Flat networks and unpatchable machines
Vendor-validated systems that may not be updated, on a network with no internal boundaries. The answer is zoning and conduit control, not a patching programme that the machine vendor will not support.
Case studies
Manufacturing & industry
Plant networks that were connected for operational reasons and segmented for none, a product reporting obligation that started this month, and more usable data on the line than in the head office. We secure the estate first, then make the data earn its keep.
Book a 30-minute executive briefing- Relevant regulation or standard
- NIS2 / Cyberbeveiligingswet
- Relevant regulation or standard
- EU Cyber Resilience Act
- Relevant regulation or standard
- IEC 62443
- Relevant regulation or standard
- EU AI Act
- Relevant regulation or standard
- ISO/IEC 27001 and ISO/IEC 42001
Who we work with
Plant or operations director
Cannot accept downtime and is being asked to connect everything.
CIO or CISO
Owns an estate that includes machines nobody in IT selected or can patch.
Head of engineering or product
Puts software inside what the company sells, and has just acquired a reporting duty.
Quality or maintenance manager
Has years of data and no way to act on it before the failure.
Two different clocks are now running
Industrial estates were built for availability, not for confidentiality. A line that runs is a line that earns, so change is resisted for good reasons, machines stay on operating systems the vendor validated years ago, and the network is flat because flat was what worked when it was installed. None of that was negligent. All of it is now exposed, because the same estate is reachable from an office network that is reachable from the internet.
The first clock is the plant. Ransomware against a manufacturer is rarely about stealing anything — the leverage is that production stops, and it stops for as long as recovery takes. Recovery time is therefore the number that matters, and in most plants we see it has been assumed rather than tested. The fix is unglamorous and well understood: know what is on the network, separate it into zones, control the conduits between them, and monitor with something that understands industrial protocols rather than treating a PLC like a laptop. IEC 62443 is the reference, because it is built around exactly that model.
The second clock is the product. The EU Cyber Resilience Act's reporting obligations took effect on 11 September 2026. If you place a product with digital elements on the EU market — including where the digital part is small and the product is mostly mechanical — you must report actively exploited vulnerabilities and severe incidents, with the wider requirements following on 11 December 2027. Many manufacturers who have thought carefully about their factories have not yet thought about the firmware in the thing they ship.
Meanwhile the data question is the opposite of the one head office has. Most corporate AI projects start by looking for data that turns out not to exist. A plant generates more of it in a shift than the rest of the business generates in a month — machine signals, quality results, maintenance records, energy consumption — and it is trapped rather than absent.
So the sequence writes itself. Segment and monitor, because that is where the loss is. Then build a governed data path off the line, because that is where the gain is. Doing them in the other order connects an estate you cannot yet defend, which is the most expensive way to start a digital programme.
What bites here
Recovery time nobody has tested
In manufacturing the ransom demand is leverage over production, not data. Recovery objectives should be tested against the systems that actually move product, and usually have not been.
A product obligation that started this month
Cyber Resilience Act reporting has applied since 11 September 2026 to products with digital elements placed on the EU market, with full requirements from 11 December 2027.
Data that is present but trapped
Historian, MES and quality systems that do not agree on what a batch, a line or a product is. Reconciling them is most of the work in any plant analytics project.
Maintenance history too thin to predict from
Predictive maintenance needs labelled failures to learn from. Where the history is thin, anomaly detection delivers value first and the labelling starts immediately.
What we do here
Evaluate
Find out what is on the network and what would actually stop the line.
Plan
A target architecture for an estate that cannot stop while you change it.
Enable
The plant teams have to run it, not just receive it.
Build
Separate the networks, then build what the data is for.
Operate
Watch it continuously, and keep the models honest.
Where this usually starts
Almost always with the asset inventory and the network. It is two to three weeks, it is the least exciting thing on this page, and it reorders every other priority — because until you know what is on the plant network and what talks to what, every subsequent decision is a guess. If you place products with digital elements on the EU market, run the Cyber Resilience Act position in parallel: that obligation is live now, and the reporting route needs to exist before you need it. The data and AI work starts once there is a boundary worth putting it behind, and the blueprint below sets out that sequence in full.
Questions
We cannot patch the line. Is that a dead end?
No, and it is the normal condition. Where a machine cannot be updated, you compensate around it: put it in its own zone, control what may talk to it, monitor that boundary, and treat the machine as untrusted by design. That is the whole logic of IEC 62443, and it is designed for exactly the estate you have.
Does the Cyber Resilience Act apply to us?
If you place a product with digital elements on the EU market, yes — including where the digital element is a component of a largely mechanical product. Reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026; the wider requirements apply from 11 December 2027.
Are we in scope of NIS2?
It depends on sector, size and the criteria in the law, assessed per legal entity — manufacturing of certain product categories is named. Groups are frequently in scope for one entity and not another, which is why the determination belongs in a written memo rather than a meeting.
Can we do predictive maintenance without touching the network?
Not meaningfully. Getting data off the line is a connectivity decision, and making that connection safely is the segmentation work. We would rather tell you that before the project than during it.
Our OT vendor says they handle security. Is that enough?
It covers their equipment, under their terms, usually within their own zone. It does not cover the network between their equipment and everything else, which is where incidents actually travel. Ask for the scope in writing — the gap is usually visible in one reading.
Leave with your top three risks documented
Thirty minutes with a senior practitioner. No slideware, no sales engineer.