Listen to this Post
A Warning the Manufacturing Sector Can No Longer Ignore
Cybersecurity is no longer an issue confined to office computers, email accounts, and corporate networks. Across the UK manufacturing industry, digital threats are increasingly reaching directly into production environments, disrupting machinery, delaying shipments, interrupting supply chains, and creating costs that can escalate within hours.
A new report from Make UK, titled “Cyber Security in Manufacturing,” paints a troubling picture of the sector’s resilience. According to the report, almost one in three UK manufacturers — 30% — experienced a cyber incident during the previous year, either through a direct attack or an incident affecting a supplier within their supply chain.
The statistic is concerning not simply because of the number of attacks, but because of what happens after an intrusion succeeds. In manufacturing, a cyberattack does not necessarily end with stolen credentials or compromised files. It can stop production lines, prevent access to critical components, delay deliveries, create material shortages, and potentially bring an entire operation to a standstill.
The report therefore highlights a much bigger problem: British manufacturers are becoming increasingly dependent on connected technology while their cybersecurity maturity is not always keeping pace with that transformation.
Make
Published on August 10, the Make UK report combines findings from its Cyber Resilience 2026 survey with wider industry and government data to examine how prepared British manufacturers are for today’s cyber threat landscape.
Its central message is difficult to ignore. Awareness of cybersecurity is improving, but awareness alone does not equal resilience.
Many manufacturers have introduced basic security controls, but significant gaps remain in governance, incident response, supplier security, insurance coverage, and operational technology visibility.
That creates a dangerous imbalance.
Factories are becoming more connected, automated, remotely managed, and dependent on digital systems. Yet some organizations still approach cybersecurity as an IT problem rather than as a fundamental component of business continuity.
The Real Cost of a Manufacturing Cyberattack
A cyberattack against a manufacturer can have consequences that spread far beyond the compromised computer.
According to the Make UK findings, 31% of affected businesses experienced reduced production capacity or operational delays following cyber incidents.
Another 23% suffered component or material shortages, while 31% of manufacturers hit by cyberattacks reported delays in delivering products to customers.
These numbers demonstrate why manufacturing cybersecurity must be viewed through an operational lens.
When an office employee cannot access an email account, the business may lose hours of productivity. When a manufacturing system fails, however, the consequences can multiply across workers, machinery, suppliers, logistics companies, customers, and contractual obligations.
When the Factory Floor Stops
Manufacturing environments are fundamentally different from conventional corporate IT networks.
A factory may contain programmable logic controllers, industrial control systems, robotic equipment, sensors, engineering workstations, human-machine interfaces, manufacturing execution systems, remote-access platforms, and numerous connected devices.
These systems often operate continuously.
A disruption affecting one component can therefore create a chain reaction. A compromised workstation may interfere with production software. A disrupted network connection may prevent machinery from receiving required instructions. A ransomware incident may make critical operational documentation inaccessible.
The result is not merely a cybersecurity alert.
It is a factory that may physically stop producing.
The Supply Chain Is Becoming an Attack Surface
One of the most important elements of the Make UK findings is the emphasis on supply-chain exposure.
Manufacturers rarely operate in isolation. They depend on suppliers for raw materials, components, logistics, software, maintenance, engineering services, cloud platforms, and remote technical support.
That interconnectedness creates efficiency — but it also creates risk.
A company may have strong internal security controls while remaining vulnerable to a compromised supplier with privileged access to its systems.
The growing use of remote management and connected industrial infrastructure makes this problem even more complicated. A supplier account that appears legitimate to security systems can potentially provide an attacker with exactly the access they need.
Nearly Half Lack a Formal Incident Response Plan
One of the clearest weaknesses identified by Make UK is incident preparedness.
Only 51% of respondents said they have a formal cyber incident response plan.
That means almost half of the surveyed organizations do not have a formalized process for responding to a cyber incident.
This is a major weakness because the first hours of an attack are often critical.
Organizations need to know who has authority to isolate systems, who communicates with suppliers, who contacts law enforcement or regulators when necessary, who handles customers, who coordinates recovery, and who makes decisions about shutting down operational technology.
Without predefined responsibilities, valuable time can disappear while executives and technical teams attempt to determine what to do.
Cybersecurity Leadership Remains Too Weak
The governance gap becomes even clearer when leadership responsibilities are examined.
Only 45% of respondents reported having designated senior leadership responsibility for cybersecurity.
Cybersecurity cannot realistically become an organization-wide priority if ownership is unclear.
