Manufacturers are built for uptime. Attackers know it.
When a manufacturer is hit, the impact rarely stays inside security operations. A compromised credential can lead to access across business systems. A vulnerable VPN or firewall can become a path into the plant network. A ransomware intrusion can delay production, expose intellectual property, disrupt shipments, and create pressure across suppliers, customers, and executives at the same time.
Pressure increased again this quarter. Manufacturing organizations were named in 563 ransomware attacks, a 71% increase from the previous quarter.
But the bigger issue is not just more attacks. It is how attackers are operating. They are using more paths at once, such as exposed internet-facing systems, stolen credentials, phishing, remote-access tools, and newly disclosed vulnerabilities. For manufacturing security leaders, the old model of working one alert at a time is no longer enough.
Why Manufacturing Is Harder to Defend
Manufacturing environments are distributed and operationally sensitive, making it harder to defend the many suppliers, engineering systems, OT networks, and third-party connections that create pathways attackers can test.
Ransomware groups continue to take advantage of that complexity. In the latest reporting period, groups including “The Gentlemen,” “Qilin,” and “Akira” showed elevated interest in manufacturing compared with other sectors, because downtime has direct business impact.
Vulnerability exploitation has also expanded. This quarter, we observed 109 newly exploited vulnerabilities, up from 62 in the previous quarter. Same-day exploitation nearly doubled. Attackers are moving quickly from disclosure to exploitation, especially against internet-facing technologies like VPNs, firewalls, remote-access systems, collaboration platforms, and network management tools.
For manufacturers, those systems often connect the business to plants, suppliers, and remote operations. If one exposed system is missed, it can become the front door.
Identity and External Exposure Are Raising Risk
There is increased movement toward credential access and internet-facing exploitation. Phishing remains a factor, but Password Spraying, Brute Force, and Exploit Public-Facing Application all gained share during Q3 2026.
Valid credentials let attackers blend into normal activity, bypass controls, and move through trusted systems. In manufacturing environments, that creates a path from corporate identity to operational disruption. A compromised account tied to remote access, engineering workflows, or supplier connectivity can become much more than an IT issue.
We learned that impersonating domains and subdomains made up 74% of DRP alerts for manufacturing customers. Credential exposure declined, but it remains a persistent risk.
This points to a broader external risk problem. Attackers are using fake domains, exposed infrastructure, and brand abuse to support phishing, fraud, impersonation, and follow-on intrusion. A fake domain that looks like a supplier portal or corporate login page can create real access risk quickly for manufacturers.
How Manufacturing Security Leaders Can Act Now
Manufacturers should focus on reducing attacker speed before it becomes operational impact. Here are some proactive steps manufacturing security teams can take now:
Prioritize high-exposure points: Treat VPNs, firewalls, SD-WAN management, remote-access portals, and collaboration tools as critical exposure points. Base patching on exploitability and business criticality and restrict public access wherever possible. Monitor closely for suspicious API activity, configuration changes, abnormal logins, and new administrative access.
Harden identity infrastructure: Enforce phishing-resistant MFA, prioritizing administrators, remote access, and third-party users. Monitor actively for password spraying, brute force, impossible travel, new device registration, and unusual session behavior.
Control remote-access and data-transfer tools: Restrict or block unapproved use of tools like AnyDesk and rclone, which attackers leverage for hands-on-keyboard activity and data theft. Build response actions that can terminate sessions or isolate affected systems quickly.
Monitor outside the perimeter: Track external threats for impersonating domains, exposed credentials, open ports, and expired certificates. Use external telemetry to catch threats before they become visible internally.
Automate safe containment actions: Automatically revoke compromised tokens, delete phishing emails, terminate malicious VPN sessions, or isolate IT endpoints without risking production. Route any action that could affect OT to a human analyst, with a fully assembled investigation attached.
Agentic Defense for Manufacturing
This quarter, manufacturing organizations improved mean time to contain from 2 hours and 11 minutes to 1 hour and 56 minutes. Organizations using Automated Response Playbooks achieved an average containment time of 6 minutes.
That is the difference between responding after an attacker has moved and containing before the incident becomes operational.
GreyMatter is the Agentic AI Security Operations Platform built to solve this problem. The Universal Translator normalizes telemetry across vendors without requiring data centralization. Detection at Source, at Storage, or in Transit catches threats where data lives or as it moves. Agentic Orchestration uses autonomous agentic systems to investigate, hunt, build detections, and execute response across the environment.
Attackers are moving faster across more paths. Manufacturing defenders need security operations that can match that speed, with precision and control.
