Business Security

Manufacturers operate in one of the most unforgiving threat environments and face a unique set of pressures that make attacks particularly damaging

03 Oct 2025  •  , 5 min. read

Manufacturers face a unique mix of risk: they have an extremely low tolerance for downtime, they sit at the heart of extensive and often complex supply chains, and their competitive advantage is often built on high-value intellectual property (IP), including proprietary designs and trade secrets. That’s a combination that should be ringing alarm bells for IT and security leaders working in the sector.

Meanwhile, the nature of modern attacks has also become increasingly complex, sophisticated and relentless. Threat actors often combine technical exploits with social engineering and credential theft, and aim to remain undetected for long periods, gathering intelligence and mapping systems before striking.

A spate of high-profile ransomware breaches over recent years confirms the high stakes: digital extortionists have the sector well and truly in their crosshairs. In a sector that relies on precision, efficiency, and tight production schedules, even a few hours of downtime can ripple across the business and its network of partners, magnifying the impact.

However, this does not mean the only things standing between your company and a mega-breach are luck and time. As we mark Manufacturing Day, it’s a good time to reflect on the sector’s growing risk – and how it can be reduced to manageable levels by building resilience and detecting threats as early as possible.

Manufacturing in the crosshairs

According to IBM, the manufacturing sector was the most targeted worldwide over the past year. It accounts for a quarter (26%) of incidents the vendor’s incident responders were called to over the period, rising to 40% in APAC. Legacy technology, and particularly connected operational technology (OT) such as industrial control systems and robotics, has expanded the attack surface of many manufacturers. That provides plenty of opportunities for determined adversaries. Other key findings include:

• Exploits of public facing apps, valid accounts and external remote services were the most common initial access vectors, highlighting how adversaries are exploiting misconfigured or otherwise insecure access points.
• Server access (16%) and malware-ransomware (16%) were the most commonly observed actions, illustrating that operational disruption and financial extortion were the main goals of attackers.
• Extortion, data theft, credential theft and reputational damage were the biggest impacts for breached manufacturers.

Separately, Verizon notes that confirmed breaches in the sector surged 89% annually in 2025, with SMBs with fewer than 1,000 employees accounting for more than 90% of breached organizations. Its analysis also reveals that a fifth of breaches were down to espionage-related motives, up from just 3% a year previously. Sensitive plans, reports and emails were the most frequently stolen data type, highlighting a risk to IP that goes beyond mere extortion. It could signify the presence of nation state actors or competitors keen to steal trade secrets.

That said, the presence of malware in manufacturing breaches increased from 50% to 66% over the period, attributable to ransomware and the preference for “System Intrusion” as the most common threat pattern. This refers to complex attacks that use “malware and/or hacking” to achieve their goals. It’s safe to say that manufacturers will continue to be firmly in the crosshairs of sophisticated adversaries.

For insights into how ESET's solutions can help manufacturers stay secure and resilient, explore this page.

Cautionary tales

Manufacturers don’t just have to keep an eye out for financially motivated cybercriminals. A recent campaign spotted by ESET targeted manufacturers as well as companies in other sectors. It was attributed to the RomCom group, which blends opportunistic campaigns and espionage efforts. This one exploited a zero-day vulnerability in WinRAR to covertly steal sensitive information, highlighting the sophistication of some threat actors targeting the sector.

Another word of warning comes via a 2023 breach at Clorox, which cost the cleaning product manufacturer tens of millions of dollars. The incident, which stemmed from a single vishing attack and set of credentials, impacted the firm for weeks, disrupting operations and its supply chain. The fact that it reportedly happened due to human error on the part of an IT outsourcer highlights the multilayered nature of cyber risk facing manufacturers.

Where MDR fits in

The question is how best manufacturers can absorb these cautionary tales in order to minimize cyber risk in their organization. The first step should be to build resilience via best practices such as multifactor authentication (MFA), prompt patching and data encryption. That’s the key to blocking initial access and preventing lateral movement where possible. But it’s not a silver bullet.

Manufacturers should also invest in continuous detection and response across their email, cloud, server, network and other environments. If yours is a large enterprise with enough budget, it may be able to do this via an in-house security operations (SecOps) team working from a security operations center (SOC) with XDR tooling.

But for many, especially the 90% of breached manufacturers with under 1,000 employees, the more sensible option may be to outsource to an expert managed detection and response (MDR) provider. A well-chosen MDR provider can deliver a range of capabilities faster and more cost-effectively than building them in-house, including:

• 24/7/365 threat monitoring from an expert team
• Reduced cost compared to the high capital and operational expense required to staff and maintain a SOC
• Expert threat hunting to find the most sophisticated threats
• Rapid detection, response and containment of threats to minimize financial, reputational and compliance risk
• Improved financial and operational resilience by enabling the organization to continue production even after an attack
• Surfaced insight to build resilience against similar future attacks

Building a mature SOC with 24/7 coverage, threat hunting, and forensic skills typically takes years and significant investment, whereas MDR providers bring an established stack and experienced team fast. The CapEx/OpEx expense of an in-house SOC and the specialized security expertise required to monitor converged environments is often prohibitive, especially for SMBs. Also, MDR playbooks emphasize containment and rapid recovery that aim to minimize production downtime, a critical metric for manufacturing. For many manufacturers, MDR provides the fastest, most cost-effective path to operational resilience.

Seconds count

Whether they’re after your IP, your customer data, or simply to cause maximum disruption with a view to extortion, when threat actors strike, the race is on to find and contain them. MDR can accelerate this process to provide the early warning you need to put incident response plans into action.

The continuous monitoring and awareness it provides across endpoints, network, and cloud environments also aligns neatly with a best-practice Zero Trust approach to cybersecurity. By combining the best of human expertise and advanced technology, MDR isn’t just worth a look for your business. It could also hold the key to securing your extended supply chain.