Security teams can deploy technology, monitor alerts, investigate incidents, and implement controls. But they cannot independently decide how much operational risk a company is willing to accept.
Those decisions belong at the leadership level.
Manufacturing executives need to understand cybersecurity in terms of production availability, customer commitments, supply-chain continuity, intellectual property, safety, regulatory exposure, and financial loss.
The CISO Gap
Perhaps one of the most revealing findings is that fewer than one quarter of surveyed manufacturers — 23% — employ a dedicated Chief Information Security Officer.
Not every small or medium-sized manufacturer needs a traditional full-time CISO. However, every organization needs someone with clear accountability for cybersecurity.
Without strategic ownership, security can become fragmented between IT departments, engineering teams, operations, external providers, and senior management.
That fragmentation becomes particularly dangerous in environments where IT and operational technology overlap.
IT Security Alone Cannot Protect the Factory
Andrew Lintell, general manager for EMEA at Claroty, highlighted one of the central challenges facing industrial organizations: visibility.
Traditional IT-centric security tools were not necessarily designed to understand every device operating on a factory floor.
Industrial control systems, sensors, connected machinery, programmable controllers, engineering workstations, and specialized industrial protocols can create a security environment that looks very different from a conventional enterprise network.
An organization cannot effectively protect assets it does not know exist.
That makes asset discovery one of the foundations of industrial cybersecurity.
The Visibility Problem Is Bigger Than It Looks
A modern factory may contain thousands of connected assets.
Some may be carefully documented and centrally managed. Others may have been installed years ago, maintained by external contractors, or introduced into production without passing through conventional IT processes.
Some industrial devices are also difficult to patch because taking them offline could interrupt production.
This creates a difficult security equation.
Organizations must balance confidentiality and cybersecurity requirements against availability, safety, production schedules, equipment limitations, and vendor support.
That is why industrial cybersecurity requires specialized strategies rather than simply applying corporate IT security controls to operational technology.
Cybersecurity Has Become a Commercial Requirement
Another important development highlighted by the report is the growing commercial importance of cybersecurity.
Customers and business partners increasingly want evidence that suppliers can protect sensitive information, maintain operational continuity, and secure their supply chains.
Cybersecurity is therefore becoming part of procurement.
A manufacturer with weak security may eventually face more than technical risk. It may lose contracts, fail supplier assessments, encounter higher insurance costs, or become less attractive to major customers.
In other words, cybersecurity maturity can influence revenue.
Cyber Insurance Is Another Warning Sign
The report also found that almost one-third of manufacturers either do not have cyber insurance or are uncertain about whether their existing policies cover cyber-related disruption.
This uncertainty is particularly important because cyber insurance is not simply about paying for stolen data or forensic investigations.
For manufacturers, business interruption can be one of the most expensive consequences of an incident.
A factory that cannot produce for several days may face lost revenue, delayed deliveries, contractual penalties, overtime costs, emergency procurement, logistics expenses, and reputational damage.
Organizations therefore need to understand precisely what their insurance policies cover before an incident occurs.
The Jaguar Land Rover Effect
The 2025 cyberattack against Jaguar Land Rover has become a reference point for the broader industrial sector because it demonstrated how a digital disruption can produce consequences that extend into physical operations and commercial activity.
The lesson for manufacturers is not simply that large automotive organizations can be attacked.
The larger lesson is that industrial cybersecurity incidents can become business continuity crises.
Manufacturing leaders should therefore ask a difficult question:
If our digital systems stopped tomorrow, how long could our factory continue operating?
For some companies, the answer may be measured in hours.
Cybersecurity Must Move Beyond Compliance
Make
Manufacturers cannot afford to treat cybersecurity as a compliance exercise where policies are created, documents are signed, and security is considered complete.
Real resilience requires continuous testing.
An incident response plan that has never been exercised may look excellent on paper while failing under real pressure.
A recovery strategy that has never been tested may reveal unexpected dependencies when systems actually go offline.
Security controls need to be evaluated against realistic scenarios rather than theoretical checklists.
Recommendation One: Stress-Test Incident Response
Manufacturers should formalize their incident response plans and regularly test them.
Exercises should simulate realistic scenarios such as ransomware, compromised supplier accounts, stolen administrator credentials, malware spreading from IT into OT environments, destructive attacks, and loss of critical cloud services.
The goal is not to create a perfect theoretical response.
The goal is to discover weaknesses before attackers do.
Recommendation Two: Train the Workforce
Employees remain an important part of the defensive perimeter.
