(Provided by bin kontan/iStockPhotos)
Rich Witucki
In July, Coca-Cola’s Fairlife dairy subsidiary suspended production at its U.S. plants after a ransomware attack hit systems that support manufacturing.The company has not said whether the attackers ever reached a controller. Whether they did or not, the outcome was the same: once the systems the plants depended on were compromised, production stopped.Fairlife is not an outlier. Dragos’ Q2 2026 industrial ransomware analysis counted 747 incidents against the manufacturing sector, 65% of the 1,140 ransomware incidents against industrial organizations that quarter. Dragos observed no case that quarter in which a ransomware operator directly manipulated a control system.In the cases Dragos tracked, operations stopped because the enterprise systems the plant depends on were encrypted or shut down as a precaution. Attackers don’t need to touch a programmable logic controller (PLC) to stop a line. They need to reach something the line depends on, and most security programs don’t treat those systems as production assets.The Fundamentals Inherit Your Operational Technology DefinitionEvery OT security program rests on the same foundations: an accurate inventory of what’s connected, segmentation between business and production networks, and tight control of remote access. Those fundamentals are sound. But each one only covers what you have already decided is OT.Consider the manufacturing execution system (MES) server that pushes work orders and recipes to the line. It often runs on a standard Windows server, often sits on the business network or a flat site network, and is patched and managed by IT on IT’s schedule. Because nobody classifies it as OT, it rarely makes the OT inventory. Its connection to the line is treated as ordinary business traffic rather than a path into production, and nobody is watching it for behavior that could affect production. The same goes for the virtualization host that runs it, the Active Directory domain that operators log in through, and the remote access gateways equipment vendors use for support.Those systems are how attackers reach production. Dragos data shows roughly 70% of OT incidents originate in IT. Attackers get in through an internet-facing system on the IT side and move to a machine that sits between the business and the floor. From there, encrypting that one machine can be enough to halt the line. The weak point is usually not the controller. It is the system everyone assumed belonged to someone else.What Does It Influence?Dragos uses a framework called extended operational technology, or xOT, to address this scoping problem. It doesn’t add a new category of device. It changes the question. Instead of asking what type of device something is, xOT asks whether it can influence the physical process: if this system failed or started behaving strangely, would production, quality, or safety change? If the answer is yes, it belongs in the OT security program, regardless of what it runs on or which team owns it.In a typical plant, that question reaches well past PLCs and human machine interfaces (HMIs). Industrial robots, machine vision systems, automated guided vehicles (AGVs), industrial internet of things (IIoT) sensors, edge devices, and historians usually answer yes. But so do some devices nobody thinks of as production equipment, and that is where device type stops being a useful guide.An office printer that turns out reports fails the test. A label printer on a packaging line that stops the line when it goes down passes it. Device type tells you very little. What the operation depends on tells you almost everything.Start With a Walk-ThroughDo it this month. Put your plant manager and your IT lead on the floor together and ask the xOT question of every connected device. Some answers are in plain sight: the cellular modem a machine builder installed in a control cabinet for remote support, the machine vision cameras, the label printers on your packaging lines.For each one that passes, ask what it needs to keep running. The MES terminal leads to its server, the server to its virtualization host, the HMI login to the domain controller that authenticates it. Anything that passes the test goes on the OT inventory and gets the same segmentation, remote access controls, and monitoring as your controllers, whoever owns it today.That single test, applied honestly, will likely surface more real risk than another audit of the systems everyone already agreed were OT.
Subscribe to our twice-weekly, FREE newsletter for the latest manufacturing news and information, including new technologies, educational webinars, podcasts and more.
Subscribe
——————————————————–
Click Here For The Original Source.
