Notifications
Clear all
Topic starter
25/06/2026 2:55 pm
TL;DR: Manufacturers adopting IIoT, automation, and AI are expanding their attack surface through shared workstations, mobile devices, and contractor access, while ransomware, third-party breaches, and supply chain disruption remain top risks, according to Imprivata. Identity and access controls now determine whether digital transformation improves resilience or amplifies operational exposure.
NHIMG editorial — based on content published by Imprivata: World Manufacturing Day underscores the critical need for secure access management
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%).
Questions worth separating out
Q: How should manufacturing teams secure shared workstations without slowing production?
A: Use session-based controls rather than relying on one-time login alone.
Q: Why is contractor access such a high-risk issue in manufacturing environments?
A: Contractor access often spans critical systems, short time windows, and urgent maintenance needs, which makes it easy to over-grant.
Q: What do security teams get wrong about identity in Industry 4.0 programmes?
A: They often treat identity as an administrative layer instead of an operational control.
Practitioner guidance
- Harden shared-workstation session controls Require re-authentication at shift changes, disable cached credentials where possible, and ensure every session on a shared device can be attributed to one named identity.
- Scope contractor access to a single task window Provision vendor and contractor accounts for the specific maintenance or support activity only, then revoke access immediately when the work is complete.
- Use monitored authentication for production systems Combine passwordless authentication with session recording on high-risk plant systems so teams can preserve speed while creating an audit trail for investigations.
What's in the full article
Imprivata's full article covers the operational detail this post intentionally leaves for the source:
- How manufacturers are applying passwordless authentication in shared-device environments without disrupting floor operations
- The article's discussion of session recording and access monitoring as practical controls for production and contractor access
- The compliance context around CMMC, NIS2, and updated cybersecurity expectations for manufacturing organisations
- Why identity is being framed as the control point that connects workflow efficiency with security and auditability
👉 Read Imprivata's analysis of secure access management for manufacturing →
Manufacturing identity security: are your access controls keeping up?
Explore further
25/06/2026 4:09 pm
Manufacturing identity security is now an operational resilience issue, not just an IAM programme concern. The article is right to connect uptime, safety, and intellectual property to access management because identity failures in manufacturing do not stay contained inside the security team. They reach production, maintenance, contractor workflows, and supplier integrations. That means IAM, PAM, and lifecycle governance need to be evaluated as plant resilience controls, not only as compliance mechanisms. Practitioners should treat identity as part of operational continuity planning.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
A question worth separating out:
Q: Who is accountable when a third-party identity causes a manufacturing incident?
A: Accountability should sit with the business owner of the access, not only the security team. If a vendor account remains active after a task ends, or if approval records are missing, the programme has a lifecycle governance failure that falls under access ownership, offboarding, and audit controls.
👉 Read our full editorial: Manufacturing identity security is becoming the new control point
