Managing Cyber Risk Across Connected OT Assets
For decades, manufacturers focused cybersecurity efforts on traditional IT assets such as laptops, servers, and office networks. Today, however, some of the most significant cybersecurity risks exist elsewhere: on the plant floor.
Modern manufacturing environments depend on thousands of connected operational technology (OT) devices. Programmable logic controllers (PLCs), human-machine interfaces (HMIs), industrial switches, sensors, robots, cameras, but also remote access and IT systems all help control and keep production running. Yet many of these assets were never designed with modern cybersecurity requirements in mind.
Unlike corporate endpoints, most industrial devices cannot support endpoint protection software, security agents, or traditional management tools. As a result, manufacturers often operate large numbers of OT and IoT assets that were not designed for traditional endpoint security tools. This leaves them with limited visibility into how these connected assets communicate, what software they run, or whether they are internet-exposed and susceptible to known risks.
Many industrial assets were designed for reliability, safety, and long operational lifecycles, not cybersecurity.
At the same time, cyber threats against manufacturing continue to grow. Forescout Research – Vedere Labs (the company’s threat research team) found manufacturing ranks among the most heavily targeted sectors, with a 16% increase in tracked threat actors targeting the industry in 2025 compared to the year prior. This upward trend is driven largely by ransomware groups seeking financial gain, targeting organizations they believe are more likely to pay a ransom rather than risk operational downtime.
The rise of frontier AI is adding new urgency to the threat landscape. Activities that once required significant technical expertise, such as vulnerability research and exploit development, are now greatly accelerated and automated with AI. As the time between vulnerability disclosure and exploitation shrinks, manufacturers have less time to identify exposed assets and implement protections before attackers begin targeting vulnerable systems. Recent attacks against U.S. water systems demonstrate how quickly threat actors can capitalize on known weaknesses and exposure across operational environments. Once vulnerable technologies and attack methods are understood, organizations using similar systems can find themselves targeted in rapid succession.
The challenge for manufacturers is not just in identifying cyber risk, but also understanding where exposure exists and reducing that exposure without disrupting production.
Why OT Devices Create Unique Security Risks
Many industrial assets were designed for reliability, safety, and long operational lifecycles, not cybersecurity.
A manufacturing facility may operate equipment that has remained in service for ten, twenty, or even thirty years. Replacing or updating those systems is often costly and disruptive. Even routine software updates may require extensive testing and OEM vendor approvals to ensure they do not affect production processes.
This creates a very different security environment than traditional enterprise IT.
In an office environment, a vulnerable laptop can often be patched quickly. On the plant floor, a vulnerable controller or industrial workstation may need to remain in operation until the next planned maintenance window. Some devices may no longer be supported by the original manufacturer at all.
As manufacturers adopt Industrial Internet of Things (IIoT) technologies, cloud-connected applications, remote maintenance capabilities, and digital transformation initiatives, the number of difficult-to-secure OT and IoT assets continues to grow.
Manufacturers have long struggled with patching constraints caused by maintenance windows, testing requirements, and concerns about operational disruption. As AI helps attackers identify and weaponize vulnerabilities faster, the gap between discovery and remediation becomes increasingly difficult to manage.
Security teams therefore face a difficult reality: vulnerabilities may exist for extended periods of time, making visibility and risk prioritization more important than ever.
Visibility Is the Foundation of OT Security
Manufacturers cannot protect assets they do not know exist. Yet many organizations still struggle to maintain a complete OT asset inventory across production environments. Devices may have been added over decades of plant expansion, modernization projects, contractor engagements, or acquisitions.
Manufacturers need visibility not only into vulnerabilities but also into how assets interact with production processes.
Without complete visibility, security teams cannot accurately assess risk, identify vulnerable systems, or understand which assets support critical production processes.
Effective OT security starts with knowing:
What devices are connected
Where those devices are located
How they communicate
Which assets are critical to production
Which systems are vulnerable or externally exposed
Which systems depend on data or systems in enterprise networks
Modern exposure management strategies rely on continuous, agentless visibility to identify OT and IoT devices without interfering with production systems. Rather than relying on software installed directly on assets, organizations use network-based monitoring to build an accurate picture of their environments.
This visibility creates the foundation for every other security initiative, including threat detection, risk assessment, segmentation, incident response, and resilience planning.
Not Every Vulnerability Carries the Same Risk
Manufacturing environments often contain hundreds or thousands of vulnerabilities, and attempting to remediate every issue immediately is not realistic. Therefore, operators need to know which vulnerabilities create meaningful operational risk.
A vulnerability affecting an isolated engineering workstation may require attention but present limited immediate danger. The same vulnerability affecting an internet-facing device, a remote access pathway, or a critical production system may deserve significantly higher priority.
This is where operational context becomes essential. Manufacturers need visibility not only into vulnerabilities but also into how assets interact with production processes.
Understanding device criticality, network exposure, communication paths, and operational dependencies helps organizations focus resources where they can have the greatest impact.
Exposure management is not just about finding risks. It is about understanding which risks require immediate attention and turning visibility into prioritized action. That shift beyond visibility is also reflected in the broader OT security market. As Forrester Senior Analyst Paddy Harrington recently observed in his blog, “Organizations that continue evaluating OT security solutions primarily on asset inventory capabilities risk investing in technologies that provide awareness without meaningful risk reduction.”
Threat Detection Should Not Disrupt Production
Historically, some cybersecurity tools designed for enterprise networks created operational concerns when deployed in manufacturing environments.
Active scanning techniques that work well in office environments may not always be appropriate for sensitive industrial systems.
As a result, manufacturers increasingly require threat detection approaches that deliver visibility and act as a compensating control without introducing downtime.
Continuous monitoring allows organizations to identify unusual communications, unauthorized devices, suspicious remote connections, and indicators of compromise without interfering with operational processes. Rather than waiting for an outage or security incident to reveal a problem, manufacturers can identify risks earlier and respond before disruptions occur. Cyberattacks typically involve multiple steps, such as gaining access, reconnaissance activities and moving laterally to find the right targets, before the operations are impacted. Monitoring can spot both weak security practices, such as shared credentials, exposed services and cyberattack activities before they lead to downtime.
Secure Remote Access Has Become Essential
Traditionally, production systems have been considered air-gapped, and many security policies still rely on that assumption. But remote access has become a normal part of modern manufacturing. Equipment suppliers troubleshoot systems remotely. Engineers provide support across multiple facilities. Contractors access specialized applications without traveling onsite.
Rather than waiting for an outage or security incident to reveal a problem, manufacturers can identify risks earlier and respond before disruptions occur.
These capabilities improve efficiency and reduce operational costs, but they also create additional attack pathways. Manufacturers need to know who (or what) is connecting, what systems they are accessing, why access is required, and how long access remains active. Access should be limited to only those resources necessary for a specific task. In practice many remote access pathways remain open for too long and provide too broad access.
Combined with strong visibility and monitoring, secure remote access helps reduce the likelihood that a compromised account can create broader operational consequences.
Building Resilience Around OT and IoT Assets
There is no single technology that eliminates cyber risk in manufacturing. The most effective security programs combine asset visibility, exposure management, threat detection, network segmentation, secure remote access, and operationally aware incident response planning. These efforts often begin with protecting the perimeter and identifying connected OT and IoT assets, because these devices frequently represent the largest blind spots within industrial environments.
As operational environments become more connected, cybersecurity increasingly depends on visibility. Manufacturers that can identify OT devices, understand their role in production, and prioritize the risks they present will be better positioned to reduce exposure while maintaining uptime, safety, and reliability.