By [Pankaj Kumar Mohanta, Cybersecurity Engineer]
Mid-sized manufacturers should start zero trust with identity and remote access, not new hardware. In order: inventory what is connected, enforce multi-factor authentication, replace broad VPN access with per-application access, separate office IT from the plant floor, and control vendor connections. Most of this fits within existing licenses and low-cost tiers.
What is zero trust in a manufacturing plant?
Zero trust is a security approach in which no user, device or network location is trusted automatically. Every access request is checked against identity, device health and policy. In a factory, that means a compromised office laptop or vendor login cannot reach machines, PLCs or production data without separate, explicit approval.
Fortinet’s Field CISO for EMEA, Daniele Mancini, told Manufacturing Today that zero trust is “a philosophy rather than a technology.” That matters for your budget: you are changing how access is granted, not buying one product.
Plants add one rule that office IT does not have: availability comes first. A patch or agent that is routine on a laptop can halt a line. The two reference frameworks are NIST SP 800-207 (zero trust architecture) and IEC 62443 (industrial control system security). Both support a gradual, low-risk rollout.
Why should a mid-sized manufacturer act now?
Manufacturing is the most targeted industry for ransomware in several 2026 datasets, and attackers are moving toward smaller victims. Because plants lose revenue every hour a line is down, they are more likely to pay quickly, which is why the sector keeps topping these lists.
Where should a mid-sized manufacturer start with zero trust?
Start with the six steps below, in this order. Each one reduces the chance that a single stolen password or infected laptop becomes a plant shutdown, and the first three rely mostly on tools and licenses you may already own.
Step 1: Map what is connected (weeks 1-3). Write down every user, device and remote connection that touches production. TXOne’s Jim Montgomery, writing in IndustryWeek, makes understanding what is on the network the number one priority for OT zero trust. Include vendor remote-support tools, shared engineering laptops and any machine with a public or cellular connection. Rank each process by cost per hour of downtime. A spreadsheet, firewall logs, DHCP leases and switch tables are enough to begin.
Step 2: Enforce multi-factor authentication and clean up accounts (weeks 2-5). Turn on multi-factor authentication for every administrator, remote-access, email and vendor account. Remove shared logins, give administrators separate accounts, and disable stale vendor access. Check the licenses you already hold, since many productivity suites include basic multi-factor authentication and conditional access at some tiers. Use hardware security keys for administrators where budget allows.
Step 3: Replace broad VPN access with per-application access (weeks 4-8). A traditional VPN often places the user on the whole network. Zero trust network access (ZTNA) grants access to one named application at a time, after checking identity and device. According to independent pricing trackers, Cloudflare’s Zero Trust free tier covers up to 50 users and its pay-as-you-go tier is $7 per user per month; confirm current prices on the vendor’s site. Start with the highest-risk path, usually remote access for engineers and outside vendors.
Step 4: Separate IT from OT (weeks 6-10). Gartner’s report, as summarized by Cora Systems, calls network segmentation the most effective single action for limiting the blast radius of ransomware. Fortinet’s Mancini suggests starting at the network because it can be improved without touching shop-floor applications. Use the firewall you already own: create zones for office IT, plant-floor systems and the DMZ, deny traffic by default, and allow only named connections between zones. Route engineering access through a hardened jump host. Dutch OT specialists at FHI suggest starting with operator and engineer workstations, because attackers rarely go straight to the PLC.
Step 5: Control third-party and vendor access (weeks 8-11). Give vendors time-limited, approved and logged sessions instead of standing accounts. Mancini notes that manufacturers have long-running trust relationships with suppliers, so procurement should require security terms before a device or vendor reaches the production network.
Step 6: Monitor, back up and rehearse (weeks 10-13). Log authentication and remote-access events, keep at least one offline or immutable backup, and run a tabletop exercise with the plant manager. Gartner’s summary notes that plants need safety validation before restarting, so downtime is often measured in weeks rather than days. Practice the restart.
Zero trust vs VPN: what is the difference for a factory?
A VPN gives a trusted user broad access to a network once they are in. Zero trust grants access to specific applications after checking the user and the device each time. For plants, the practical gain is that a stolen vendor password no longer opens the whole production network.
| Traditional VPN | Zero trust network access | |
|---|---|---|
| Access granted | Whole network or large subnet | One application at a time |
| Trust model | Trusted once connected | Verified per request |
| Device checks | Often none | Device health and posture |
| Vendor access | Often standing accounts | Time-limited, logged |
| Lateral movement risk | High | Lower |
| Typical cost | Hardware or license, often already owned | Per-user fee; free tiers exist |
What does a 90-day plan look like?
| Days | Focus | Done when |
|---|---|---|
| 1-30 | Inventory, multi-factor authentication for admins and remote users, remove shared accounts | You can list every remote path and every admin account |
| 31-60 | Per-application access for engineers and vendors, first IT/OT firewall zones in monitor mode | VPN no longer the only way in; zone rules logged |
| 61-90 | Enforce segmentation, time-limited vendor sessions, backup test, tabletop exercise | Restart rehearsal completed; gaps ticketed |
What mistakes should manufacturers avoid?
- Treating it as a big-bang project. Mancini argues that disruption comes mostly from how changes are introduced. Phase it and test in monitor mode first.
- Installing agents on legacy PLCs or HMIs. Protect them from the outside with segmentation, jump hosts and allow-lists instead.
- Buying “zero trust in a box.” No single product delivers it.
- Leaving the plant manager out. Operations must own the uptime trade-offs.
- Skipping the inventory. Policy depends on knowing what exists.
Frequently asked questions
What is the first step in zero trust for a mid-sized manufacturer?
Build an inventory of every user, device and remote connection touching production, then enforce multi-factor authentication on all administrator and remote-access accounts. Both steps are low-cost and remove the most common attack paths.
Can zero trust work with legacy PLCs and SCADA systems that cannot be patched?
Yes. Rockwell Automation and Dragos note that legacy systems often lack the needed controls, so you apply zero trust around them using segmentation, jump hosts and strict allow-lists rather than software on the device.
Will zero trust slow down production?
Not if it is phased. Start with identity and remote access, then run segmentation rules in monitor mode before enforcing them, and schedule changes in planned maintenance windows.
Does zero trust help with cyber insurance?
It can. Gartner’s summary projects premium increases of 15-20% in 2026, and insurers increasingly ask about controls such as multi-factor authentication and segmentation. Confirm specifics with your broker.
Do we need a consultant or managed provider?
Not necessarily. Mid-market firms often have just enough IT staff to run the basics, but an OT-experienced partner is worth considering for segmentation design and plant-floor testing.
Which standards should we follow?
NIST SP 800-207 for zero trust architecture and IEC 62443 for industrial control system security. Use them as a checklist, not a mandate to do everything at once.
