Loading story…
Smart manufacturing environments are increasingly exposed to cybersecurity risks due to architectural decisions that create single points of failure, such as reliance on nonredundant engineering workstations and external cloud connectivity. Stefan Braun, CISO at Henkel, highlights how legacy systems and mixed-generation equipment complicate monitoring and resilience, with attackers exploiting these weaknesses to disrupt production. The shift toward cloud-based SaaS platforms for critical factory operations introduces new vulnerabilities, as disruptions in connectivity or third-party outages can halt entire production lines, turning physical machinery into inoperable assets.
The broader industry faces similar challenges, as demonstrated by a recent AWS outage that disrupted healthcare payment systems due to poor redundancy planning by vendors and service providers. This incident underscores the epidemic of inadequate cloud resilience, where a single provider's failure can cascade across thousands of organizations, affecting both customer-facing and internal operations. The need for robust redundancy, local autonomy, and disciplined vendor accountability is critical to mitigate the operational and security risks posed by these architectural patterns.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
A CIO article argued that recent outages, including the Microsoft 365 and AWS incidents, show enterprises must build redundancy through multi-cloud, hybrid, and edge strategies rather than relying on a single provider.
In a published interview, Henkel CISO Stefan Braun described how legacy OT, unmanaged IoT, nonredundant engineering workstations, and cloud/SaaS dependencies can create production-stopping cyber and availability risks in smart manufacturing environments. He also recommended tiered OT monitoring, war-room-focused tabletop exercises, and stronger vendor SBOM accountability.
An AWS outage on October 20, 2025, was identified as another major incident demonstrating the business impact of relying on one cloud provider for critical operations.
A Microsoft 365 outage occurred on October 29, 2024, later cited as a high-profile example of how dependence on a single cloud provider can create a major operational single point of failure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Industrial and manufacturing organizations continue to face significant **operational technology (OT)** security risk as connected control systems, IoT devices, and legacy infrastructure expand the attack surface. A Siemens Energy report cited by *TechRepublic*, based on Ponemon Institute survey data, found that **77%** of respondents said an OT security compromise in the past 12 months led to loss of confidential information or operational disruption, while **52%** said a successful exploit against their industrial control systems is likely within the next year. Respondents also estimated that **41%** of OT attacks go undetected, with many organizations taking more than a month to detect incidents and an average of seven months to recover. The broader picture is that smart factories are still struggling with basic cyber resilience as modernization outpaces security controls. In an interview with *Help Net Security*, Packsize CSO Troy Rydman said unmanaged **IoT** devices, outdated legacy systems, and human-targeted attacks such as phishing and social engineering remain major weaknesses in factory environments. He also highlighted the persistent tradeoff between production uptime and security requirements, underscoring that industrial operators are still balancing business continuity with the need to reduce exposure across connected devices and older operational systems.
Jun 29, 2026
Security teams are struggling to keep pace with the rapid evolution of cloud environments, where production workloads increasingly rely on multicloud and hybrid architectures. A recent study by Palo Alto Networks highlights that operational complexity, fast-paced software deployments, and the integration of generative AI into development pipelines are outpacing the ability of security controls to adapt, resulting in high-severity vulnerabilities reaching production. Data exposure risks are exacerbated by fragmented environments, overly broad identity permissions, and weak secret management, with manual processes still prevalent for identifying sensitive data and managing access. Supply chain security remains a critical weak point, as attackers exploit third-party access to compromise systems and propagate malicious activity across interconnected organizations. The Thales Digital Trust Index report reveals that over half of organizations retain third-party access long after it is needed, creating persistent vulnerabilities. Weak authentication practices, inefficient identity lifecycle management, and poor access hygiene further increase the risk of breaches originating from trusted partners, underscoring the need for robust controls and continuous evaluation of third-party relationships.
Jun 29, 2026
Organizations are facing a rapidly evolving cyber risk landscape as the boundaries between IT, operational technology (OT), Internet of Things (IoT), and supply chain systems blur. The proliferation of connected devices, such as cameras, badge readers, HVAC systems, and factory controllers, has significantly increased the attack surface for enterprises. Business demands have driven the integration of IT, OT, and IoT, enabling telemetry to inform analytics and automation, but also concentrating dependencies on critical control planes like cloud consoles and APIs. This interconnectedness means that a single compromised identity provider, software updater, or remote management tool can serve as a single point of failure, potentially impacting thousands of endpoints and critical business processes. Security leaders emphasize the importance of maintaining a living inventory of assets, applying least privilege principles, and segmenting networks by function and criticality to mitigate these risks. Unknown or unmanaged devices should be treated as unsafe until proven otherwise, and where devices lack robust security features, organizations are advised to broker connections through secure gateways. The challenge is compounded by resource constraints and the long lifecycles of many IoT and OT devices, which often cannot be easily updated or replaced. The expansion of cyber risk also extends to the supply chain, where third-party vendors, contractors, and service providers can become entry points for attackers. Recent high-profile breaches have demonstrated that adversaries exploit trusted relationships to infiltrate organizations, with the fallout often affecting the victim company regardless of where the breach originated. This complexity is frequently invisible to the public and regulators, leading to reputational damage and loss of narrative control for affected organizations. Effective cyber readiness now requires extensive preparation, including scenario exercises, communication planning, and training to operate under pressure. The shift from endpoint-centric to control plane-centric risk management reflects the need to address the realities of modern, interconnected business environments. Organizations must adopt an "assume breach" mindset and focus on resilience and recovery planning, not just prevention. The evolving threat landscape demands that security strategies account for the full spectrum of connected assets and the intricate web of dependencies that define today's enterprises. As the definition of cyber risk continues to expand, so too must the approaches to visibility, segmentation, and incident response. Ultimately, the ability to manage and recover from cyber incidents hinges on preparation, visibility, and the recognition that every connected asset and relationship represents a potential risk vector.
Jul 12, 2026