IT/OT boundary review
Assessing the DMZ, jump hosts and remote access services that bridge the two networks.
Industries · Manufacturing
Manufacturing Cybersecurity Assessment for the IT/OT Boundary
Most factory intrusions start on the IT side
Most factory intrusions start on the IT side
Almost nobody breaks into a plant by attacking a controller. They arrive through a corporate account, a supplier portal, an ERP integration or an exposed remote access service, and then walk into a network that was designed for reliability, not for containment.
AIPTx tests that path with AI penetration testing. It does not touch your control systems.
Industry Overview
Why manufacturing cybersecurity is different
Manufacturing spent thirty years connecting two networks that were designed on incompatible assumptions.
Corporate IT assumes change, patching and identity. Operational technology assumes stability above everything — a controller commissioned in 2009 is running correctly precisely because nobody has touched it. Neither assumption is wrong in its own domain. The trouble is at the join. That join now carries real traffic. Production scheduling from ERP, quality data flowing upward, remote support from equipment vendors, predictive maintenance telemetry to a cloud service, and a plant floor that is increasingly addressable.
The consequence profile is also inverted relative to most sectors. In financial services or healthcare, the fear is data loss. In manufacturing, the fear is that the line stops.
An incident that leaks nothing at all can still cost more per hour than the entire security budget, which is why the sector's tolerance for testing risk is close to zero, and why security vendors who do not understand that are dismissed quickly.
That inversion also changes what a security programme has to prove. A report delivered as a ranked list of severities, rather than through AI risk prioritization, does not answer the question the plant is actually asking, which is whether an exposure reaches anything that can stop production, and whether the testing itself can. The second is a matter of configuration: declared scope, excluded ranges, non-destructive defaults and a request rate you set. The first is a matter of evidence. It becomes answerable only once a finding has been demonstrated rather than argued, because a path that reaches the IT/OT boundary and a path that stops in the corporate DMZ are the same severity on paper and two entirely different conversations in a plant meeting.
Security Challenges
Top cybersecurity risks in manufacturing
- R01
Flat plant networks
Segmentation is frequently designed and incompletely enforced. A foothold in one zone reaches further than the architecture diagram suggests, and the diagram is usually the last thing that was updated.
- R02
Unpatchable by design
Control systems under vendor warranty, validated configurations, and equipment where a patch requires a production stop. The vulnerability is often known and the remediation is a scheduling problem measured in quarters.
- R03
Remote access for equipment vendors
Suppliers need access to service their machines. That access is frequently persistent, broadly scoped, and shared, and it is one of the most common intrusion paths in the sector.
- R04
Legacy Windows
Engineering workstations and HMI hosts running operating systems well past support, because the software that runs on them will not run on anything else. Where they are domain-joined, an Active Directory assessment shows what a foothold on one of them reaches.
- R05
ERP and supply chain integration
Production planning systems connected to supplier and customer systems, exchanging data continuously. A trusted integration is a trusted path.
- R06
Consequence measured in downtime
Ransomware in this sector does not primarily monetise data. It monetises the hourly cost of a stopped line, which is why manufacturing is targeted disproportionately.
How AIPTx Helps
How AIPTx pentests manufacturing networks safely
- Stage 1
Scoped away from the plant, deliberately
Out-of-scope paths are declared and respected. Destructive actions are off by default. Every run honours a request rate you set. The recommended configuration excludes control system ranges entirely, and the scope is verified before anything executes.
This is a product constraint, not a promise: the agent cannot test what the scope excludes.
- Stage 2
The IT/OT boundary assessed from the IT side
Internal network assessment via a Docker-deployed autonomous pentesting agent covers your corporate and DMZ ranges: port and service detection, version detection, CVE matching, TLS posture and default credentials. That is where remote access services, jump hosts, historians' upstream interfaces and engineering workstations sit, and it is where an intrusion establishes itself before it goes anywhere near a controller.
