A modern factory may connect production lines, warehouse systems, sensors, quality tools and enterprise applications. This helps teams track production and respond to operational changes. It also creates more paths between industrial systems and business networks.

That connection changes the security requirements. A threat that affects an office laptop is serious. A threat that interrupts a production controller can stop a line or affect physical processes. The response must account for safety and uptime.

Rockwell Automation's 2026 State of Smart Manufacturing research found that 46% of manufacturers experienced at least one cyber incident in the previous year. The study gathered feedback from 1,560 respondents across 17 manufacturing countries. Read the report findings.

For manufacturers, OT security in manufacturing needs to start with the plant environment. It should protect industrial assets without disrupting the processes they control.

Why OT security needs a different approach

Operational technology, or OT, includes systems that monitor or control physical equipment. Examples include programmable logic controllers, supervisory control and data acquisition systems, distributed control systems, industrial robots, sensors and human-machine interfaces.

Enterprise IT and OT share some security needs. Both need asset visibility, access controls, network protection, monitoring and recovery plans. Their operating priorities can differ.

An IT team may apply a security patch during a scheduled update window. A plant may run a process that cannot stop during that window. A controller may also depend on an older operating system or vendor-supported configuration.

NIST's Guide to Operational Technology Security, SP 800-82 Rev. 3 addresses these differences. It frames OT security around performance, reliability and safety requirements. These considerations should guide the design of every plant security control.

A good OT security programme therefore asks two questions. Can the control reduce the cyber risk? Can the plant continue to operate safely after the control is introduced?

Where manufacturing environments are exposed

Every plant has a different architecture. Still, several exposure points appear across connected manufacturing environments.

1. Flat networks between IT and OT

A plant network may have grown over several years. New machines, engineering workstations and business applications may have been connected as projects needed them. Without clear boundaries, a compromise in one area can create paths into another.

Segmentation limits those paths. It separates systems by function and risk. It also defines which communications are necessary between zones.

2. Remote access for suppliers and engineers

Equipment vendors often need remote access for maintenance and troubleshooting. Engineers may also connect from different sites. Shared accounts, persistent remote sessions and broad permissions increase risk.

Remote access should use named identities, strong authentication and time-limited approvals. Access should be restricted to the system and task required. Sessions should be logged and reviewed.

3. Legacy systems that cannot be patched easily

Some production systems run for many years. Their hardware or software may not support regular updates. A patch can also affect a certified process or a vendor-supported configuration.

These systems need compensating controls. Segmentation, restricted access, passive monitoring and tested backups can reduce exposure. Patch decisions should involve OT engineers and equipment owners.

4. Incomplete asset inventories

Security teams cannot protect devices they do not know exist. Plant environments may include controllers, sensors, engineering stations, wireless devices and vendor equipment. Some devices may be undocumented or connected only during maintenance.

An OT inventory should capture the asset type, location, owner, firmware, network connection and operational importance. It should also record the communication paths required for normal operation.

5. Limited visibility into industrial protocols

General IT monitoring may not understand the protocols used by industrial equipment. A sudden change in communication between a controller and an engineering workstation may matter more than a large volume of routine traffic.

Monitoring should account for the protocols and normal behaviour of each plant segment. It should also avoid active scanning that could affect sensitive equipment.

6. Recovery plans that focus only on IT

A backup may exist, but the plant may not have a tested way to restore a controller, engineering workstation or production configuration. Recovery also depends on the order in which systems must return.

A plant recovery plan should identify the people, equipment, software and approved procedures required to restart operations safely.

A practical OT security model

A useful approach uses several layers. Each layer addresses a different type of risk.

Start with asset discovery and risk ranking

Build an inventory of devices, software, connections and owners. Group assets by process and operational importance. Identify systems that affect safety, production quality or plant availability.

Do not treat every asset as equal. A controller responsible for a critical process needs a different protection plan from a monitoring display. The inventory should also identify end-of-life equipment and systems with known support limits.

Segment the plant network

Create security zones for systems with similar functions and risk. Define the traffic that needs to pass between those zones. Use an industrial demilitarised zone, or IDMZ, where information must move between enterprise IT and plant OT.

The goal is to prevent unnecessary connections. A business application should not have direct access to every controller. A supplier should not reach an entire plant because one machine needs support.

Segmentation rules should follow documented production flows. Test them with plant engineers before implementation. An incorrect rule can interrupt a legitimate process.

Secure remote and privileged access

Use individual accounts for staff and suppliers. Apply strong multi-factor authentication. Grant access only for approved tasks and periods. Record remote sessions where the technology and operational context allow it.

