Why do manufacturing organisations remain exposed even when they understand the cybersecurity risk?

Manufacturers often have to choose between security improvements and operational continuity. Patching, retooling, or taking systems offline can create downtime costs that exceed the perceived cost of a breach. That reality leaves known vulnerabilities in place, especially in legacy environments and shared-access workflows where attackers can log in rather than break in.

Why This Matters for Security Teams

Manufacturing exposure persists because the business cost of interruption is immediate, while the cost of a known weakness is often deferred until an attacker turns it into downtime. In plants, shared terminals, vendor access paths, and legacy controllers are frequently kept alive to preserve throughput, which makes “fix later” the default operating model. That is why the issue is not just patching discipline, but the security economics of uptime.

NHIMG’s research on The 52 NHI breaches Report shows how often identity-related failure becomes the practical entry point, not a theoretical one. The same pattern appears in broader industry reporting, where CISA cyber threat advisories consistently highlight exploitation of exposed services, weak access paths, and credential misuse. For manufacturers, that means the problem is rarely a lack of awareness. It is the collision between operational continuity, inherited systems, and access models that were never designed for modern threat pressure.

In practice, many security teams encounter the breach only after a production stoppage, not through an intentional resilience test.

How It Works in Practice

Most manufacturing environments expose risk because access is optimized for continuity, not for containment. Operators, engineers, integrators, and suppliers often share privileges across plants, and the same account may reach HMI stations, historians, remote maintenance portals, and sometimes upstream business systems. When that account is over-privileged or rarely rotated, an attacker does not need to break in again after the first foothold. They can log in, move laterally, and blend into normal activity.

This is why NHI governance matters even in a manufacturing question. Service accounts, API keys, certificates, and remote support tokens are all secrets that can outlive the task they were created for. Current guidance suggests moving away from long-lived static credentials toward JIT issuance, short TTLs, and workload identity so access is tied to what the system is and what it is trying to do. That aligns with the broader direction of Ultimate Guide to NHIs — Key Challenges and Risks, which stresses that stale credentials and weak visibility are recurring failure modes.

Practically, that means:

• replace shared accounts with named or workload-bound identities where possible;
• issue credentials just in time for maintenance windows and revoke them automatically when the task ends;
• use policy-as-code and runtime checks instead of relying only on pre-approved roles;
• segment vendor access so remote support cannot silently reach production assets beyond its purpose;
• log identity usage in a way that operations and security can both investigate quickly.

Frameworks such as NIST Cybersecurity Framework 2.0 and NIST SP 800-53 Rev 5 Security and Privacy Controls help structure the control set, but implementation must fit the plant’s maintenance model and safety constraints. These controls tend to break down when suppliers still require persistent remote access to aging equipment that cannot support modern identity enforcement.

Common Variations and Edge Cases

Tighter access control often increases maintenance overhead, requiring organisations to balance reduced exposure against repair speed, vendor support, and safety procedures. That tradeoff becomes sharper in multi-site plants, where one facility may modernize credentials while another still depends on VPNs, shared jump hosts, and controller accounts that cannot be changed without downtime.

There is no universal standard for this yet, but current guidance suggests prioritising the highest-risk access paths first: remote maintenance, shared administrator credentials, and secrets used by automation scripts. For some facilities, the immediate win is not full transformation but reducing the lifetime and reach of the most dangerous identities. The Top 10 NHI Issues resource is useful here because it reflects how credential rotation, visibility, and privilege sprawl repeatedly surface in real environments. Industry reporting from Ultimate Guide to NHIs — Why NHI Security Matters Now also shows that exposure is often less about missing policy and more about unresolved operational dependency.

Edge cases matter: air-gapped plants, legacy PLCs, and safety-certified systems may not tolerate frequent change, so compensating controls such as strict segmentation, monitored break-glass access, and immutable logging become more important. Best practice is evolving toward context-aware access, but in brownfield manufacturing, the realistic goal is to narrow blast radius without disrupting production.

Related resources from NHI Mgmt Group

• Why do source code leaks remain hard to control even when leaders understand the risk?
• Why do AI agents create new risk even when they are short-lived?
• How should organisations reduce risk from exposed non-human identities and secrets?
• Why do unused permissions remain a risk even after teams find them?