- Stage 3
Default credentials, found repeatedly
Default credential testing against discovered services is unglamorous and finds something in most industrial IT environments the first time it runs. Service-specific checks cover SSH, MySQL and Redis, including weak algorithms, anonymous access and default credentials.
- Stage 4
Supplier and customer portals tested properly
Web Application SecurityMulti-role authenticated testing across supplier, customer and internal accounts, with cross-access attempted between them. A supplier portal where one supplier can reach another's orders, pricing or drawings is both a security failure and a commercial one.
- Stage 5
ERP and integration APIs
REST via OpenAPI or Swagger, GraphQL with introspection, gRPC with proto files. Integration endpoints are frequently built for internal trust and later exposed, which is a recurring pattern worth testing for directly.
- Stage 6
Evidence an OT engineer will accept
A confirmed finding carries the exact request, the response, and a reproducible curl command. In an environment where any remediation may require a maintenance window, the case for the window has to be evidential rather than advisory.
Features & Solutions
Manufacturing penetration testing features
Internal network assessment
Docker-deployed agent, outbound connectivity only, across declared IP ranges and CIDR blocks.
Default credential and service testing
including SSH, MySQL and Redis specifics.
CVE matching against detected versions on internal services
Version detection first and matching second, so the list describes what is actually running on the ranges you declared rather than what the asset register believes is running on them.
Multi-role authenticated testing for supplier, customer and internal portals
Accounts are held at once and pointed at each other. A supplier reaching another supplier's orders, drawings or pricing is the failure that matters in a portal built to serve hundreds of them under one login page.
API testing (REST, GraphQL and gRPC) for ERP and supply chain integrations
The interfaces carrying scheduling, quality and inventory data are tested in their own right, not only through the screens that happen to call them.
API SecurityAttack chain testing
Deep mode tests complex multi-step chains, which is how a corporate foothold becoming boundary access gets demonstrated rather than argued.
Scope controls
declared out-of-scope paths, verified scope, non-destructive defaults, configurable request rate.
Compliance evidence
control mapping for ISO 27001, SOC 2, NIST, CIS, GDPR, PCI DSS and HIPAA.
ISO 27001 and NIST compliance mappingAIPTx does not test operational technology. There is no support for industrial protocols (Modbus, DNP3, EtherNet/IP, PROFINET, S7 or equivalent) and no capability for PLC, HMI, DCS or safety instrumented system assessment. Devices on a scanned IP range would appear only as hosts with open ports, and control system ranges should be excluded from scope.
This page covers corporate IT, the DMZ, the IT/OT boundary from the IT side, and the applications and integrations that connect to production systems.
Benefits
Benefits of manufacturing security testing
- The intrusion path gets tested
- Corporate IT, remote access and the boundary (where incidents actually begin) rather than the layer everyone worries about and nobody is allowed to touch.
- No risk to production
- Scope exclusion is enforced by the product, not by an operator's care.
- An honest internal inventory
- Most manufacturers find, through asset discovery, services on their IT ranges that nobody has an owner for.
- Supplier portals held to the same standard as customer-facing systems
- They rarely are, and they carry commercially sensitive data.
- Evidence for maintenance windows
- A demonstrated exploit, documented in smart security reports, makes the case for downtime that an advisory cannot.
- Assessment across multiple sites without multiplying cost
- Cost scales with estate rather than with consultant days, which matters when you run eleven plants, and continuous security validation keeps every site current.
Use Cases
Manufacturing pentest use cases: IT/OT boundary, ERP and supplier portals
Supplier portal assessment
Multi-role testing with cross-access attempted between supplier accounts.
Remote access audit
Identifying exposed remote services, default credentials and unpatched versions on the paths equipment vendors use.
ERP integration testing
Assessing the API surface connecting production planning to supplier and customer systems.
Multi-site baseline
Consistent assessment across plants, with per-site reporting and a comparable score.
Pre-certification evidence
A Deep assessment with ISO 27001 and NIST compliance mapping ahead of a certification cycle.
FAQ
Manufacturing cybersecurity testing FAQs
Is penetration testing safe for manufacturing plants and production lines?
