Cyber-Physical Risk: Building Security Capability and Behavior in AI-Driven, Connected Manufacturing

When a cyber incident becomes a physical incident, security capability stops being an IT line item and becomes a continuity and safety imperative

1. Introduction: When a Cyber Incident Becomes a Physical Incident

Cyber-physical security in manufacturing has stopped being a specialist IT concern and become a board-level continuity and safety question, because the consequence of a breach in a connected factory is rarely confined to data. It is a halted assembly line, a compromised safety interlock, or weeks of lost production while systems are rebuilt and safety-validated before restart. In August 2025, an attack that exploited a vulnerability in a third-party supplier's software moved laterally into a major automaker's core production systems and halted manufacturing across three countries for five weeks, with the UK Cyber Monitoring Centre later calling it one of the most economically damaging cyber incidents in British history and estimated damage reaching close to two billion pounds, rippling out to more than five thousand businesses in the supply chain.

That incident was not an anomaly. It was representative. IBM's X-Force Threat Intelligence Index has now named manufacturing the most targeted industry for cyberattacks for the fifth consecutive year, and Check Point's Manufacturing Threat Landscape 2026 report documents a 56 percent year-over-year rise in ransomware incidents against the sector, from 937 confirmed cases in 2024 to 1,466 in 2025. Manufacturing alone now accounts for roughly half of all ransomware hits globally, reflecting both its operational criticality and the sheer financial cost of even a single day of stopped production.

The uncomfortable truth for manufacturing leadership is that this risk has grown precisely because of the digital transformation the sector has been racing to complete. Every connected sensor, every cloud-linked SCADA dashboard, every vendor VPN tunnel into a production network is both a source of value and a potential entry point. Framing cybersecurity purely as a technology procurement problem, rather than a capability and behavior problem spanning engineering, operations and the executive suite, is precisely why so many manufacturers remain exposed despite meaningful security spending.

2. The Cyber-Physical Capability Stack

Building durable cyber-physical resilience requires capability across five layers that most manufacturers have historically staffed and governed separately. OT security covers the protection of programmable logic controllers, SCADA systems and industrial control systems, and it operates under different constraints than IT security because availability and physical safety, not just confidentiality, are paramount. Network segmentation, increasingly governed by frameworks such as ISA and IEC 62443, limits how far an attacker who gains an initial foothold can move laterally toward the systems that actually run production.

Secure IIoT design addresses the reality that connected sensors and devices are proliferating faster than the security discipline around them, with connected devices in manufacturing facilities projected to more than double between 2025 and 2030. Identity and access management, particularly around the vendor and third-party remote access that Sophos identified as a leading root cause of manufacturing ransomware incidents in 2025, closes one of the most consistently exploited entry points into production networks. Incident response, the fifth layer, determines how quickly an organization can detect, contain and recover, and the gap here is stark: Dragos reports that organizations with comprehensive OT visibility contain incidents in an average of five days, compared with an industry-wide average of 42 days for organizations without it.

3. Behavioral Gaps and Failure Modes

The technical vulnerabilities documented across the industry are well understood by security professionals. What is less consistently addressed is the behavioral layer beneath them, the daily choices made by people on the plant floor and in engineering offices who are not security specialists but who hold the keys to the most consequential entry points. Weak or shared passwords on operator terminals, unsafe use of USB drives to transfer files between air-gapped and networked systems, habitually dismissing patch and update prompts because a reboot risks interrupting a shift, and shadow IT in the form of unauthorized remote access tools installed for convenience, all recur across incident investigations.