Your factory is cybercriminals' #1 target (and nobody's told you)

Why your production plant is the perfect target

If you work in manufacturing in Galicia—workshops, food processing, timber, automotive, logistics—you probably think cybersecurity is a problem for banks or big tech. Wrong.

In 2025, Spain's cybersecurity authority handled 122,223 cyber incidents, a 26% increase from the year before. And the most-attacked sector isn't banking anymore: it's manufacturing. According to NTT Data's Global Threat Intelligence report (February 2026), Spain registered 605 high-impact cyberattacks in just six months. Three per day.

Why factories? Simple: a stopped plant bleeds money by the minute. Attackers know this. Ransomware in an industrial control system doesn't just encrypt files—it stops production. And when that happens, the pressure to pay the ransom is enormous.

Fortinet's 2026 OT cybersecurity report confirms it: 71% of organizations detected between one and nine intrusions in their operational technology systems in the past year. In 2025 it was 47%. The increase partly reflects better detection capabilities, but also real growth in attacks.

The IT/OT convergence trap: we used to be isolated, now we're not

Traditional factories had an accidental security advantage: their control systems (PLC, SCADA, robots) ran on isolated networks with no internet connection. An attacker couldn't reach the production line because there was no path.

That's over. Industry 4.0—connecting machines to management systems, the cloud, and suppliers—eliminated that isolation. And with it, the false sense of security.

Today, in many industrial plants, the corporate network and the production network share infrastructure. An office worker who clicks on a phishing email can, unknowingly, give attackers access to the systems controlling the assembly line. The attack on Aceros Olarra in September 2025, which forced a production shutdown, came in exactly this way: through poorly secured remote access.

The underlying issue is that OT systems have characteristics that make them especially hard to protect:

• Industrial protocols with no built-in security: Modbus, Profinet, DNP3 are designed for reliability, not security. They have no authentication or encryption.
• Equipment 10–20 years old: many PLCs and controllers don't receive security patches and don't support robust authentication.
• Absolute priority on uptime: in IT, you shut down a system during an incident. In OT, shutting down a production line costs thousands of euros per hour immediately.
• Limited visibility: in many plants, nobody has a complete inventory of all devices connected to the industrial network. What you can't see, you can't protect.

The real threats already hitting Spanish factories

This isn't science fiction. These are the attack vectors already shutting down plants in Spain:

Industrial ransomware

It's not just about encrypting office files anymore. Modern ransomware is built specifically to attack OT systems. According to Dragos, there are 119 active ransomware groups specialized in industrial targets—a 49% increase from the previous year. Three new groups focus exclusively on industrial facilities. 93% of manufacturing ransomware attacks also target backups to make sure you pay.

Uncontrolled supplier remote access

This is the most common attack vector. Machinery makers, integrators, and maintenance technicians need remote access to control systems. Many do it through generic VPNs without multi-factor authentication, with sessions left permanently open. An attacker who compromises one supplier can access all their industrial customers' networks without attacking them directly.

Targeted phishing for plant staff

Phishing remains the most effective entry method, present in 76% of recorded OT incidents. And AI has perfected the deception: emails no longer have typos or formatting errors. A production operator who receives a fake "technical support" email and clicks it can open the door to the entire control system.

Shadow OT

Devices that suppliers, installers, or maintenance staff add to the network without documenting them. WiFi sensors, IoT gateways, control panels connected without IT involvement. They don't appear in any inventory. They don't receive updates. They're open doors that nobody knows exist.

NIS2 and the Critical Entities Law: what changes for your company

Until now, cybersecurity in industrial SMBs was optional. In 2026, that's changing through two channels:

NIS2. The European cybersecurity directive classifies manufacturing companies in sectors like machinery, vehicles, chemicals, food, and medical devices as essential or important entities. If you exceed 50 employees or €10 million in revenue, it applies to you. And the obligations are specific: risk management, 24-hour incident reporting, direct management responsibility.

Critical Entities Protection Law. Approved by Spain's cabinet in March 2026, it strengthens obligations for critical sectors. Manufacturing, energy, and logistics are at the center. The law doesn't just require technical measures: it establishes that company leadership is personally liable if protections aren't implemented.