Yes. AIPTx tests only the IT side of your plant, such as corporate networks, the DMZ and the IT/OT boundary. Control system ranges are out of scope, and the agent cannot test anything beyond the scope you declare. Destructive actions are off by default, and every scan follows a request rate you set, so production is not placed at risk.
Can AIPTx test OT, ICS, SCADA or PLC systems?
No. AIPTx does not test operational technology. There is no support for industrial protocols such as Modbus, DNP3, EtherNet/IP, PROFINET or S7, and the agent cannot assess PLC, HMI, DCS or safety systems. It covers your IT network, remote access services and the IT/OT boundary from the IT side. If you need protocol-level OT testing, you will need a specialist OT security engagement.
How does manufacturing network penetration testing work with AIPTx?
AIPTx runs as a Docker container inside your network with outbound connectivity only, so no inbound access is required. You configure it with API credentials and the IP ranges you authorise, and the agent checks open ports, service versions, known CVEs, TLS settings and default credentials on those ranges only.
Can you test legacy Windows engineering workstations and HMI hosts?
Yes, at the network and service layer. AIPTx checks open ports, service versions, CVE matches, TLS posture and default credentials on these hosts. Many of them cannot be patched, so knowing exactly what is exposed lets you place segmentation and access controls in the right places. AIPTx does not test the industrial software running on them.
How can manufacturers test supplier portals and ERP integrations for security flaws?
AIPTx uses multi-role authenticated testing, where supplier, customer and internal accounts are tested against each other. This finds cases where one supplier can see another supplier's orders, pricing or drawings. For ERP and supply chain integrations it also tests REST APIs (OpenAPI/Swagger), GraphQL (introspection) and gRPC (proto files).
Does manufacturing security testing help with ISO 27001 and NIST compliance?
Yes. AIPTx maps its findings to controls for ISO 27001, SOC 2, NIST, CIS, GDPR, PCI DSS and HIPAA. A Deep assessment with ISO 27001 and NIST mapping gives you evidence to take into a certification audit. The report supports your compliance process, but it does not replace the audit itself.
The engine behind it
Test the path in, not the plant
Corporate IT, remote access and the boundary, assessed thoroughly, with your control systems explicitly out of scope. View pricing.
Out-of-scope paths declared and respected · Destructive actions off by default
Cybersecurity testing for other industries
Same engine, different threat model, different auditor. Each page covers the systems, regulations and attack paths that sector actually lives with.
Financial Services
Payment flows, lending decisions, account servicing, open banking APIs — the logic that handles money is the logic attackers study hardest. It is also the logic no signature database describes.
Financial Services Security TestingHealthcare
Patient portals, scheduling systems, clinical APIs, payer integrations: all of it holds data that carries a lifetime of consequence if it leaks, and much of it runs on systems that cannot be taken offline for a test.
Healthcare Security TestingGovernment
Government penetration testing for benefits portals, licensing systems, tax filing and records access — services that must be open to everyone by design, running on estates that were often built decades apart and connected later.
Government Security TestingRetail
The vulnerabilities that cost retailers money are rarely exotic. A discount that stacks when it should not. A price accepted from the client. A gift card balance that survives a concurrent request. A loyalty account reachable from another customer's session.
Retail Security TestingSaaS
Every enterprise deal arrives with a questionnaire, a SOC 2 request and someone technical asking when you last tested. Meanwhile you ship on Tuesday and again on Thursday, and the last pentest describes a product that has since changed twice.
SaaS Security TestingTelecom
A single authorisation flaw in a subscriber portal is not one exposed account. At operator scale it is a data set — and the same flaw in a provisioning API is an operational one.
Telecom Security TestingEducation
A department stood up a project site in 2019. A research group runs its own server. A faculty subdomain points at infrastructure that was decommissioned two years ago. None of it went through central IT, and all of it is reachable.
Education Security TestingLegal
Clients do not retain a firm because of its document management system. They retain it on the assumption that what they share stays privileged — and increasingly they audit that assumption before instructing.
Legal Security Testing