Most factory intrusions start on the IT side

Manufacturing spent thirty years connecting two networks that were designed on incompatible assumptions.

Corporate IT assumes change, patching and identity. Operational technology assumes stability above everything — a controller commissioned in 2009 is running correctly precisely because nobody has touched it. Neither assumption is wrong in its own domain. The trouble is at the join. That join now carries real traffic. Production scheduling from ERP, quality data flowing upward, remote support from equipment vendors, predictive maintenance telemetry to a cloud service, and a plant floor that is increasingly addressable.

The consequence profile is also inverted relative to most sectors. In financial services or healthcare, the fear is data loss. In manufacturing, the fear is that the line stops.

An incident that leaks nothing at all can still cost more per hour than the entire security budget, which is why the sector's tolerance for testing risk is close to zero, and why security vendors who do not understand that are dismissed quickly.

That inversion also changes what a security programme has to prove. A report delivered as a ranked list of severities does not answer the question the plant is actually asking, which is whether an exposure reaches anything that can stop production, and whether the testing itself can. The second is a matter of configuration: declared scope, excluded ranges, non-destructive defaults and a request rate you set. The first is a matter of evidence. It becomes answerable only once a finding has been demonstrated rather than argued, because a path that reaches the IT/OT boundary and a path that stops in the corporate DMZ are the same severity on paper and two entirely different conversations in a plant meeting.