Mandatory cybersecurity awareness training can help reduce risks associated with phishing, credential theft, unsafe downloads, social engineering, removable media, suspicious remote-access requests, and other common attack vectors.
Training should not be limited to office employees.
Factory workers, engineers, maintenance teams, contractors, and third-party technicians can all interact with systems that influence production.
Recommendation Three: Secure the Supply Chain
Supplier security must become a formal part of manufacturing risk management.
Organizations should understand which suppliers have access to their networks, what privileges those accounts possess, how remote access is controlled, and what happens if a supplier experiences a breach.
Third-party access should be minimized, monitored, segmented, and reviewed regularly.
A supplier should never receive permanent broad access simply because it is convenient.
Recommendation Four: Audit Cyber Insurance
Manufacturers should carefully review their cyber insurance policies rather than assuming coverage exists.
Organizations need to determine whether policies cover business interruption, operational downtime, incident response, ransomware-related expenses, supply-chain disruption, forensic investigations, and other relevant costs.
The important question is not whether a company owns a cyber insurance policy.
The important question is whether the policy would actually respond to the type of incident the company is most likely to experience.
Deep Analysis: How Manufacturers Can Build Real Cyber Resilience
Start With Complete Asset Discovery
The first technical priority should be establishing an accurate inventory of IT and OT assets.
Defenders should know which systems exist, where they are located, what software they run, who owns them, how they communicate, and whether they expose remote services.
A basic Linux environment can begin with network discovery and service identification:
sudo nmap -sV -O 192.168.10.0/24
For production environments, however, scanning must be carefully controlled. Aggressive network scanning can potentially disrupt sensitive industrial equipment.
Passive discovery and specialized OT monitoring are often safer approaches.
Monitor Network Connections
Security teams should establish a baseline of normal network behavior.
For Linux systems, administrators can inspect active connections with:
ss -tulpn
They can also review listening services:
sudo ss -lntup
Unexpected listening services, unusual remote connections, or newly exposed management interfaces should trigger investigation.
Review Authentication Activity
Compromised credentials are frequently involved in modern intrusions.
Linux administrators can review authentication activity with:
sudo journalctl -u ssh --since "24 hours ago"
On systems using traditional authentication logs, defenders can also inspect:
sudo grep -i "failed" /var/log/auth.log
Windows environments should similarly monitor authentication events, especially privileged logons, unusual geographic access, impossible travel patterns, and new administrative accounts.
Protect Remote Access
Remote access should be treated as a high-value attack surface.
Manufacturers should eliminate unnecessary internet-facing management interfaces and require strong authentication for legitimate remote access.
Where possible, organizations should use VPNs or zero-trust access mechanisms combined with multifactor authentication, device validation, session monitoring, and least-privilege permissions.
Remote vendor access should be temporary whenever possible.
Segment IT and OT Networks
One of the most important architectural protections is network segmentation.
Corporate IT systems and industrial operational technology should not exist on one unrestricted network.
A simplified architecture might separate:
Internet
|
Firewall
|
Corporate IT
|
Security Boundary
|
Industrial DMZ
|
OT Monitoring Layer
|
Production Network
|
Controllers / PLCs / HMIs
The exact architecture should depend on the factory and operational requirements, but the principle remains consistent: compromise of an office endpoint should not automatically provide unrestricted access to production systems.
Apply Least Privilege
Employees, applications, vendors, and machines should receive only the permissions they actually need.
Excessive privileges increase the impact of credential compromise.
An ordinary workstation account should not automatically have administrative access across critical manufacturing infrastructure.
Similarly, vendor accounts should have narrowly defined access and should be disabled when maintenance activities are complete.
Monitor for Lateral Movement
Attackers rarely stop after compromising the first device.
Security teams should monitor for unusual authentication patterns, unexpected remote administration, abnormal SMB activity, suspicious PowerShell execution, unauthorized service creation, and unusual connections between IT and OT networks.
For example, defenders can search Windows event logs for suspicious PowerShell activity:
Get-WinEvent -FilterHashtable @{
LogName='Microsoft-Windows-PowerShell/Operational'
Id=4104
} -MaxEvents 100
This is a defensive monitoring technique intended to identify potentially malicious scripting activity.
Backups Must Be Tested
Backups are essential, but merely having backups is not enough.
Manufacturers should maintain protected backup copies and regularly perform restoration exercises.
Critical systems should have documented recovery priorities.
Organizations should know which systems must return first, which dependencies are required, and how production can operate while systems are being restored.
