Verizon’s 2025 Data Breach Investigations Report (DBIR) finds that within the manufacturing industry, ransomware attacks increased by 37 percent last year and played a role in 44 percent of all breaches. We should brace for continued escalation this year, given a recent warning of sophisticated phishing campaigns designed to deliver custom malware to “supply chain-critical manufacturing companies.”
Attackers are also doubling down on other entry points. A new FBI alert warns of threat actors seeking to bring down industrial control systems by exploiting thousands of end-of-life networking devices with unpatched vulnerabilities. Scanning attacks that are used to conduct reconnaissance and find exploitable security flaws within Internet of Things (IoT) devices and network routers increased by 91 percent in 2024.
Manufacturers are feeling the pain of being in the crosshairs. According to IBM’s annual Cost of a Data Breach Report 2025, the industrial sector, which includes manufacturing companies, recorded the third highest average breach cost at $5 million, driven in part by business disruption and revenue losses due to downtime.
While the cost of downtime is a primary concern, manufacturers are also feeling pressure to navigate and meet various regulatory and compliance standards. The NIST Cybersecurity Framework has been a standard for decades and is continually updated, ICE 62443 is increasingly a focus for OT environments, NIS2 raises the stakes for supply chain security, and the new Cyber Resilience Act (CRA) sets standards for manufacturers of digital products to be sold in the European Union. And this list just scratches the surface.
Challenges From Within
The reality within modern manufacturing environments adds additional challenges. Manufacturing infrastructure is among the most complex to protect for several reasons:
- It consists of operational technology (OT) networks and Industrial Internet of Things (IIoT) devices that are connected to IT networks and out to the Internet.
- It comprises a diverse range of device types from different vendors, and with different levels of security built in.
- Some devices are new, others are legacy systems, and they have widely varying lifecycles.
Beyond the technical complexity, an additional blocker has been the human element. Responsibility for infrastructure is divided between two different teams with two different mandates.
- Traditionally, IT leadership has a mandate to build, support, maintain, and keep network infrastructure available. Network engineers develop expertise in specific device types, and their success depends on their ability to ensure system uptime and reliability.
- Security leadership has a mandate to detect and prevent breaches. They are focused on threats to the organization and hardening systems, so patching and upgrades are prioritized. With cyber risk being part of governance, risk, and compliance (GRC) programs, they are also increasingly aligned with auditing and compliance, which creates additional friction between the two teams.
Different mandates put network and security teams at odds, as they work independently with little understanding that they share the same goal: strengthening network cyber resilience.
Let’s take vulnerability management as an example.
As part of audits, security teams run scans to check for compliance and throw any vulnerabilities that surface over the fence to the network team to address. Scanning can negatively impact network performance, and it typically generates a significant number of false positives because many manufacturing assets aren’t recognized.
Additionally, legacy OT assets can have life spans of decades, which present unique challenges when it comes to proactively addressing risk. Not all vulnerabilities are created equal. And the reality is that there aren’t enough hours in the day to validate results, much less patch or manage upgrades for assets that are approaching the end of life.
Manual labor has been the last remaining barrier to success.
Collaborating Against a Common Enemy with AI and Automation
Senior decision-makers at manufacturing organizations say they see strategic advantage in converged network and security solutions that enhance security and resilience, while reducing IT workloads.
Ransomware is a common enemy as it affects uptime and security. Therefore, it makes sense to search for a converged solution. Vulnerability intelligence in the manufacturing environment is an opportunity for network and security teams to be on the same page. Here’s how.
There’s a mountain of work involved in correlating CVEs to the device manufacturer, device type, device version, and firmware version. And then network teams still lack the context to understand if the CVE is being actively exploited and if it is a high priority for teams to address. What’s more, CVEs are just one source of vulnerabilities. Teams also need to track information from device vendors, websites, and other sources.
Enter AI and automation. According to Gartner, by 2026, 30 percent of enterprises will automate more than half of their network activities, tripling their automation efforts from mid-2023. Additionally, 50 percent of enterprises will use AI functions to automate Day 2 network operations. AI enhances automation by significantly speeding up iteration, learning, and problem-solving processes.
Solutions that leverage AI and automation to track vulnerabilities from various sources and score vulnerabilities with context help prioritize remediation. This approach enables teams to automate remediation or determine if a workaround, such as a configuration change, is available and deploy it. Automation can also close the loop by validating that vulnerabilities are remediated correctly.
To stay ahead of many vulnerabilities, compliance with the Center for Internet Security (CIS) Benchmarks, which aligns with essential industry regulations, establishes a healthy posture. When teams automate compliance checks to run regularly, they can remediate during windows that work best for their manufacturing operations and proactively mitigate risk.
Building resilience means being able to detect issues quickly, contain them before they cause significant impact, and recover operations quickly with minimal disruption. When teams collaborate, they can turn the page on ransomware and other threats to uptime.
