Make UK’s cybersecurity in manufacturing report puts recovery at the centre of factory planning.

Manufacturers face a decision that reaches beyond the IT function: can the business keep producing, shipping, and meeting customer commitments after a cyber incident? Make UK frames cyber resilience as an operational requirement for connected factories, where enterprise systems sit alongside operational technology, robotics, suppliers, logistics providers, and customer platforms.

The report’s data shows a mixed position. Seven in ten manufacturers said no cyber incident affected their operations in the previous year. Another 20 percent said they contained attacks before disruption occurred. Ten percent reported an incident with financial or business impact.

The reported outcomes place recovery planning, supplier assurance, and ownership of operational technology risk ahead of a narrow focus on perimeter defences.

Cybersecurity in manufacturing reaches the factory floor

Manufacturing carries a different exposure from organisations whose main concern is data availability. A cyber event can affect the systems that plan production, monitor equipment, manage orders, or coordinate logistics. Make UK names ERP and manufacturing execution systems as targets for ransomware, and identifies intellectual property theft as another concern.

Operational technology brings a further safety dimension. The report states that manufacturers should assess whether a cyber event or an unauthorised configuration change could create a hazardous situation. If it could, the organisation must treat it as a machinery safety issue as well as a cyber risk.

That requires joint ownership. Engineering, maintenance, production, IT, health and safety, procurement, and senior leadership all hold parts of the response process. The report says governance should set approval routes for changes, define supplier system access, and establish how teams escalate risks. It should also specify how they assess production and safety effects during an incident.

Core controls remain widely deployed in the survey. Make UK found that 92 percent of respondents use firewalls, and 80 percent use malware protection. Secure configuration reached 67 percent, followed by access control at 61 percent. Patch management sat at 36 percent.

The gap matters in operational settings because long-lived industrial equipment may connect to newer business platforms, cloud services, and remote monitoring tools.

Organisations need to identify which equipment and supporting platforms would stop production if unavailable, then establish who can approve changes and reconnect systems after an incident. The report recommends mapping machinery, platforms, service providers, and supply chain dependencies.

Supplier incidents extend beyond the breached company

The report puts supply chain exposure alongside direct attacks. 67 percent of manufacturers reported no financial effect from a supplier cyber incident over the past 12 months. Ten percent reported financial or business impact, and 20 percent said mitigations avoided an effect. Two percent preferred not to say.

For companies affected by a supplier incident, delays to customer deliveries and reduced production capacity each reached 31 percent. Supplier delivery delays affected 23 percent. The same proportion reported shortages of components or materials. Logistics or scheduling disruption reached eight percent, as did higher costs from actions such as expedited shipping or alternative sourcing.

The supplier relationship now carries assurance duties in both directions. Make UK found that 25 percent of manufacturers had received a customer request to demonstrate cyber security compliance. 23 percent had asked suppliers for comparable assurance. Most had not introduced those requirements: 70 percent had not received a customer request and 71 percent had not requested assurance from suppliers.

Leadership teams should establish which suppliers provide components, software, logistics, or remote services needed to sustain production. The report does not prescribe a common questionnaire or contractual model. It does, though, make a direct recommendation to map supplier dependencies and assess their ability to interrupt operations.

Make UK also cites two wider incidents to show the reach of digital disruption. Marks & Spencer reported cyber-related costs of around £131 million in 2025, following disruption that included a 46-day suspension of online clothing and home orders. The report describes effects on fulfilment, store availability, logistics, and customer service.

Stryker Medical faced a global network incident that affected operations, shipping, distribution, and production, according to the report. NHS England, the Department of Health and Social Care, and NHS Supply Chain worked with the company to manage UK supply risk. NHS England’s public update did not confirm a financial cost.

Downtime drives the reported cost

Make UK estimates the direct financial impact for an affected manufacturer at about £28,000 per cyber incident. The report calculated that figure from the midpoints of its survey cost bands. It calls the number conservative because the top band ends at £100,000 and excludes indirect effects, including lost production and reputational damage.

Cost bands varied. 36 percent of affected firms reported costs up to £10,000. An equal share fell between £25,001–£50,000. 14 percent reported £10,001–£25,000, and the same percentage reported £50,001–£100,000.

The business effects reported most often were increased operational costs and production downtime, each cited by 46 percent of affected companies. Supply chain disruption, data loss or breach, and ransom demands all reached 15 percent each. Eight percent reported lost output or reduced capacity, as did organisations that faced customer-order delays.

No neat separation exists between cyber recovery and continuity planning in those results. A factory recovery exercise needs to test the return of production schedules, order management, logistics coordination, and customer commitments, as Make UK recommends. Restoring an endpoint fleet alone does not answer whether the business can resume production.

Governance and testing remain uneven

The report shows more progress in preventative controls than in formal preparedness. 51 percent of respondents said they have internal incident response or recovery processes. 45 percent assigned cyber security responsibility to a senior leader. 42 percent define cyber roles in policy, and 39 percent discuss cyber security regularly at board or risk meetings.

Only 23 percent said they have a CISO. Make UK also found that 11 percent reported none of the surveyed preparation arrangements. 64 percent have internal or external support to recover from a major attack. Employee training reached 56 percent, and 52 percent reported a cyber resilience strategy or incident procedure.

Confidence does not substitute for evidence. 38 percent described themselves as very confident in their cyber preparedness, with 36 percent only moderately confident. 15 percent were slightly confident. One percent were not at all confident, and 10 percent were extremely confident.

The report identifies affordability and awareness as the leading barriers to improvement, with each cited by 32 percent of respondents. 23 percent said available products or services do not fit their business. 18 percent cited providers’ limited understanding of manufacturing operations.

Make UK points organisations to NCSC resources including the Board Toolkit, Cyber Security Code of Practice, Early Warning service, and Exercise in a Box. It also directs industrial control system teams towards the ICS Community of Interest.

The report recommends that manufacturers test how production, orders, logistics, and customer commitments return after an incident, rather than treating incident response as a document-only exercise.

See also: IT/OT convergence brings OT security into ServiceNow

Want to learn more about the IoT from industry leaders? Check out IoT Tech Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events including AI & Big Data Expo and the Cyber Security Expo. Click here for more information.

IoT News is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.