A backup that cannot be restored under pressure is not a reliable recovery strategy.
Test the Entire Business Continuity Chain
Manufacturers should test more than their IT recovery process.
A realistic exercise should ask:
Can production continue?
Can engineers access required documentation?
Can suppliers still communicate?
Can customers receive accurate delivery information?
Can replacement components be sourced?
Can financial systems continue operating?
Can employees safely work while systems are unavailable?
These questions connect cybersecurity directly to operational resilience.
What Undercode Say:
- Manufacturing Cybersecurity Has Entered a New Era
The UK manufacturing sector is facing a fundamental transformation in cyber risk.
- Connectivity Is Both an Advantage and a Liability
Connected factories are more efficient, but every connection can become another potential attack path.
- Thirty Percent Is Too Large to Ignore
When nearly one in three manufacturers reports a cyber incident, cybersecurity can no longer be treated as an exceptional event.
4. Supply Chains Multiply Risk
A company can have strong internal defenses and still be compromised through a trusted third party.
5. Production Is the Ultimate Target
For manufacturers, attackers do not necessarily need to steal data to cause serious damage.
- Downtime Can Be More Expensive Than Data Theft
Every hour of halted production can create operational and financial consequences.
7. Incident Response Must Be Practiced
A document sitting inside a policy folder does not constitute operational readiness.
8. Leadership Accountability Matters
Cybersecurity requires clear ownership at the executive level.
9. The CISO Gap Is Significant
With fewer than a quarter employing a dedicated CISO, strategic security leadership remains limited.
10. Smaller Manufacturers Face Particular Pressure
Smaller companies may lack the resources required to maintain specialized security teams.
- That Does Not Mean They Are Less Attractive Targets
Attackers often target organizations based on opportunity rather than size.
12. Industrial Systems Require Specialized Visibility
Traditional endpoint security cannot necessarily understand every device inside a factory.
13. Asset Discovery Should Be a Priority
Organizations cannot defend infrastructure they have never properly inventoried.
14. Legacy Technology Creates Difficult Choices
Some industrial equipment cannot simply be patched like an ordinary laptop.
15. Availability Must Be Considered
Security decisions must account for production and safety requirements.
16. Segmentation Can Limit Damage
Separating corporate and industrial networks can prevent a compromised endpoint from becoming a bridge into production.
17. Remote Access Needs Special Attention
Vendor and maintenance connections can provide attackers with valuable pathways.
18. Privileged Accounts Are High-Value Targets
Administrative credentials should receive stronger protection and continuous monitoring.
19. Multifactor Authentication Should Be Standard
Passwords alone are increasingly inadequate for critical access.
20. Supplier Security Needs Continuous Assessment
A security questionnaire completed once a year is not enough.
21. Cybersecurity Is Becoming Part of Procurement
Weak security can eventually become a commercial disadvantage.
22. Customers Want Evidence
Manufacturers increasingly need to demonstrate resilience rather than simply claim that they are secure.
23. Cyber Insurance Requires Careful Review
Organizations should understand exactly what their policies cover.
24. Business Interruption Is a Major Risk
Production downtime can create costs that quickly exceed the original technical incident.
- Recovery Must Be Designed Before the Attack
Waiting until systems are encrypted is too late to begin planning.
26. Backups Need Real-World Testing
Restoration exercises reveal problems that documentation cannot.
27. Employee Training Still Matters
Human error remains a major component of many successful attacks.
28. Engineers Need Cybersecurity Awareness Too
Security cannot stop at the boundary of the IT department.
29. Contractors Need Controls
Third-party technicians can become powerful privileged users inside industrial environments.
30. Monitoring Should Include OT
Security teams need visibility into the systems that actually control production.
31. Cybersecurity Should Be Measured Operationally
Organizations should track recovery time, detection time, segmentation effectiveness, privileged access, and backup restoration.
32. Compliance Is Only the Starting Point
Passing an audit does not necessarily mean surviving a sophisticated attack.
33. Attack Simulations Reveal Hidden Weaknesses
Tabletop exercises and controlled technical assessments can expose gaps before criminals exploit them.
34. Manufacturing Needs Defense in Depth
No single product can protect an interconnected factory.
35. Detection and Recovery Are Equally Important
Prevention will never be perfect.
36. Resilience Means Expecting Failure
The strongest organizations plan for the possibility that some defenses will eventually be bypassed.
37. Cybersecurity Is Now Business Security
The separation between information security and business continuity is becoming increasingly artificial.
