Home / Industries / Manufacturers & suppliers

IT for shops and plants that can’t stop the line.

Southeast Michigan builds things, and its suppliers are a favorite target for ransomware and data theft. You get plant-floor networks that stay up, security your customers’ audits will accept, and AI that keeps drawings and specs where they belong.

  • Tier 2 and Tier 3 automotive suppliers
  • Defense and government contractors
  • Machine shops, tool and die, and fabricators
  • Plastics, coatings and finishing
  • Engineering and design firms
  • Distribution and logistics

What makes manufacturing IT different

A plant has two networks whether anyone planned it or not: the office side and the machines. The shop floor often runs on older Windows computers that can’t be updated without the equipment vendor, sitting on the same network as email. When ransomware gets in through a phishing message, that’s how it reaches the line.

Customers are paying attention. Automakers and defense primes send security questionnaires, require certifications and flow those requirements down to their suppliers. Losing an RFQ because you couldn’t answer a questionnaire is an expensive way to find out.

I spent years in Fortune 150 manufacturing, working between engineering, the plant floor and the front office. The fixes are rarely exotic: separate the networks, control who can reach what, keep backups attackers can’t touch, and document it all so the next audit is routine.

Rules you may answer to

Most of these come from your customers’ contracts rather than a regulator. Your purchase orders and supplier agreements tell you which ones apply.

CMMC
Defense suppliers that handle Controlled Unclassified Information need CMMC Level 2. The Pentagon suspended third-party certification (Phase II) in July 2026 pending a review, but Level 1 and Level 2 self-assessments, SPRS scores and annual affirmations still apply, and primes still flow the requirements down to subcontractors.
NIST SP 800-171
The 110 security requirements behind CMMC Level 2 and DFARS 252.204-7012. Cloud services that store CUI must meet the FedRAMP Moderate baseline or its equivalent.
TISAX
Required by many European automakers and their Tier 1 suppliers, and increasingly passed down to Tier 2 and Tier 3 suppliers that handle their design or production data.
Customer security requirements
OEMs and Tier 1s often have their own questionnaires and contract terms. A documented security program answers most of them once, instead of from scratch every time.
ISO/IEC 27001
The international standard for an information security management system. TISAX builds on it, and some customers ask for it directly.

Where manufacturers get hurt, and how I close the gap

Manufacturing was the most-attacked industry in IBM’s incident response data for the fifth year running, with 27.7% of all incidents in 2025. Here’s how attackers usually get in, with the numbers behind it and what I do about each.

  1. 32%of attacks on manufacturers began by exploiting an internet-facing system

    Exposed systems and old remote access

    Internet-facing applications and portals were the most common way in, and external remote services such as VPN and remote desktop added another 11%. Forgotten vendor access is a classic.

    What I doAn outside-in scan of everything you expose to the internet, patching or retiring what doesn’t need to be there, and one controlled, multi-factor path for staff and vendor remote access.

    Source: IBM X-Force Threat Intelligence Index 2026

  2. 41.6%of manufacturing ransomware victims were hit through security gaps they didn’t know they had

    Gaps nobody knew about

    The top organizational cause, at 42.5%, was a lack of in-house expertise to spot and stop an attack in time. Unknown gaps came a close second.

    What I doA plain-English security assessment that finds the gaps before an attacker does, a prioritized fix list, and ongoing monitoring by someone who knows what to look for.

    Source: Sophos, State of Ransomware in Manufacturing and Production 2025

  3. 3,300industrial organizations hit by ransomware in 2025, over two-thirds of them manufacturers

    The plant floor shares the office network

    Ransomware groups targeting industrial organizations grew 49% in a year. When the office and the machines share a network, one infected laptop can stop the line.

    What I doSeparate the plant network from the office, control and log every connection between them, and keep machine programs and configurations backed up offline.

    Source: Dragos 2026 OT/ICS Cybersecurity Report, via Stingrai

  4. 23%of manufacturing ransomware attacks started with a malicious email

    Phishing and stolen logins

    Email is still a leading way in, and valid stolen accounts made up another 16% of initial access in IBM’s data. One compromised login can reach the whole network.

    What I doMulti-factor sign-in everywhere, email filtering, separate admin accounts, and training built around the invoice, shipping and supplier scams manufacturers actually see.

    Source: Sophos, State of Ransomware in Manufacturing and Production 2025

  5. 29%of defense contractors who felt audit-ready had the basic evidence in place to back it up

    A compliance score that won’t survive review

    Third-party CMMC certification is on hold, but DFARS 7012, NIST SP 800-171 and self-assessed SPRS scores still apply, and the Justice Department has settled False Claims Act cases over overstated cybersecurity claims.

    What I doAn evidence-based gap assessment against the 110 NIST SP 800-171 requirements, a system security plan and remediation plan that match reality, and a score you can defend.

