Article in a snapshot:

• Manufacturing: the number one target for cyber attackers
• Connectivity improves efficiency, but expands the attack surface
• SMEs are not exempt
• What cyber incidents in manufacturing look like in practice
• When cyber incidents cause physical damage
• Operational safeguarding for manufacturing clients
• Where cyber insurance fits in

Manufacturing businesses have always managed physical risk. Fire, equipment failure, and supply chain disruption are familiar territory. But as factories and production facilities have become increasingly digitised and connected, a new category of risk has moved firmly into the mainstream. For your manufacturing firms, understanding cyber exposure and having the right cover in place is no longer optional.

Manufacturing: the number one target for cyber attackers

It might surprise some of your clients to learn just how firmly manufacturing sits in attackers’ crosshairs. According to IBM’s X-Force Threat Intelligence Index, manufacturing has been the most targeted industry for cyberattacks for five consecutive years, accounting for around 27.7% of all documented ransomware incidents globally. In the first half of 2024 alone, the sector recorded 377 confirmed ransomware and data leak incidents, more than any other industry. 

The reason is straightforward. Manufacturers have a very low tolerance for downtime. Every hour a production line sits idle, revenue is lost, orders are missed, and potential contractual penalties can be incurred. Attackers know this, and they exploit it. Ransomware in a manufacturing environment can cause production stoppages and all the financial consequences that follow.

Connectivity improves efficiency, but expands the attack surface

Modern manufacturing relies on a dense web of digital systems. Production lines, machinery, sensors and control systems are increasingly connected to online IT networks. Industry 4.0 technologies such as real-time monitoring, predictive maintenance and automated quality control deliver genuine operational benefits. They also create a far larger attack surface than existed a decade ago. 

Many manufacturing businesses use a mix of legacy operational technology (OT), systems designed long before network connectivity was a consideration, alongside modern IT infrastructure. That combination can be particularly difficult to protect. Legacy OT systems were not built with modern cyber threats in mind, patching them is often disruptive, and integrating them securely with newer systems requires specialist knowledge that many businesses might not have in-house.

Manufacturing businesses may also be connected to broader supply chains, sharing data and systems with suppliers, customers and logistics partners. A weakness anywhere in that chain can be an entry point for attackers.

SMEs are not exempt

A common assumption among smaller manufacturers is that cyber attackers are focused on large, high-profile targets. The data tells a different story; 42% of SMEs in the UK have experienced a cyber attack or breach in the past year. Automated attack tools allow criminals to scan thousands of organisations simultaneously, looking for common weaknesses such as unpatched software, weak passwords and unsecured remote access, regardless of company size. 

For a mid-sized manufacturer, a ransomware attack that halts production for several days can be detrimental. Unlike a large corporate with a dedicated IT security team and tested incident response plans, many SMEs have limited internal resource to respond quickly and effectively. Often, there is a gap in coverage. That is where the value of cyber insurance, and the services that come with it, becomes most tangible.

What cyber incidents in manufacturing look like in practice

Recent incidents illustrate the breadth of exposure across the sector.

When cyber incidents cause physical damage

One of the most important distinctions in manufacturing cyber risk is the potential for a digital incident to cause physical consequences. In most industries, a cyberattack affects data and systems. In manufacturing, the impact can extend to the factory floor itself. 

Where production equipment is controlled by networked systems, an attacker who gains access to those systems can alter settings, disable safety controls or disrupt processes. The consequences can include:

• Machinery operating outside safe parameters, causing equipment failure or fire
• Production of defective or unsafe products, with associated liability implications
• Shutdown failures that cause physical damage to plant, stock or buildings
• Contamination of batches in sectors such as food and beverage or pharmaceuticals
  
  

Real-world incidents have demonstrated this risk clearly. In 2014, a German steel mill suffered significant physical damage after attackers manipulated control systems, preventing a blast furnace from being properly shut down. More recently, a ransomware attack on a US water treatment facility saw operators briefly lose control of chemical dosing systems. 

For larger manufacturing clients with significant industrial control system exposure, Brit’s BCAP Industrial product is specifically designed to respond. BCAP Industrial provides cover for cyber-triggered physical damage and business interruption at industrial facilities, addressing risks that standard cyber policies may not cover. We would encourage you to speak to our team to understand the benefits of this specialist product.

Operational safeguarding for manufacturing clients

Cyber security does not have to be prohibitively complex or expensive. There are a number of practical steps businesses should consider taking to reduce their exposure:

Network segmentation

Separating IT networks from OT and production control systems is one of the most effective steps a manufacturer can take. If an attacker compromises the business’s IT environment, segmentation limits their ability to move laterally into production systems.

Multi-factor authentication

MFA on all remote access and critical systems significantly reduces the risk of attackers using stolen or compromised credentials. It is now a standard requirement for most cyber insurers.

Tested backups 

Offline or air-gapped backups, tested regularly, give businesses a realistic path to recovery after a ransomware attack. Many businesses discover at the point of crisis that their backups were not as complete or as usable as they assumed.

Supplier and supply chain oversight 

Understanding how third-party suppliers and technology providers connect to systems, and what security standards they maintain, is increasingly important. A supply chain compromise can be just as damaging as a direct attack.

Staff training 

Phishing and social engineering remain among the most common entry points for attackers. Regular, practical training, particularly for those with access to financial systems or production controls, reduces the human element of risk.

Where cyber insurance fits in

Cyber insurance works alongside good security practice as a critical part of a manufacturing client’s resilience planning. Modern policies do considerably more than pay claims. 

At Brit, our cyber cover provides manufacturing clients with access to a coordinated incident response from the moment a breach is reported, including 24/7 notification, breach counsel, digital forensics and technical support to contain and recover from an incident. Our approach means clients have expert support at every stage of a cyber event.

Pre-breach services are also an important part of what we offer. Security assessments, training resources and access to specialist advice can help your clients improve their cyber maturity over time, reducing the likelihood of an incident as well as its impact if one does occur.

For larger manufacturers with significant industrial control system exposure, our BCAP Industrial product provides specialist cover for cyber-triggered physical damage and business interruption. We welcome the opportunity to discuss what the right structure looks like.

Speak to our team

We have been writing cyber insurance for more than 20 years. That depth of experience gives us genuine insight into how cyber risk plays out across different sectors, including manufacturing. 

If you would like to discuss how to approach cyber risk management, or explore the cover options available, get in touch with our Cyber team today