IT and OT on one flat network
Plant, warehouse and logistics systems were connected for operational reasons and segmented for none. Segmenting and monitoring that boundary is the highest-value security work available in this sector.
Case studies
FMCG, retail & distribution
Thin margins, long supplier chains, and an IT estate that now reaches into plants and warehouses. AI pays back faster here than almost anywhere — forecasting, pricing, catalogue, customer operations — and the security exposure sits in the same places.
Book a 30-minute executive briefing- Relevant regulation or standard
- NIS2 / Cyberbeveiligingswet — food production, processing and distribution
- Relevant regulation or standard
- GDPR
- Relevant regulation or standard
- PCI DSS where cards are taken
- Relevant regulation or standard
- EU AI Act
- Relevant regulation or standard
- ISO/IEC 27001
Who we work with
COO or supply chain director
Runs an operation where an hour of downtime is measurable in pallets.
CIO
Has an estate that now includes plant and warehouse systems nobody ever classed as IT.
Commercial director
Is making pricing and assortment decisions on last quarter's data.
CFO
Sees margin pressure and a rising security line, and wants both explained in the same sentence.
The margin is thin and the attack surface just got wider
Consumer goods and distribution run on volume and timing. The difference between a good quarter and a bad one is often a few points of forecast accuracy, a few days of working capital, or one price change made too late. That is exactly the shape of problem where AI pays back quickly — and it is also why an outage costs far more here than the IT budget would suggest.
The estate changed underneath the org chart. Production lines, warehouse management, cold chain monitoring, handhelds, weighbridges and route planning are all networked now, and a good proportion run software nobody in IT selected. Attackers know it: the route into a distribution business is rarely the ERP. It is the flat network behind it.
The law caught up this summer. The Dutch Cyberbeveiligingswet came into force on 15 August 2026 with no transition period and roughly eight thousand organisations in scope, and food production, processing and distribution is one of the named NIS2 sectors. In scope means a duty of care you can evidence, incident reporting on a twenty-four-hour clock, and accountability sitting with the management body rather than with IT.
Your customers regulate you as well. Retailers and manufacturers cascade their own obligations down the chain through questionnaires and contract clauses, which is why suppliers with no legal obligation of their own end up needing ISO 27001 anyway. It is an unglamorous driver and a reliable one, and it usually arrives with a deadline attached to a listing.
On the AI side the value is unusually legible in this sector: demand forecasting, promotion and pricing, catalogue and master data quality, order and supplier operations, customer service triage. The constraint is almost never the model. It is that product, price and customer data are held differently in three systems — which is a finding you want in week four, not in month nine.
What bites here
NIS2 arriving through the supply chain
Food production, processing and distribution sits in the NIS2 sectors and the Dutch law has applied since 15 August 2026. Even where you are out of scope, your customers' obligations reach you as contract terms.
Master data that does not agree with itself
Product, price and customer records held three ways is the reason most forecasting and pricing projects stall. It is fixable, and it is not fixed by the model.
Ransomware aimed at operations, not data
In distribution the leverage is not confidentiality — it is that the warehouse stops. Recovery objectives should be set against that and tested, rather than assumed and discovered.
Peaks with no slack
Change freezes around peak trading compress every project into the same two windows a year. Security and AI work both have to be planned around that calendar rather than against it.
What we do here
Evaluate
Find out what you are actually exposed to, and where the margin is.
Plan
Sequence it around the trading calendar rather than against it.
Enable
Get the people in the plants and the offices working the new way.
Build
Separate the networks, then build the thing that makes money.
Operate
Keep it running when the warehouse cannot stop.
Where this usually starts
If the driver is regulatory or a customer questionnaire, start with the NIS2 and Cyberbeveiligingswet readiness assessment — it produces the scope determination and the duty-of-care position you will be asked for repeatedly, by different people. If the driver is margin, start with an AI value assessment scoped to a single function: demand planning, pricing or customer operations. A scored portfolio in one function beats a survey of the whole business, every time. And if the plants and warehouses sit on the same network as the offices, do the configuration audit first regardless of the driver. It takes two to three weeks and it usually reorders everything else on the list.
Questions
Are we in scope of NIS2?
It is assessed per legal entity against sector, size and the criteria in the law, and food production, processing and distribution is named. Groups are often in scope for one entity and not another, which is exactly why the determination needs writing down with its reasoning rather than deciding in a meeting.
Our biggest risk is the warehouse stopping. Where do we start?
With the boundary between the office network and the operational one, and with recovery objectives that have actually been tested for the systems that move pallets. Both are ordinary engineering, and neither is expensive next to a week of standstill.
Which AI use case pays back first here?
In our experience, the ones that touch data you already trust: quote and order handling, catalogue and master data normalisation, customer service triage, and demand signals by location. Pricing and promotion pay back more and take longer, because they need the data to agree with itself first.
We supply the big retailers rather than being one. Does this apply?
The law may not; your customers will. Retail and manufacturing buyers cascade security requirements — and increasingly AI requirements — through contracts, and being able to answer quickly has turned into a commercial advantage rather than a compliance cost.
Can any of this happen during peak?
Assessment and planning work, yes. Anything that touches production systems, no — and we would not propose it. We schedule build work into your windows and use the freeze periods for the assessment, design and training that do not require a change ticket.
Leave with your top three risks documented
Thirty minutes with a senior practitioner. No slideware, no sales engineer.