Here's a number most shop floors never hear: for five years running, manufacturing has been the single most-attacked industry in the world. In IBM's 2026 X-Force Threat Index, manufacturers absorbed 27.7% of all the cyber incidents the team responded to, more than any other sector.

If that surprises you, you're in good company. Most owners assume the criminals are chasing credit card numbers and patient records, and that a metal shop or a food producer in Greater Vancouver isn't really on the map. So why does the plant floor keep coming up first?

Understanding why the sector gets attention is the first step to becoming a harder target. Some of what follows your own team can start this month. Some of it is worth doing alongside whoever looks after your systems. Both halves are worth knowing before you decide where to spend your attention.

Why the plant floor draws attention

It comes down to two things attackers look for: uptime that is expensive to lose, and equipment that was never designed to talk to anything else.

Start with uptime. When a production line stops, the cost is immediate and easy to calculate: idle crews still on the clock, missed ship dates, penalty clauses in supply contracts, and a backlog that takes days to clear. Criminals understand that math as well as you do, and they are betting you will pay quickly to get running again. Ransomware and extortion activity climbed 49% year over year in IBM's latest count, and manufacturers stay near the top of the target list because the pressure to restore production is built into the business.

Then there's the floor itself. Most plant equipment was bought to do one job well for fifteen or twenty years, and it was never built to integrate with anything. Machines, controllers, sensors, and the one old workstation running the CNC used to live in isolation. Today they're connected to your ERP, your email, and the internet, often through whatever bridge got them talking in the first place. It isn't unusual to find a controller running Windows XP, or something older still, because the machine it drives is good for another decade and the vendor stopped issuing updates years ago. The software can't be easily updated, and nobody wants to be the person who patches a machine mid-run.

Add a high cost of downtime to hardware that's hard to patch, and you have the exact profile attackers look for.

What the risk actually looks like (and what it doesn't)

The picture in most people's heads is the movie version: a targeted, sophisticated break-in aimed squarely at your company by someone who has studied you for months. The reality is more ordinary, and it usually starts in one of two places.

The first is an internet-facing application that was left exposed. A remote access portal set up for an equipment vendor during a commissioning job and never turned off. A web form sitting on an old server. A VPN appliance that missed a firmware update two years ago. Exploiting public-facing applications like these is now the leading way attackers get in, accounting for roughly 40% of incidents.

The second is a normal-looking email to someone in purchasing, accounts, or the front office: a fake invoice, a vendor asking you to update banking details, or a shipping notice with an attachment that needs opening today.

From there, if the office network and the plant network are one flat system, a problem that starts on a single laptop can reach the file server holding your job specs, drawings, and schedules. That's the scenario worth preventing, and it's genuinely avoidable with a few deliberate steps.

The path through: six steps worth starting this quarter

You don't have to do all of this at once. We've flagged which parts a capable team can begin on their own and which ones usually go faster with whoever handles your IT.

1. ‍Know what's connected. You can't protect what you can't see. Make a simple inventory of what's on your network, office and floor alike: PCs, servers, the machines, the controllers, the one old workstation running the CNC. Most shops are surprised by what turns up. If you already work with an IT provider, you likely have an asset list somewhere, and in that case the useful exercise is reviewing it rather than building it. Ask when it was last updated, and whether anything on the production floor ever made it onto the list at all.‍
2. Separate the floor from the office. Network segmentation means that if a phishing email lands in someone's inbox, the trouble can't wander onto the production network and stop the line. This is one of the highest-value moves a manufacturer can make. It's a design job rather than a setting you switch on, so it's one to scope with whoever manages your network. Done in phases, it doesn't require shutting production down.‍
3. Turn on multi-factor authentication. Especially for email and any remote access. It's the single cheapest protection against stolen passwords, and it stops most account break-ins cold. If you do nothing else this month, start with the accounts that can move money or approve a vendor change.‍
4. Patch what you can, wall off what you can't. Some equipment can't be updated without the vendor, and some can't be updated at all. That's workable. The answer is to put those machines behind stricter network rules so their age doesn't become an open door. There's almost always a safe path around a machine you aren't allowed to touch.‍
5. Back up both worlds, then test the restore. Back up office files and production configurations, keep a copy offline or immutable, and actually confirm you can bring it back. An untested backup leaves you exposed to exactly the downtime you're trying to avoid. Put a restore test on the calendar the same way you'd schedule preventive maintenance on a machine.‍
6. Train the crew on the messages aimed at them. Phishing training doesn't have to mean a course. Your people are targeted with fake purchase orders and banking-change requests every week. A short, plain conversation about what to watch for, plus one firm rule that any banking change gets verified by phone to a number you already had, turns your team into the first line of defence instead of the way in.

A quick story from a Surrey shop floor

A mid-sized metal fabricator in Surrey had a Tuesday afternoon most owners dread. Someone in purchasing opened an attachment that looked like a supplier invoice, and within minutes a machine was encrypting files. Here's the part that matters: because the shop had separated its office network from the plant floor a few months earlier, and because its backups had actually been tested, the production line never stopped. The office cleaned up the affected machines overnight, restored the files that morning, and the crew was milling parts on schedule. The difference between a bad afternoon and a lost week wasn't luck. It was a handful of quiet decisions made before anything went wrong.

The takeaway

Being the most-targeted industry sounds alarming, but it's really just a signal. It tells you exactly where to put a little attention so you can keep making things without interruption. Start with the two steps that pay off fastest: map what's connected, and confirm your backups actually restore. Those alone move you out of the easy-target category.

Technology can feel like unfamiliar terrain, especially when it's bolted onto equipment you know far better than any network. IT's a jungle out there, and the plant floor is a stretch of it we walk often, which is why supporting manufacturers is a good part of what we do. If you'd like a second set of eyes on where your office network ends and your plant floor begins, book a short call with us. We'll walk through those same two questions together, what's connected and whether your backups would truly bring you back, and you'll leave the conversation knowing where you stand whether or not you ever work with us.

‍