Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Potentially, but not automatically. AI and cloud services can add connections, data flows, remote access, and links between corporate IT and plant-floor systems. Each may create another route an attacker could exploit if it is poorly secured. Adoption alone, however, does not prove a manufacturer is more likely to be attacked: the risk depends on what is connected, how access is controlled, and whether the plant can detect, contain, and recover from an incident.
How can AI and cloud change a factory’s attack surface?
Manufacturing uses industrial control systems (ICS) to monitor and control physical processes. Operational technology (OT) includes the systems and equipment involved in running those processes. Enterprise IT handles business functions such as email, finance, and workforce systems; cloud services may support either business or manufacturing-related workloads. These environments can be connected, but they are not interchangeable—and not every cloud-connected service directly controls machinery.
In its 2024 smart manufacturing section, CISA identifies changes that can expand the attack surface, including AI/ML analytics, more networked devices, data moving between systems, links between IT and OT, and supplier integrations. These are potential exposure points, not proof that any one technology is inherently unsafe. The practical question is what a connection can reach, what data it can access, and what happens if it is misused.
- More connectivity: Sensors, controllers, analytics platforms, and business applications may exchange more data. Each connection needs an owner, a defined purpose, and appropriate limits.
- Remote access: Remote administration can make support more efficient, but weak authentication or overly broad permissions may give an intruder a route into systems that should be restricted.
- IT-to-OT bridges: A connection between business networks and plant systems can create a path across a security boundary. The consequences depend on the systems reachable through that path; it does not mean every IT compromise can control production equipment.
- Suppliers and data flows: External services and partners may handle operational data or connect to manufacturer systems, adding dependencies that need to be governed and monitored.
- AI-related data and services: Analytics can depend on data collection, transmission, and access to systems. Those dependencies should be included in the security assessment rather than treated as separate from the plant’s existing architecture.
NIST also identifies connectivity, remote access, legacy technologies, flat network topologies, and missing security technologies as factors that can expose industrial control environments. The issue is therefore not simply whether a manufacturer uses AI or cloud services, but whether the resulting architecture creates unneeded or insufficiently protected paths.
#1 Best Overall
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
What can a cyber incident put at risk?
In a factory, cybersecurity is not only about keeping business records confidential. An incident can threaten production continuity, the integrity of control systems or manufacturing data, and potentially worker safety. A disruption to corporate IT may also affect operations even when plant-floor controls are not directly accessible—for example, if the business systems needed to coordinate work or support production become unavailable.
ENISA’s Threat Landscape 2025 provides recent sector context for the European Union, but it does not measure whether AI or cloud adoption causes a higher probability of attack. Its reported manufacturing threat activity and ransomware strains are scoped to that analysis, not to all manufacturing attacks worldwide.
| ENISA manufacturing reporting, 2025 | Reported share |
|---|---|
| Cybercrime | 59.3% of reported manufacturing threat activity |
| Data breaches | 20.5% of manufacturing threat reporting |
| Akira ransomware | 48.7% of the ransomware strains listed for manufacturing |
| Qilin ransomware | 20.5% of the ransomware strains listed for manufacturing |
| FOG ransomware | 10.3% of the ransomware strains listed for manufacturing |
ENISA also describes a BlackBasta incident at German consumer-electronics manufacturer Medion AG in November 2024 that caused prolonged IT and website disruptions, and an August 2024 incident affecting the IT systems of Germany’s Arntz Optibelt Group. These are examples reported by ENISA, not evidence that AI or cloud architecture caused either incident.
Which safeguards help manage the added exposure?
Safeguards should follow a plant-specific risk assessment: a control must reduce meaningful risk without creating unacceptable operational or safety consequences. NIST’s manufacturing guidance demonstrates security capabilities, not a universal configuration for every site.
Map connections and protect boundaries
- Inventory relevant devices, services, data flows, remote connections, and supplier access so the organization knows what communicates with what.
- Separate IT and OT networks where appropriate, and restrict traffic between them to necessary, authorized communication. Review the boundaries around remote access and cloud-connected services as well as those between internal networks.
- Assess whether network layouts are unnecessarily flat and whether an incident in one area could reach systems that should remain isolated.
Control identity, software, and changes
- Use authentication and authorization to limit who—and what service—can access systems, and restrict permissions to what is needed for the task.
- Consider application allowlisting where it is appropriate and operationally compatible, so only approved software can run on protected systems.
- Use file-integrity checking to help identify unauthorized changes, and apply change control so updates to systems and configurations are reviewed and traceable.
Monitor without disrupting operations
Behavioral anomaly detection can help identify activity that differs from expected system behavior. Monitoring must account for manufacturing processes and operational constraints: a security measure that interferes with a safety-critical or time-sensitive process can introduce its own risk. NIST’s example architecture includes capabilities such as anomaly detection, allowlisting, integrity checking, change control, and authentication and authorization; manufacturers should select and configure capabilities based on their own assessment.
NIST SP 1800-10, published in March 2022, presents a laboratory demonstration using commercially available components. It is an example of how security capabilities can be assembled, not field testing across a representative sample of factories or proof that one architecture will work everywhere. NIST’s guidance is to assess risk and determine which capabilities are appropriate for the organization.
Rank #4
How should a manufacturer prepare to respond and restore operations?
Prevention cannot guarantee that a cyber incident will not happen. A response plan should explain how the organization will recognize and contain an incident, coordinate security and operational teams, and restore affected services and systems safely. Recovery planning matters because restoring availability without checking system integrity or operational readiness can create further disruption.
Free tools Windows power users keep installed
One-click scans. No signup required.
NIST published an initial public draft of SP 1800-41, Responding to and Recovering from a Cyber Attack: Cybersecurity for the Manufacturing Sector, on May 21, 2026. Its stated comment period closed July 8, 2026. The draft says that defense in depth can mitigate cyber risk but cannot eliminate it, and that manufacturing organizations should plan to recover and restore operations after an incident. Consult NIST’s publication page for the document’s current status.
- Define response roles and communication routes for security, plant operations, safety, and relevant business teams.
- Plan how to isolate affected systems while preserving safe operation where possible.
- Maintain backups and recovery procedures appropriate to the systems involved, and test that restoration works under realistic operational constraints.
- Set criteria for confirming system integrity and readiness before returning affected systems to service.
What guidance can manufacturers use as a starting point?
NIST’s SP 1800-10 describes protecting information and system integrity in industrial control environments and provides the manufacturing laboratory example. Its executive summary outlines the risks and example architecture.
NIST’s Cybersecurity Framework Version 1.1 Manufacturing Profile offers a voluntary, risk-based roadmap. NIST says the profile is intended to enhance—not replace—standards and guidance a manufacturer already uses. It can help organize a security program, but it is not a guarantee against attack.
For smart manufacturing attack-surface considerations, see CISA’s 2024 Compendium of Cybersecurity Technical Investigations. For the European manufacturing threat context described above, consult ENISA’s Threat Landscape 2025. NIST’s SP 1800-41 publication page provides the response-and-recovery document and its status.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
