Manufacturing IT
Protecting a business where downtime is measured in units not produced.
Manufacturers need the standard controls — MFA, endpoint detection, email security, patching, tested immutable backups — plus segmentation between office systems and production equipment. Much plant equipment runs unsupported operating systems that cannot be patched, so the practical control is isolating it, restricting what it can talk to, and being able to recover production systems quickly.
Production equipment often runs old Windows versions the machine vendor will not let you touch. You cannot patch your way out of that, so you contain it: separate VLANs, firewall policy that permits only the traffic the machine requires, no direct internet access, and controlled vendor remote access instead of a permanent open tunnel.
Plant staff share terminals, work in gloves, and rotate across shifts. Security models designed for office knowledge workers fail here and get bypassed.
We design account models, MFA methods and session behavior that plant employees can actually follow, which is the difference between a policy and a workaround.
When a manufacturer is hit, the loss is production hours plus the cost of restarting a stopped process. Recovery priority matters: ERP and receiving usually come first, because nothing else can start without them.
We build recovery order into the plan rather than deciding it during an incident.
Separate the network that runs the business from the network that runs the machines, then control every path between them.
OT and IT have different security assumptions. IT expects regular patching, antivirus, MFA and modern operating systems. OT often cannot be patched, runs legacy protocols, and was designed to be isolated by air gap. Segmentation lets OT keep running while IT gets the security controls it needs, and it prevents a single compromised office PC from becoming a path to a production controller.
Many machine controllers run Windows versions the vendor will not certify for patches. The realistic answer is not to argue with the vendor; it is to isolate the device so tightly that its exposure is minimal.
That means a dedicated VLAN, a narrow firewall rule, no internet, no direct SMB browsing, and monitoring that can spot unexpected traffic.
A well-segmented plant survives ransomware better because the infection has fewer paths to travel. Even if the office is locked, the line may be able to keep running while recovery happens elsewhere.
Let machine vendors support their equipment without leaving a permanent tunnel open to the rest of the plant.
Vendor access should be requested, approved, time-boxed, destination-limited and logged. The vendor connects to a hardened jump server in the industrial DMZ, authenticates with MFA, and is allowed only to the specific device they need to support. When the session ends, access is revoked. There is no always-on VPN sitting on the control network.
Vendor credentials are a common attack path. If a vendor's account is compromised and the path is permanent, the attacker can move straight into the control network. A brokered session removes that standing privilege.
We design the access path, manage the jump server, enforce the policy and keep the logs. The vendor still does the machine-specific work they are qualified for. The boundary is clear: they bring the machine expertise, we bring the secure access.
Audit trails, document control and recall readiness built into normal transactions.
Traceability requires that every movement of a lot or serial is recorded as it happens — receipt, consumption, production, shipment — plus an audit trail showing who changed what and under whose approval. With that in place, a forward trace from a supplier lot to every affected customer, or a backward trace from a complaint to its raw material, is a report rather than an investigation.
Auditors ask who could change a specification or release a held lot, not just who did. Role design, segregation of duties and identity controls in the ERP are part of the compliance posture — and they connect directly to the identity and security work we do everywhere else.
Retention requirements are worthless if the restore has never been tested. We tie ERP data retention to a backup and recovery plan with proven restore times, so the records exist when someone asks for them years later.
Common questions
It can be, with a controlled path: dedicated account, restricted destination, MFA, logging and access that is enabled when needed rather than left permanently open.
It can be isolated and monitored, which is the realistic control when patching or replacing is not an option.
Only if it is done without understanding the traffic. We document required flows before changing rules, then test with the vendor or operator present.
Start with visibility: inventory devices by MAC, VLAN and function, identify the critical traffic flows, then move devices into VLANs in planned phases with rollback windows.
Once it is set up, approval is usually minutes. The bigger delay is often the vendor's own response time, not the access workflow.
It can be done with existing firewalls, VPN concentrators and jump servers, or with dedicated privileged access tools. We choose based on the number of vendors, frequency of access and budget.
Most commonly ISO 9001, AS9100, IATF 16949 and FDA-regulated environments. The ERP controls are similar; the evidence and validation expectations differ.
Only with the full control set — unique identity, audit trail, record retention and system validation. We scope that explicitly rather than assuming a checkbox covers it.
We review your network, security posture, cloud tenant and recovery plan, then hand you a plain-language report of what we found and what it means for the business.