    Source: Kiteworks, State of CMMC 2.0 Preparedness in the DIB (2026)

Related services: Network security & cybersecurity · Managed IT services · Cloud, Microsoft 365 & Google Workspace · AI consulting & integration · Secure AI

Where AI helps, and where it needs guardrails

AI can take real hours out of quoting, documentation and quality paperwork. It can also send a customer’s drawings to a public service with one paste.

Good places to start

  • Drafting quotes, RFQ responses and supplier emails
  • Turning tribal knowledge into written work instructions and SOPs
  • Summarizing maintenance logs and downtime notes to spot repeat problems
  • Drafting corrective action, 8D and quality reports from your own data
  • Searching your own manuals, specs and procedures with an assistant that stays in your accounts

Keep out of AI tools unless approved

  • Customer drawings, CAD files and specifications
  • Controlled Unclassified Information, which needs tools and cloud services approved for CUI
  • Pricing, cost models and supplier terms
  • Free and personal AI accounts staff sign up for on their own

How a secure AI setup works

Put AI to work on the plant floor

Cameras that inspect every part, sensors that warn before a machine fails, and machine data that finally explains where the shift went. The models are the easy part. Getting them onto the floor without opening the plant to attackers is where most projects stall, and where I spend my time.

Visual quality inspection

Computer vision that checks parts at line speed and catches what tired eyes miss on the third shift.

What it covers

  • Surface defect and finish inspection
  • Assembly verification: missing, wrong or misplaced parts
  • Label, part number and lot code reading
  • Dimensional and presence checks
  • A saved image for every part, for traceability and customer complaints
  • Reject signals wired to the line

Best forLines with defect escapes or 100% manual inspection.

  • Fewer escapes
  • Consistent every shift
  • Proof for every part

Predictive maintenance

Vibration, temperature and current data from the machines that actually hurt you when they fail, watched for the early signs of wear.

What it covers

  • Condition sensors on critical spindles, motors, pumps and presses
  • Alerts when readings drift from normal
  • Repairs scheduled into planned downtime
  • Failure history tied to your maintenance system
  • Spare parts planned from real wear

Best forPlants where one machine going down stops a line.

  • Less downtime
  • Planned repairs
  • Longer equipment life

Production, downtime and energy insight

Machine and shift data turned into answers: where the time went, what’s scrapping out and what each line costs to run.

What it covers

  • OEE and downtime reasons by machine and shift
  • Scrap and rework trends tied to their causes
  • Energy use by machine, line and shift
  • Throughput and capacity forecasts for quoting
  • Plain-language summaries for the morning meeting

Best forPlant leaders who know there’s capacity hiding somewhere.

  • More throughput
  • Less waste
  • Lower energy costs

How it gets onto the floor safely

  • Cameras, sensors and edge devices on their own network segment, never flat on the office network.
  • Processing at the edge where speed matters, with data kept in your own cloud account.
  • Vendor remote access through one controlled, multi-factor path that you can switch off.
  • Start with one line and an off-the-shelf camera or sensor kit, prove the value, then decide what’s worth customizing.

AI consulting & integration · Agentic operations

Common questions

Are you a CMMC assessor?

No. Certification assessments are performed by authorized third-party assessment organizations (C3PAOs). I help you get ready: scoping, a gap assessment against NIST SP 800-171, remediation and documentation, so your self-assessment holds up today and a certification assessment goes smoothly when it returns.

CMMC certification is on hold. Can we wait?

The suspension paused third-party certification, not the security requirements. DFARS 252.204-7012 and NIST SP 800-171 are still in your contracts, and your SPRS score is still a representation to the government. Getting the controls and evidence right now protects you today and puts you ahead whenever certification resumes.

We’re a small shop. Does CMMC really apply to us?

If you handle Controlled Unclassified Information under a defense contract or subcontract, yes, whatever your size. If you only handle Federal Contract Information, Level 1 applies instead. Your contract and your prime tell you which, and I can help you read them.

Can we use AI with customer drawings?

Only in tools your customer agreements allow, and never in free or personal accounts. For CUI, the tool and the cloud service behind it have to meet the requirements for CUI. Many shops start with AI on internal paperwork and SOPs, where the data is their own.

Our machines run old versions of Windows. Is that a problem?

It’s common, and it’s manageable. When equipment can’t be updated, isolate it: its own network segment, no internet or email access, and tightly controlled remote access for the vendor.

Sources

  1. IBM X-Force Threat Intelligence Index 2026
  2. Sophos, State of Ransomware in Manufacturing and Production 2025
  3. Dragos 2026 OT/ICS Cybersecurity Report, via Stingrai
  4. Kiteworks, State of CMMC 2.0 Preparedness in the DIB (2026)
  5. Holland & Knight, DOW suspends CMMC Phase II requirements (July 2026)
  6. DFARS 252.204-7012, Acquisition.gov
  7. NIST SP 800-171 Rev. 2

Figures and rules on this page were checked against these sources on October 27, 2026, using the latest edition available. This page is general information, not legal advice.

Other industries

Keep the line running and the audits boring.

Tell me what your customers are asking for. You’ll get a straight read on where you stand and a plan to close the gaps.

Book a callSend a message