Industry
Technology and security for manufacturing
Manufacturers connect plant systems built for reliability to IT networks built for convenience. Onion Infosec works on both sides of that boundary: plant connectivity, enterprise systems, and the security of each.
- Sector
- Manufacturing
- Segments
- Discrete manufacturing, Process industries, Automotive and industrial equipment, Consumer goods
01Context
When a manufacturer’s systems stop, production stops.
Lines halt, delivery commitments are missed and revenue stops accruing by the hour. That cost of downtime is the reason criminal groups target the sector.
Operational technology was built for reliability and long service life. It now connects to IT networks, cloud analytics and supplier systems that were built for convenience. The boundary between the two is where most of the risk sits, and design files, formulas and process knowledge add an intellectual property concern on top.
02Technology
What the sector builds and runs.
- Plant connectivity and industrial data
- Historian, MES and ERP integration, OPC UA and MQTT data flows, and industrial IoT platforms, designed so that data leaves the control network without opening a path back in.
- AI on the shop floor
- Predictive maintenance, visual inspection and demand forecasting, with models deployed at the edge or in cloud depending on latency and connectivity.
- Enterprise applications and integration
- Supplier portals, quality and traceability systems, and custom applications around ERP and product lifecycle platforms.
- IT and OT operations
- Networks, identity, endpoints, backup and patching across offices and plants, with 24×7 monitoring and support that understands maintenance windows.
03Risk
The risks that matter most.
- Ransomware that halts production
- Attacks on IT systems that plants depend on, such as ERP, scheduling and file services, as well as on the control environment itself.
- IT/OT boundary compromise
- Flat or poorly segmented networks where a compromised office workstation can reach industrial control systems.
- Theft of designs and process knowledge
- Design files, formulas and process parameters targeted by competitors and state-aligned actors.
- Vendor and remote access paths
- Maintenance connections from machine builders and integrators that bypass the controls applied to employees.
04Regulation and assurance
What you may need to demonstrate.
IEC 62443 is the reference standard for industrial control system security, with NIST SP 800-82 as practical guidance and ISO 27001 for the enterprise side. Customer requirements carry weight: TISAX in automotive and CMMC in the US defense supply chain. In the EU, NIS2 covers many manufacturers and the Cyber Resilience Act covers products with digital elements. Regional examples include CERT-In directions in India.
Which of these apply depends on where you operate and what you do. We scope against your actual obligations.
05Where we usually start
Services that matter most here.
OT
Asset inventory, network segmentation, secure remote access and monitoring for plant environments, aligned with IEC 62443 and planned around production schedules.
Managed SOC and MDR
24×7 monitoring that covers both the enterprise network and the IT systems that production depends on.
Managed IT services
Identity, endpoint, patching and backup operations across offices and plants, including tested recovery of the systems that schedule production.
Incident readiness
Response and recovery plans that include plant managers and cover the decision to isolate or keep running.
AI
Predictive maintenance and inspection models built on plant data, with a secure path for that data out of the control network.
Cloud
Cloud platforms for industrial data and analytics, with identity, network and cost controls set from the start.