38. The Factory Floor Must Be Included
Protecting email and laptops while ignoring industrial machinery creates a dangerous security blind spot.
- The Next Major Attack May Not Look Like Ransomware
Attackers could increasingly focus on disruption, manipulation, supplier compromise, or operational sabotage.
- UK Manufacturers Need to Act Before the Next Crisis
The Make UK findings should be treated as a warning rather than merely another cybersecurity statistic.
✅ One in Three Manufacturers Experienced a Cyber Incident
The article states that 30% of UK manufacturers experienced a cyber incident over the previous year, either directly or through their supply chain.
This figure is attributed to Make
The important context is that the figure includes supply-chain-related incidents rather than only attacks originating directly inside a manufacturer’s environment.
✅ Operational Disruption Was Widely Reported
Make
The report also identifies component or material shortages affecting 23% and customer delivery delays affecting 31% of manufacturers hit by cyberattacks.
These figures reinforce the argument that cyber incidents can become physical and commercial disruptions in manufacturing environments.
✅ Cybersecurity Governance Remains Uneven
The reported figures of 51% with formal incident response plans, 45% with designated senior leadership responsibility, and 23% with a dedicated CISO demonstrate significant gaps in formal cybersecurity governance.
These statistics support the
⚠️ Cybersecurity Risk Cannot Be Measured Only by Incident Counts
Incident statistics provide an important snapshot, but they do not reveal every attempted attack or near miss.
Organizations may experience attacks without recognizing them, while others may classify incidents differently.
Consequently, the 30% figure should be interpreted as a reported survey finding rather than a complete measurement of every cyberattack affecting UK manufacturing.
Prediction
(+1) Cybersecurity Will Become a Board-Level Manufacturing Requirement
The direction of travel is clear: cybersecurity will increasingly become a board-level responsibility rather than an isolated IT function.
As factories become more connected and customers demand stronger assurances from suppliers, manufacturers will increasingly be required to demonstrate measurable cyber resilience as part of commercial relationships.
(+1) OT Security Investment Will Accelerate
The growing awareness of industrial control system risks is likely to drive additional investment in OT asset discovery, network segmentation, behavioral monitoring, privileged access controls, and industrial incident response.
Organizations that previously focused almost exclusively on traditional IT security will increasingly turn their attention toward the factory floor.
(+1) Supplier Security Will Become More Strict
Manufacturers are likely to impose stronger cybersecurity requirements on suppliers and contractors.
Security questionnaires alone will gradually become less persuasive as organizations demand evidence of multifactor authentication, vulnerability management, access controls, incident response capabilities, and secure remote maintenance.
(+1) Cyber Insurance Will Become More Technical
Insurers are likely to demand clearer evidence of cybersecurity maturity before providing favorable coverage.
Manufacturers may increasingly need to demonstrate segmentation, tested backups, incident response exercises, privileged access controls, and effective monitoring before obtaining comprehensive policies.
(-1) Attackers Will Continue Targeting Operational Disruption
The most concerning prediction is that attackers will increasingly recognize how valuable manufacturing downtime can be.
Rather than simply stealing information, threat actors may deliberately target production systems, supplier relationships, remote access infrastructure, and industrial environments because disruption can create immediate financial pressure.
(+1) Resilience Will Become the New Security Metric
The manufacturing organizations best positioned for the future will not necessarily be those claiming to have perfect defenses.
They will be the organizations capable of detecting an intrusion quickly, isolating affected systems, continuing critical operations, restoring technology, communicating with customers, and returning to normal production without catastrophic losses.
The Bigger Lesson for UK Industry
The Make UK report delivers a message that extends far beyond manufacturing.
Modern businesses are increasingly dependent on digital infrastructure, but the consequences of cyberattacks are becoming increasingly physical.
For manufacturers, software controls machines. Networks connect suppliers. Credentials unlock production environments. Cloud platforms support logistics. Remote access connects engineers to factories thousands of miles away.
That means the traditional boundary between cybersecurity and operational resilience is disappearing.
A cyberattack can now become a supply-chain crisis, a production crisis, a customer crisis, and ultimately a financial crisis.
The 30% incident figure should therefore be viewed as more than a statistic.
It is a warning that the
The manufacturers that act before the next major incident will have a significant advantage.
Those that wait until the production line stops may discover that cybersecurity was never just about protecting computers.
It was about protecting the factory itself.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.infosecurity-magazine.com
Extra Source Hub (Possible Sources for article):
https://stackoverflow.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
