Manufacturing and process
Manufacturing
A factory turns material into product on lines where every lost hour is lost output. Its control systems come from many vendors and many decades.
How the process runs
From goods in to goods out
Material arrives, is made into product, checked, packed and shipped. MES ties the line to planning, and utilities keep everything running.
Stage 1: Goods in
Raw material and parts arrive, are stored and moved to the line.
Control systemsWarehouse controlAGVs and conveyorsStage 3: Quality
Vision systems, testers and labs check units or batches.
Control systemsVision systemsTest stationsQuality data (SPC)Challenge4Stage 4: Packing and dispatch
Finished goods are packed, labelled and shipped.
Control systemsPackaging PLCsLabelling and track-and-traceStage 5: Utilities
Power, compressed air, steam, chilled water and HVAC keep the plant running.
Control systemsUtility PLCsBuilding management systemEnergy meters
Attackers rarely go straight for a controller. They travel through these shared systems, so this is where we look first.
For product makers
Building products for manufacturing?
Machine builders, robot makers and automation vendors now carry security obligations of their own. In the EU they come from two directions at once.
- Machines and production lines
- Robots and cobots
- PLCs, HMIs and drives
- Vision and test systems
- MES and industrial software
- IIoT gateways
Due to apply from 20 January 2027: control systems must withstand foreseeable malicious attempts, and safety software must be protected against corruption.
Controllers, software and connected machines sold in the EU need CE marking under the CRA from 11 December 2027.
Plant owners ask automation suppliers for certified components and a secure development process.
For plant owners
Where it gets hard, and how we tackle it
We start from how your process runs, fix what matters most first, and use what you already own wherever we can.
Ransomware stops the line through IT
Norsk Hydro switched plants to manual operation after ransomware in 2019, and Jaguar Land Rover stopped production for about five weeks after a cyberattack in 2025. Lines stop when MES, ERP and ordering go down, even if every PLC is clean. Source: Cyber Monitoring Centre
How we tackle itWe put a proper boundary between plant and IT, list the IT services each line depends on, and plan how to keep producing when they are gone.
Cybersecurity SolutionsEvery machine builder wants remote access
New machines often arrive with their own router or remote support tool, sometimes bypassing the plant firewall entirely.
How we tackle itOur gap assessment finds those paths. Then we move them onto one managed remote access route the plant controls, with approval and recording for every session.
Gap AssessmentMany vendors, many decades
One plant can run Siemens, Rockwell and Schneider PLCs side by side, with HMIs on Windows versions that no longer get patches.
How we tackle itWe build an accurate asset inventory from passive monitoring, then protect what cannot be patched with zones, allow-listing and hardened engineering stations.
Risk AssessmentSmart factory projects outrun security
IIoT sensors, cloud dashboards and digital twins open new paths from the line to the internet, often approved by operations rather than IT.
How we tackle itWe give projects a short security checklist and a reference design for sending plant data to the cloud safely, and review new connections before they go live.
Cybersecurity Program
Where plant owners usually start
Three ways in
Rules and standards
What applies in manufacturing
- IEC 62443International
Zones and conduits for the plant, plus IEC 62443-2-4 for the integrators and service providers who work on it.
- NIS2European Union
Covers makers of medical devices, electronics, electrical equipment, machinery and vehicles above size thresholds.
- EU Machinery Regulation 2023/1230European Union
Due to apply from 20 January 2027: machine control systems must withstand foreseeable malicious attempts, and safety software must be protected against corruption.
- CERT-In Directions, 2022India
Cyber incidents must be reported to CERT-In within 6 hours.
Talk to RelyBlue
Operating in manufacturing?
An honest conversation about your OT environment. No sales pressure, no fear tactics.
- You talk to a senior advisor, never a salesperson