May 23, 2025 Manufacturers Face a Broader Landscape of Cyber Risk

Interconnected technologies and multiple points of entry make manufacturers an especially attractive target for cybercriminals.

By Stephen Ross

The manufacturing sector has long been an attractive target for cybercriminals, but recent stats show that industrial manufacturing is becoming a much higher-priority target. As we move further into 2025, the landscape of cyber threats facing manufacturers continues to evolve. The significant increase in attacks, and their growing sophistication is compounded by the fact that as barriers to entry fall, so is the number of bad actors increasing.

Manufacturers are an increasingly attractive target. They are uniquely vulnerable to cyberattacks for several reasons. First, our increasing reliance on interconnected technologies, such as the Internet of Things (IoT), operational technology (OT), and cloud-based data sharing, provides cybercriminals with more entry points into sensitive systems. The operational down time caused by these attacks can be catastrophic, not only financially but also in terms of reputational damage to the manufacturing company and disruptions to the supply chain. In some cases, a single attack can shut down business operations entirely.

In addition, manufacturers often lag behind in terms of the maturity and sophistication of their approach to cybersecurity. While their IT systems may be well-secured, operational technology (OT) – the backbone of manufacturing operations – often lacks the same level of protection. The unique complexity of OT, combined with limited cybersecurity awareness within manufacturing organizations, creates an environment ripe for exploitation. As new threat actors enter the field—and as we’ll see, this is a very real factor—this gap between emerging threats and outdated defenses is widening.

The rise in attacks targeting manufacturing also comes at a time when competition among threat actors is intensifying. In 2024, the number of cybercriminal groups we identified performing these attacks nearly doubled, from 27 to 53. This increase in threat actor groups may result from the perception that significant financial gains can be made by disrupting business operations and stealing critical data, including those targeting organizations in the manufacturing industry. These threat actors are also benefiting from the lower barriers to entry offered by AI-driven tools and other new malware.

What Our Analysis Reveals

Our new 2025 Cyber Incidents Insights Report, which analyzes over 600 cyber incidents we’ve responded to globally, shows a marked rise in attacks on manufacturing organizations. According to ecrime.ch data, in 2022, there were 115 attacks, which surged to over 300 in 2023. By 2024, the number had climbed to 420 incidents – a staggering increase that underscores the sector’s growing vulnerability. While these cases are just a snapshot of the overall activity, we feel they are representative of the global picture for cyber risk in the manufacturing industry.

The majority of the attacks we saw were not full-blown ransomware incidents but targeted business email compromises (BEC). In these cases, attackers use deceptive methods, such as phishing or social engineering, to gain access to sensitive information like credentials. These can then be used to launch further attacks. The rise in BEC attempts highlights the sophistication of modern cybercriminals and the growing complexity of attacks targeting manufacturers.

Typical Cyberattacks on Manufacturers

Cyberattacks on manufacturers come in many forms, but the most common and concerning threats are ransomware, business email compromise, and man-in-the-middle (MitM) attacks. These incidents often lead to operational downtime, stolen intellectual property, and significant financial losses.

Ransomware. While the growth of ransomware attacks slowed in 2024—our report shows a growth rate of 13%, down from 70% the prior year—it remains a potent threat. Attackers use ransomware to encrypt a company’s data and demand a ransom for its release. This can cause significant disruptions and even halt manufacturing operations entirely.

Business Email Compromise (BEC). BEC attacks have become a more common method for cybercriminals to infiltrate organizations. By targeting employees with fake emails or fraudulent communications, attackers can gain access to sensitive information, including company credentials, intellectual property, and financial data.

Man-in-the-Middle (MitM) Attacks. These attacks are particularly dangerous in industries that rely on remote communications and cloud-based platforms for data sharing. A MitM attack occurs when a cybercriminal intercepts communications between two parties. In the case of manufacturing, this could involve intercepting critical design data shared with suppliers or partners. The attacker then can alter, steal, or leak sensitive information.

A 5-Step Approach to Cybersecurity, and How AI Helps

Addressing cyber threat requires a multifaceted approach. At the core of any solution is the recognition of the importance of defense in depth, which refers to implementing multiple layers of security to protect an organization’s most critical assets. Here are five things manufacturing companies should consider incorporating into their cyber risk strategy for the year ahead:

1. Enhanced Security Measures: Where possible, manufacturers should invest in robust cybersecurity frameworks that include endpoint detection and response (EDR) systems, firewalls, and multi-factor authentication. By securing both IT and OT systems, manufacturers can better defend against sophisticated cyberattacks.
2. Regular Backups and Disaster Recovery: Managed backups, disaster recovery planning, and response plans are essential for mitigating the impact of ransomware and other disruptive attacks. Regularly backing up critical data can reduce the effectiveness of ransomware attacks, allowing organizations to restore their operations quickly without paying the ransom.
3. Encryption and Access Control: Encryption, especially symmetric encryption, remains one of the most effective tools for securing data in transit and at rest. Manufacturers should ensure that they use secure data-sharing platforms, implement strong access control protocols, and continuously monitor for unauthorized access to sensitive systems.
4. AI and Machine Learning: AI is a double-edged sword in the cybersecurity battle. On one hand, cybercriminals are leveraging AI to develop more effective malware, create more convincing phishing emails, and automate social engineering attacks. On the other hand, AI and machine learning are also helping defenders by providing advanced threat detection and behavioral analysis capabilities. EDR solutions that use AI can help identify abnormal activity and quarantine malware before it has the chance to execute.
5. Staff Training and Awareness: Manufacturers need to do everything they can to ensure that their employees are adequately trained to recognize phishing attempts and social engineering tactics. With AI making it increasingly difficult to identify fraudulent emails and messages, traditional methods of training (e.g., spotting typos or logo mismatches) are no longer sufficient. Ongoing cybersecurity training programs should focus on more sophisticated threat detection techniques.

A View Into 2025

The rise in cyberattacks on the manufacturing sector is a wake-up call for organizations to raise their cybersecurity maturity levels. Cybercriminals are becoming more sophisticated and are increasingly targeting smaller manufacturing companies, which were previously seen as less lucrative targets.

In 2025, manufacturers will need to continue evolving their defenses to stay ahead of these threats. This means embracing cutting-edge cybersecurity tools, fostering a security-conscious culture within organizations, and recognizing that cybersecurity is an ongoing journey, not a one-time fix.

As the sophistication of attacks continues to rise, the silver lining is that defensive measures are also advancing. By focusing on strong, proactive strategies – such as better backup systems, robust perimeter security, and AI-driven threat detection – manufacturers can better protect their operations and ensure that they remain resilient in the face of ever-evolving cyber risks.

Cybersecurity is no longer just an IT concern. It’s a critical part of operations and business continuity and as such, should be considered a C-Suite priority for the manufacturing industry.

About the Author
Stephen Ross is Head of Cybersecurity, Americas for global cybersecurity and intelligence consultancy S-RM.

Subscribe to Industry Today