Privileged accounts should receive extra attention. Review who can change controller logic, update engineering workstations or modify network devices. Remove old accounts after a supplier engagement ends.

Monitor without disrupting production

Use passive traffic monitoring where active discovery could create operational risk. Establish a baseline for normal communications between industrial assets. Investigate unexpected devices, new connections and changes in traffic patterns.

Security alerts should reach people who understand both the cyber risk and the process. A technical alert alone may not explain whether a response could affect production.

Manage vulnerabilities and changes with plant owners

Maintain a list of known vulnerabilities and vendor advisories. Assess each issue against the asset's role, exposure and available mitigations. Plan patches during approved maintenance windows.

When a patch is not possible, document the reason and apply compensating controls. Set a review date instead of leaving the exception open indefinitely.

Prepare for incidents and recovery

Define how the plant will respond to ransomware, suspicious remote access, malware on an engineering workstation and loss of network connectivity. Include plant operations, IT, security, safety and equipment vendors.

Test recovery procedures. Restore selected configurations in a controlled environment. Make sure teams know who can isolate a segment and who must approve a production shutdown.

How to build an OT security roadmap

A plant-wide programme can feel too large when the current environment is not fully documented. A phased plan makes the work manageable.

Phase 1: Assess. Select a plant or production area. Build an asset inventory and map the connections between IT and OT. Identify exposed remote access, unmanaged devices and critical dependencies.

Phase 2: Prioritise. Rank risks by operational impact, likelihood and ease of containment. Give priority to internet-facing access, shared privileged accounts and systems connected to critical processes.

Phase 3: Protect. Implement segmentation, controlled remote access and suitable endpoint or network controls. Start with the areas that present the highest risk and have a clear change window.

Phase 4: Monitor. Establish normal traffic patterns and alert rules. Route relevant events to teams that can assess both cyber and production impact.

Phase 5: Test. Exercise incident response and recovery. Confirm that controls work as intended. Record where operational teams need additional procedures or training.

How should manufacturers measure progress?

Security tools installed is not a useful measure on its own. A better scorecard shows whether the plant is easier to understand and safer to operate.

Track measures such as:

·       Percentage of OT assets inventoried and assigned to an owner.

·       Number of unmanaged or unauthorised connections.

·       Percentage of remote access sessions using named, approved identities.

·       Percentage of critical zones with documented segmentation rules.

·       Time required to identify an affected asset during an incident.

·       Percentage of critical systems with tested backups and recovery procedures.

·       Number of high-risk vulnerabilities with an approved mitigation plan.

·       Incidents that caused production disruption or required emergency isolation.

Review the scorecard with operations leaders. A reduction in alerts is not helpful if visibility has also decreased. The measures should reflect security and production continuity together.

What to look for in an OT security partner

Ask how the provider will work with plant engineering teams. A good partner should be able to explain how discovery, monitoring and segmentation will affect existing processes.

Ask for a clear method to identify assets and communication paths. Request examples of how the provider handles legacy systems and remote vendor access. Confirm who approves changes and who supports incident response.

Arche's OT Security practice describes capabilities across OT asset discovery, network segmentation, industrial protocol security, incident response and connected-device controls. Its Manufacturing practice also covers IT/OT convergence, wireless infrastructure, OT managed services, plant security and edge data centres.

These capabilities matter because OT security does not sit in one product. The design needs to account for the plant network, industrial devices, access paths and operating procedures.

Frequently asked questions

What is the difference between IT security and OT security?

IT security protects information systems and data. OT security protects systems that monitor or control physical processes. OT controls must account for safety, uptime and equipment limitations.

Can legacy OT systems be secured without replacing them?

Often, yes. Asset discovery, network segmentation, restricted remote access, passive monitoring and tested recovery can reduce exposure. The right controls depend on the system and its operational role.

Should IT and OT networks be fully separated?

They should have clearly defined boundaries and approved communication paths. Some business and production information must move between them. An IDMZ and documented access rules can help manage that exchange.

How often should an OT security assessment be performed?

Assess the environment before major changes and after significant incidents. Review critical assets and access paths on a regular schedule. The frequency should reflect plant risk and regulatory needs.

Protect production while improving security

A strong OT security programme starts with a clear picture of the plant. It then builds boundaries around critical systems and controls who can reach them.

The programme should involve security, IT and operations from the first assessment. That keeps cyber controls aligned with production requirements.

Explore Arche's OT Security capabilities or speak with the team about your manufacturing environment.