to restore data and applications. Test recovery for the systems that keep production moving, including MRP data, file shares, configuration files and key virtual servers. A backup that has never been restored is a hopeful theory, not a recovery plan.
A sensible route to implementation
Trying to redesign every network and identity system at once often creates disruption. A phased approach gives better control and helps demonstrate progress to customers, insurers and senior management.
Begin with a short assessment of the assets and connections that affect production. Identify which systems are critical, which devices are unsupported, who has administrative rights, and where external access exists. Include factory-floor PCs, Wi-Fi infrastructure, servers, cloud services, CAD and CAM workstations, warehouse devices and machinery suppliers. The office network diagram is not enough.
Next, address clear high-risk issues that do not require major production changes. Remove unused accounts, introduce multi-factor authentication for remote and cloud access, secure administrative accounts, patch supported devices, and document every supplier connection. Then plan segmentation and device controls around the production schedule.
Finally, test the response. If a shop-floor PC is isolated after suspicious activity, can production continue safely? If the MRP server fails, who decides whether to restore, rebuild or use a manual process? If a supplier needs urgent remote access, who authorises it? These are operational questions, not just IT questions, and the answers should be agreed before an incident.
Common mistakes to avoid
The most common mistake is treating zero trust as a software purchase. Technology helps, but it cannot compensate for unknown assets, uncontrolled supplier access or unclear responsibility between an IT provider, machine vendor and internal team.
Another is applying office rules to production without understanding the consequence. Automatically rebooting a machine-connected computer for updates in the middle of a shift is a good way to turn a security project into an operations problem. Updates still matter, but they need testing, scheduling and an agreed exception process.
It is also risky to assume that Cyber Essentials, customer questionnaires or cyber insurance questions can be answered by adopting the phrase zero trust. These requirements assess specific controls and evidence. Zero trust is a useful security approach, not a certificate in its own right.
When zero trust manufacturing delivers the most value
The strongest case is usually where a business has a mix of modern cloud services and older operational technology, several external suppliers, shared devices or growing customer security expectations. It can also make acquisitions, new sites and hybrid working easier to manage because access rules follow the user and device rather than relying solely on being inside one building.
The return is not limited to preventing a cyber incident. Clearer access reduces time spent guessing who owns a system. Segmentation makes faults easier to contain. Managed devices make support more predictable. Better records of supplier access help when customers ask how sensitive drawings and production systems are protected.
Start with the systems that would affect deliveries or margins if they failed for a day. Map their dependencies, identify unnecessary access and decide what can be improved without risking output. If you need an independent view of that plan, Syn-Star can review your current manufacturing IT arrangements and help turn security controls into practical, staged actions.
