Five Years as the Most-Attacked Industry: Securing Manufacturers

For the fifth straight year, manufacturing was the most attacked industry in the world. And that’s not a coincidence; it’s a trend that comes down to how manufacturing is structurally built and how modern production environments operate.

IBM X-Force’s 2026 Threat Intelligence Index cites that manufacturing accounted for 27.7% of all cybersecurity incidents observed in 2025, which was more than any other sector. Ransomware played a big role. According to KELA’s 2025 ransomware data, reported by Industrial Cyber, ransomware attacks against manufacturers rose from 520 to 838 incidents year-over-year, a 61% increase and the steepest growth of any critical sector, including industries such as healthcare, energy, and financial services.

Why is manufacturing a main target?

Manufacturing is targeted so heavily due to its IT architecture. Dragos found that shared IT/OT domains, corporate networks and production systems with no meaningful separation between them showed up in nearly half of the manufacturing environments it assessed. That’s the highest rate of any sector Dragos tracks, and more than three times the rate seen in oil and gas or electric environments.

The IT/OT architecture is what makes manufacturing an easy target. For example, attackers don’t need specialized industrial control system knowledge to cause damage on a plant floor. Stolen credentials, compromised remote access, and weak network segmentation are all common entry points into IT systems, and once an attacker is inside a network, systems can be easily disrupted. In fact, victim data from Dragos found that manufacturing accounted for more than two-thirds of all ransomware victims among industrial organizations in 2025 alone.

What a breach looks like for a manufacturer

Verizon’s 2026 Data Breach Investigations Report reveals how manufacturers actually get breached. Three attack patterns, including system intrusion, social engineering, and basic web application attacks, account for 91% of manufacturing breaches. These techniques do not require the attacker to have any understanding or in-depth knowledge of the industry. The report found that hacking actions were involved in 71% of manufacturing breaches, with stolen credentials and exploited vulnerabilities each responsible for 41%, which is consistent with the data points Dragos identified as the byproduct of flat IT/OT networks.

The Jaguar Land Rover incident in 2025 is a prime example. A cyberattack forced the automaker to proactively shut down its systems, halting production across its UK factories and disrupting suppliers for a whopping five weeks. Thousands of employees across the company and its supplier base were sent home, and the financial fallout, which was reported in the hundreds of millions of pounds, extended well past the day systems came back online. For manufacturers, downtime is usually the real cost of a breach, not the stolen data.

The AI complication

Manufacturers are leaning into AI too, and the same legacy footprint behind the IT/OT problem exists there too. Netrio’s Mid-Market AI Readiness Report found that 50.9% of manufacturing IT leaders cite data readiness and integration as their biggest gap in executing on AI, the largest of any industry surveyed and above the 46.1% overall rate. Plant floors are full of legacy equipment generating data that was never built to feed an AI model, which is the same infrastructure gap that leaves IT and OT effectively running on one flat network.

That gap is starting to show up as a barrier, not just a risk. Cisco’s 2026 State of Industrial AI Report found that 40% of industrial decision makers now cite cybersecurity as the top obstacle to AI adoption, up from third place just two years ago, and 43% still report limited IT and OT collaboration. The same disconnect between plant floor and IT stack that makes manufacturers easy breach targets is now also slowing their AI rollouts.

Where manufacturing security should start

The data makes it clear. Stolen credentials, compromised remote access, and flat networks are common, well-understood entry points. That means the solutions are just as well understood and achievable.

For most manufacturers securing their companies should start with:

• Segmenting IT from OT so a compromise on one side can’t reach production on the other
• Closing off unmonitored or unmanaged remote access
• Bringing visibility and monitoring to the OT environment itself, not just the IT layer around it
• Getting plant-floor data AI-ready before scaling AI tools further, rather than after

Netrio works with manufacturers on OT-aware cybersecurity, vulnerability detection and management, and AI readiness and governance built in from the start rather than being bolted on afterward. Manufacturers need to keep attackers out and keep their operations running, and Netrio can help.

Ready to assess where your environment stands? Contact Netrio today.