How to Protect a Connected Factory from Cyberattacks Without Stopping Production

To protect a connected factory from cyberattacks, you don't need to renew your whole infrastructure or change your production processes. According to SPRI, you can make progress with specific actions: separating networks, controlling access more tightly, protecting remote connections and starting to monitor what happens in plant systems [1].

How can you protect a connected factory from cyberattacks without stopping production?

The security of a connected plant can be strengthened by acting on specific points, without replacing all the infrastructure or redesigning processes. It comes down to separating networks, controlling access, protecting remote connections and gaining visibility into what happens in plant systems. This is the core of industrial cybersecurity and smart factory security.

The starting point is simple. Every time a machine stops working in isolation, there is something new to protect. This happens with a machine linked to the ERP, with a robot that exchanges data with other equipment and with a line that allows remote maintenance. Each of those connections opens an entry point that needs to be controlled [1].

Do you have to renew all your infrastructure to be safe?

No. SPRI stresses that connecting the factory brings advantages and that what matters is doing it securely, not undoing digitalisation [1]. As a starting point, you can review one specific concern: a network that should be separated, machines with remote access, communication between the plant and the ERP, or external staff who need to connect.

Which four areas concentrate the initial effort?

The four areas the source highlights are these [1]:

• Network separation: the production network and the office network should not be the same one.
• Access control: who gets into each machine, for how long and with what permissions.
• Protection of remote connections: remote working, technical support from outside and supplier maintenance.
• Visibility: monitoring the industrial network to detect anomalous behaviour.

Why is protecting an industrial plant different from protecting an office?

In a factory, an IT failure can reach physical production. That is why generic cybersecurity advice is not enough unless it is adapted to the reality of the plant.

The usual recommendations for any company are useful: keep software up to date, run audits, use firewalls, make backups and train staff [2][3]. If you want to review that foundation, there is a basic cybersecurity guide for SMEs. When applying that advice in a plant, keep in mind that even small updates can interrupt production.

What sets OT security apart from traditional IT security?

IT (information technology) security mainly protects data and management services. OT (operational technology) security protects the equipment that controls physical processes: machines, robots, automated cells. In OT, the priority is that production keeps running. In operational environments, even small updates can interrupt production.

What happens when an IT incident reaches the production line?

The source describes three scenarios: someone gains unauthorised access to a machine, ransomware reaches the plant network, or an IT incident ends up affecting production [1]. A security breach can stop production lines and disrupt delivery times.

Which security measures can you apply without interrupting production?

You can start by reviewing the network and access, assessing the impact of each measure together with production. The measures are segmentation, access control, remote access protection and monitoring. Together they form the basis of manufacturing cybersecurity and of any effort to protect production from cyberattacks.

SPRI mentions projects for IT/OT network segmentation, remote access protection, secure architectures, firewalls, IDS/IPS, monitoring or SOC services, as well as response and recovery measures [1]. If you need a broader view, you can look at the approach to industrial OT security.

How does network segmentation help?

Separating the production network from the office network makes it harder for a problem to spread from one to the other [1]. Several Basque plants cited by the source have carried out actions of this kind: sectorising the plant, segmenting critical networks or installing firewalls.

How do you better control who accesses the machines?

By limiting who can enter each machine remotely, for how long and with what permissions [1]. This does not mean shutting down access, but making sure every connection has an owner and a reason.

How do you protect remote connections?

Connectivity does not end at the factory walls. VPNs, identity management, strong authentication or dedicated remote access solutions make it possible to keep remote working and external support going without leaving systems exposed [1]. The source also mentions strengthening the security of the plant's Wi-Fi networks.

How do you gain visibility into what happens in the plant?

By monitoring the industrial network to detect anomalous behaviour before it affects production [1]. Monitoring makes it possible to spot anomalous behaviour in the industrial network.

What should you do if ransomware reaches the plant network?

SPRI raises ransomware in the plant network as one of the possible risk scenarios. The best preparation is to limit by design how far it can spread and to decide in advance who acts and how.

Why does network separation limit the reach of an incident?

In a connected environment, attackers who gain access can move laterally between systems and affect operations. Network segmentation limits lateral movement and helps contain breaches. Segmentation appears in several of the projects that SPRI describes [1].

What should be decided before it happens?

The source includes response and recovery measures among the possible actions [1]. In practice, it helps to be clear about who decides to isolate part of the network, how systems are recovered and in what order the line is restarted. You can read more about ransomware protection.

What questions should you ask before touching a running line?

Before applying any change, production, maintenance and IT should agree on which assets are critical, when it is possible to intervene and how a change is rolled back if something fails. This list is general guidance:

Which plant assets are critical and which can wait?

• Which machines stop production if they fail?
• Which ones connect to the ERP or to external suppliers?
• Is there equipment whose internal workings nobody understands well?

How do plant, maintenance and IT coordinate to choose intervention windows?

• Take advantage of planned stoppages or shift changes.
• Appoint a person from production with the authority to approve or halt a change.
• Document each intervention and how it is reverted.

Which changes can be tested first outside production?

• Network rules in a test environment or on a secondary line.
• New remote access with one specific supplier before extending it.
• Monitoring in observation-only mode before enabling blocking.

Is there funding available for industrial cybersecurity?

According to SPRI, the Ciberseguridad Industrial 2026 programme provides for a maximum grant of 100,000 euros per company [1]. Even so, check the terms and requirements before counting on it.

What does the Ciberseguridad Industrial 2026 programme cover?

SPRI states that the programme can cover part of the cost of these improvements. Among the eligible expenses, it lists specialised consulting and engineering tied to the project, hardware and software licences [1].

How can you check whether your company is eligible?

The most prudent step is to ask SPRI directly about eligible actions, the scope of the programme and how to apply. According to the source, the deadline ends on 23 November [1].

What does this mean for your business?

If your plant is already connected, the first reasonable step is to run a diagnosis: what is on the network, who accesses it and which remote connections exist. With that picture, you can prioritise the measures that affect production the least.

That diagnosis can be carried out with a team specialised in cybersecurity for OT and industrial environments, who can help decide where to start without stopping lines. It is also worth confirming with legal counsel which cybersecurity obligations apply to your company. As a starting point, you can review the NIS2 requirements for the industrial and OT sector.