Cyber security for manufacturing
In a factory a cyber attack is not measured in encrypted files but in hours of stopped production line. Start from what is connected to the network, from who gets in from outside and from what your customers are asking of you.
Information security in industry: attackers count on downtime
Cyber security in manufacturing has a problem that offices do not have: the cost of an attack grows with every hour production stays stopped. Whoever launches ransomware knows this, and chooses companies that cannot afford to wait. A company that has to deliver by Friday is more willing to negotiate.
The typical scenario is mundane. An employee's credential ends up in a collection of stolen passwords, someone tries it on the VPN, gets in, moves from the office network to the server that plans production and from there to the warehouse management system. When the files are encrypted the machines may still work, but no one knows any more what to produce, for whom and with which bills of materials.
Then there is what is taken before encryption: technical drawings, process recipes, quotations, price lists. A manufacturer's intellectual property is worth a lot, including on the sites where criminal groups publish the data of victims who do not pay.
OT security: where the factory opens up
It is almost never a sophisticated attack on the machine. More often it is the flat network that connects everything to everything.
Ageing machines and shop-floor PCs
Operator panels and line PCs with unsupported operating systems, which are not updated because the machine supplier does not allow it.
Networks that are not separated
Offices, departments, cameras and IIoT devices on the same network: whoever gets in from an administrative PC can also reach production.
Maintenance contractors' remote access
Remote desktop, VPN routers installed by the manufacturer, shared accounts with passwords never changed since commissioning.
Open technical folders
Drawings and machine programs on shares readable by anyone on the network, convenient for the workshop and for attackers.
NIS2, customers and new product regulations
- NIS2. Legislative Decree 138/2024, the Italian law transposing NIS2, lists manufacturing among the "other critical sectors" in Annex II: medical devices and in vitro diagnostic devices, computers and electronics, electrical equipment, machinery, motor vehicles and trailers, other transport equipment. Medium-sized and large companies in these sub-sectors are important entities. To find out whether you are in scope, read who must comply with NIS2.
- The supply chain. Even if you are not in scope, your customer often is: NIS2 requires it to assess the security of its suppliers, and that request reaches you as a questionnaire.
- Automotive customers and large groups. Many ask for their own requirements or industry standards such as TISAX, often derived from ISO/IEC 27001.
- Machinery Regulation (EU) 2023/1230. From 20 January 2027 it introduces requirements for protection against corruption, including cyber tampering, for machinery manufacturers.
- Cyber Resilience Act (EU) 2024/2847. For those placing products with digital elements on the market, the obligations to report actively exploited vulnerabilities apply from 11 September 2026; the rest from 11 December 2027.
The controls a manufacturing company needs first
Each control corresponds to a Dottor Box service that can be enabled on its own, without buying the full package.
| The question to ask | The control | The service |
|---|---|---|
| What is really connected to the network, shop floor included? | A network map with the agentless hosts no one had recorded | Asset Management with the Cyber Drill probe |
| What does someone who is already inside see? | A non-invasive scan from the inside, with exclusions by IP address, port and MAC address for the most delicate line systems | Internal network vulnerability assessment |
| Where does the maintenance contractor get in, and who else can? | Open ports and services exposed on the internet, checked every day | External network |
| Can anyone read the technical drawings? | Access to shared folders tested as an anonymous user and as an authenticated user | Open shares |
| Are employees' passwords already circulating? | Company domain credentials found in data breaches | Dark Web Monitoring |
| If the line stops, how long can the company hold out? | BIA, continuity plan and backup checks | Business continuity |
| Are the suppliers who access your systems reliable? | Qualification questionnaires completed from a link, with evidence | Supply Chain |
Production networks need careful handling. Scans are non-invasive and complemented by manual checks by qualified staff. You decide which subnets to include, when to run the checks and which addresses to exclude: the scan is scheduled when the lines are stopped, not in the middle of a shift.
Fewer surprises on the shop floor, more answers for customers
The network as it is, not as it was designed
Every device found on the network, including the one installed by the machine supplier and never reported to IT.
Questionnaires completed with proof
Reports in Italian and English and self-assessments against NIS2 and ISO 27001 to attach when the customer asks for evidence.
Improvement you can see
Scan history and vulnerabilities resolved over time: you can show the journey, not just today's status.
If production runs several shifts, consider the MDR + SOC 24/7 level: Dottor Marc's SOC responds to alerts at any time, with a dedicated phone number for emergencies.
The three service levels are described on the Product page. For large customers' questionnaires there is a dedicated path: answering customer security questionnaires.
Questions about cyber security in manufacturing
Does a manufacturing company have to comply with NIS2?
It depends on the sub-sector and the size. Legislative Decree 138/2024 includes in manufacturing medical devices, electronics, electrical equipment, machinery, motor vehicles and other transport equipment. If you operate in these sub-sectors and are at least a medium-sized company (50 employees, or €10 million in turnover or balance sheet total), you are an important entity. Other sub-sectors, such as metalworking or textiles, are not listed, but still receive requests from customers who are in scope.
Can a vulnerability scan stop the machines?
Dottor Box scans are non-invasive: they look for ports, services and known vulnerabilities without trying to exploit them. Some very old line devices react badly even to unusual network traffic, which is why you can exclude them by IP address, port or MAC address and schedule the checks during downtime.
How do I manage remote access by machine maintenance contractors?
First of all you need to know what they are: the external network scan shows the ports open to the internet every day, and the internal map reveals routers and remote support devices installed by the manufacturers. Then it is worth qualifying the suppliers who connect, with a questionnaire on their security practices, and tracking access with the access log register.
An automotive customer has sent me a security questionnaire: where do I start?
Start with the questions that ask for proof rather than statements: asset inventory, vulnerability management, backups, training, incident handling. With Dottor Box this evidence comes from the data collected by the platform and from the periodic reports. If the customer asks for a TISAX label you need an assessment by an accredited audit provider: the platform prepares the evidence but does not replace that audit.
What should I do if production is stopped by ransomware?
Isolate the affected systems without switching them all off, alert whoever handles the incident and preserve the evidence. If you are a NIS2 entity you must send an early warning to CSIRT Italia, the national incident response team, within 24 hours and a notification within 72 hours; if personal data is involved, notification to the Garante (the Italian Data Protection Authority) within 72 hours also applies. The Incident Response module takes you through the phases with the roles already assigned.
The modules manufacturers start from
Cyber Drill
The probe installed on site that analyses your internal network. No firewall ports to open.
Learn more SeeAsset Management
A single IT inventory of devices and software, with a graph map of the network.
Learn more SeeInternal network
Your LAN scanned by the on-site probe, the way malware that is already inside would see it.
Learn more SeeExternal network
Your perimeter as seen from the internet: ports, exposed services and blacklists, with nothing to install.
Learn more GovernSupply Chain
Supplier assessment with questionnaires completed from a link, no accounts needed.
Learn more GovernBusiness continuity
Business Impact Analysis, continuity plan and backup checks, guided by questionnaires.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.