Manufacturers face rising cyber risk not only on the factory floor but across sprawling, multi-tier supplier networks, with third-party breaches doubling from 15% to 30% in a year per Verizon’s 2025 Data Breach Investigations Report.

Security culture must shift from a purely technical remit to shared organizational responsibility, with procurement, operations, and production leading risk appetite and asset prioritization while the CISO provides assessment frameworks, segmentation, and monitoring.

Embed vendor security requirements in procurement contracts and onboarding, and maintain ongoing supplier assessments with continuous monitoring as the supply chain perimeter now reaches every connected link.

Legacy OT/IT gaps are closing as IT and OT converge, expanding the IT/OT attack surface and enabling disruptions through supply chain compromises.

Industrial systems commonly ship with vendor-installed software, default credentials, backdoors, and unpatched vulnerabilities that are often overlooked within supplier ecosystems.

AI can amplify risks like phishing and deepfakes but also strengthen defenses through real-time asset discovery, credential monitoring, and faster detection and response; it should augment—not replace—security controls such as segmentation and MFA.

EU rules are tightening supply chain cybersecurity: NIS2 broadens accountability to mid-sized manufacturers and suppliers, the Cyber Resilience Act imposes product-level obligations, and the EU Machinery Regulation requires resistance to tampering and unauthorized access, with main requirements starting in early 2027.

Breaches in vendors cascade to downstream firms, making the most connected node in the supply chain the critical single point of failure.