Cyber Risk for Manufacturers: Protecting OT and IIoT Systems

Ransomware groups have quietly settled on manufacturers as the highest-value target class. Not because manufacturer data is more valuable than a hospital’s or a bank’s, but because a manufacturer’s downtime cost is easier to calculate and faster to accumulate. A plant that cannot ship for three days often faces losses larger than the ransom demand, and attackers know it.

For an Idaho food processor, a Utah aerospace parts machinist, or any mid-market manufacturer running connected shop-floor equipment, cyber risk is now an operational risk, not just an IT concern. The financial exposure has to be quantified, the technical exposure has to be reduced, and the insurance response has to be tested before an incident.

Why OT and IIoT Are the Weak Link

Operational technology (OT) and Industrial Internet of Things (IIoT) systems (PLCs, SCADA controllers, connected CNC machines, sensor networks, ERP-to-MES integrations) were designed for reliability and long life, not for security. Many are still running legacy operating systems that have not been patched in years. Most have flat network topologies that make lateral movement easy once an attacker gets in.

The result is a large, aging attack surface that sits inside the same network as the office computers. When ransomware hits the IT side, it usually spreads to OT within hours, and the plant goes dark.

Common Attack Paths on the Shop Floor

Four attack paths account for most manufacturer intrusions:

• Phishing on the office network. An email attachment or malicious link executed by an office user provides the initial foothold. Lateral movement to OT follows.
• Remote access exposure. Poorly secured VPN, RDP, or vendor remote-access accounts get compromised via credential stuffing or brute force.
• Third-party vendor compromise. A maintenance vendor’s laptop, connected to a plant network for a service call, brings in malware from another client site.
• Unpatched OT firmware. Known vulnerabilities in older PLCs and HMIs are exploited via internet-facing management interfaces.

Each path is well-documented and defensible. Very few are new or novel.

Financial Impact of a 72-Hour Plant Shutdown

The financial impact scales with plant economics. A mid-size food processor might run daily throughput of $150,000 to $500,000 in revenue. Three days down destroys that revenue, plus incremental cost to recover (forensic response, incident response counsel, temporary staffing, rush freight to catch up), plus customer relationship cost from missed shipments.

Ransomware demands for a manufacturer of that size typically run in the hundreds of thousands to low millions. Attackers price the demand to be less than the shutdown cost. Every operator should run the math on their own numbers before an incident so the response is a decision, not a panic.

Insurance, Retention, and Named Perils for Manufacturers

Cyber insurance has matured over the last five years and now specifically covers manufacturers. Key policy elements to understand:

• Business interruption coverage. Compensates for lost profit and continuing expenses during a shutdown. Waiting period (typically 8 to 24 hours) applies before coverage kicks in.
• Contingent business interruption. Covers losses from a supplier or vendor’s cyber incident that impacts your operations.
• Ransom coverage. Reimbursement of ransom payments, subject to policy limits and government sanctions checks. Coverage of ransomware negotiation costs.
• Data restoration. Cost of restoring lost data and rebuilding compromised systems.
• Retention (deductible). Manufacturers typically face retentions of $25,000 to $250,000 depending on premium and coverage limits.

Named perils have expanded to include ransomware, business email compromise, wire fraud, and social engineering losses. Policies vary significantly on what is covered and what is excluded. Read the specific policy before an incident.

A 90-Day Plan to Reduce Exposure

A practical 90-day risk reduction path for a mid-market manufacturer:

• Days 1-30: Multi-factor authentication on every remote access account. Immutable, offline backups tested with a real restore. Email security gateway configured with anti-phishing and attachment scanning.
• Days 31-60: Network segmentation between OT and IT. Vendor remote access moved to a broker with session recording. Endpoint detection and response deployed on all servers and workstations.
• Days 61-90: Incident response plan documented and tabletop-exercised. Cyber insurance policy reviewed against the current threat profile. Third-party risk assessments completed for critical vendors.

None of this requires enterprise IT budget. Most of the leverage sits in configuration and process discipline rather than expensive tools.

Board-Level Reporting Metrics for Cyber

Cyber risk should be reported to ownership or the board using metrics an operator can actually understand:

• Days since last tested backup restore
• Percentage of remote access accounts with MFA enabled
• Number of vendors with unrestricted network access
• Estimated business interruption exposure per 24 hours down
• Cyber insurance limits vs. estimated worst-case loss

These are the numbers an owner or board can act on. Reporting cyber risk as a technical readout of vulnerabilities loses everyone in the room.

Cyber has moved from an IT concern to an operational and financial risk that deserves ownership-level attention. The manufacturing team at Cooper Norman works with Idaho and Utah manufacturers to quantify the financial exposure, evaluate cyber insurance coverage against actual downtime cost, and coordinate with technical vendors on the risk reduction plan. Our audit and assurance group reviews cyber controls as part of every audit engagement for manufacturing clients.