And if your SMB is small and NIS2 doesn't directly apply? That doesn't mean you're safe. Your major customers are obligated, and they'll demand certain security standards as a condition for continued business. This is already happening in automotive and food processing.

5-step plan to protect your plant (without halting production)

After reading the data above, you might think protecting an industrial plant requires million-euro budgets and engineers. It doesn't. Here's what you can do, ordered from most urgent to most strategic:

Step 1: Inventory your OT assets

You can't protect what you don't know exists. Identify all devices connected to your industrial network: PLCs, HMIs, servers, switches, supplier remote access. Passive scanning tools exist that don't interrupt production. This step costs you basically one week of focused effort.

Step 2: Segment IT from OT networks

Your office network and production network must be separated by a firewall with strict rules. No "anything to anything." Every data flow between IT and OT must be explicitly authorized. If an attack arrives by email at the office, it shouldn't be able to reach the plant's PLCs.

Step 3: Control remote access

This is the most exploited attack vector and the easiest to close. Require all supplier remote access to go through a centralized point with multi-factor authentication. Sessions activated on-demand, not permanently open VPNs. Document every session with timestamps and actions performed.

Step 4: Monitor the OT network

Standard IT SIEM solutions don't understand industrial protocols. You need an OT-specific monitoring solution (Claroty, Dragos, Nozomi Networks) that detects anomalies in Modbus, Profinet, or DNP3 traffic without interrupting production. For an SMB, this might cost €15,000–20,000/year. Compare that to the €50,000–350,000 average cost of an attack.

Step 5: Develop an OT incident response plan

An IT incident response plan doesn't work when the production line is down. OT incident response has different priorities: production security before data security. Define who authorizes emergency shutdown, how to continue production manually, and how to restore control systems from clean backups. And test the plan at least once yearly.

How much should you invest in plant protection?

There's no magic number, but there's an industry-accepted rule: 5–10% of your IT/OT budget should go to cybersecurity. For an industrial SMB with 5 office staff and 20 plant workers, that's €3,000–15,000/year depending on digitalization level.

But the most useful way to think about this isn't how much to spend, but how much you risk if you don't:

The math is simple. A single attack can cost more than five years of protection. And the statistic that worries me most: only 57% of companies that pay ransoms recover their data. The rest lose the money and the information.

Frequently asked questions

What is industrial cybersecurity (OT)?

Industrial cybersecurity or OT (Operational Technology) security protects the systems that control physical processes in factories and plants: PLCs, SCADAs, robots, sensors, and production networks. It's different from office IT security because here production uptime is the priority. A traditional antivirus won't protect a PLC.

Does NIS2 apply if I have a 30-person industrial SMB?

It depends on what you manufacture. If you make products covered by NIS2 annexes (machinery, vehicles, chemicals, food), the threshold is 50 employees or €10 million revenue to be classified as an important entity. Below that, it doesn't directly apply. But your major customers are obligated, and they can require you to meet security standards to remain a supplier. This is already standard practice in automotive and food in Galicia.

How much does a cyberattack on an industrial SMB cost?

€50,000–350,000 on average, per INCIBE and Sophos data. This includes ransom (€50,000–200,000), production stoppage (€5,000–50,000/day), and technical recovery (€20,000–100,000). If customer personal data is compromised, add GDPR fines up to €20 million or 4% revenue. Plus there's a hidden cost: executive time spent managing the crisis.

Can I protect my plant without halting production?

Yes. Network segmentation, passive monitoring (scans without interrupting), and remote access management all deploy without affecting production. System patching is scheduled during planned maintenance windows. There's no excuse to wait: Step 1 (inventory) requires no downtime.

What is IEC 62443 and why should I care?

It's the international standard for cybersecurity in industrial automation and control systems. It's not mandatory in Spain, but more and more large manufacturers—especially in automotive, energy, and defense—require it from suppliers. If your company wants to supply these sectors, certification may be a requirement to enter as a vendor.

What do I do if I think I've already been attacked?

Don't restart equipment or delete logs. Isolate affected systems from the network, contact Spain's cybersecurity authority (INCIBE at 017), and preserve all digital evidence. If personal data is compromised, you have 72 hours to notify the data protection authority. Fast, organized response makes the difference between controlled recovery and a crisis that eats months of work.