Michael Bannach
Second shift, a little after nine at night. The lead on the laser cell goes to pull the next program from the shared drive and the folder is full of files with a strange extension and a text file he has never seen before. He opens it. It is a ransom note. He walks over to the office, where the ERP screen on the scheduler’s desk is frozen, and calls the owner at home.
By the time the owner gets to the shop, the file server, the ERP server and eleven of the fourteen office PCs are encrypted. The CNC machines are fine, because they are still running the programs that were loaded that afternoon. But the next job’s program is on the server, the job travelers are on the server, the drawings are on the server, and the quality records the customer will want with the shipment are on the server. Nothing ships tomorrow. Probably nothing ships this week.
The IT provider, reached at 10:40, asks when the backup was last tested. The owner asks what the provider means by tested.
How it got in, and why the shop floor made it worse
Nobody at the shop clicked anything unusual that day. The way in was a workstation in the back that runs the software for an older piece of inspection equipment. The machine builder stopped supporting new operating systems years ago, so the PC still runs the version it shipped with. It cannot be patched. It had been on the office network since the day it arrived, because that was easier than running a separate cable, and it had a remote access tool on it that a vendor technician had installed during a service call and nobody had removed.
That is a familiar inventory at a fabrication or machining shop. The production equipment lasts twenty years. The computers attached to it last as long as the equipment, which means a shop of forty people can have three or four machines on the floor running operating systems that have not seen a security update in a decade. Those machines are not the problem by themselves. The problem is when they sit on the same network as the file server and the ERP, with nothing between them. An attacker who reaches the old inspection PC can see everything else, and from there it is a short walk to the server where the whole business lives.
Three decisions that would have changed the night
Put the production systems on their own network. Industrial PCs, CNC controllers and the inspection station do not need to reach the internet or the office file server directly. They need to receive programs and send results, and that can be done through a controlled path. Segmenting the plant floor from the office means the old inspection PC can stay old, because the only path off it is one you control. It is one of the most important changes a manufacturer can make, and it can be done without shutting down production if whoever does it maps the dependencies first and schedules the work between shifts.
Keep a copy of the business somewhere the ransomware cannot go. The shop had a backup. It was a drive attached to the file server, and it was encrypted along with everything else. A backup that protects a manufacturer has a copy off the network, is taken often enough that a nine o’clock event does not lose the whole day’s travelers and quality records, and has been restored as a drill so someone can say how long it takes to bring the ERP back on different hardware. That number is what decides whether the shop ships on Thursday or in three weeks.
Know who is on the network. The vendor’s remote access tool is the detail that turns a bad night into a long one. Every manufacturer has outside parties who need access to something: the machine builder, the ERP consultant, the payroll service, the customer’s quality auditor. Each of those should have a named account, a second factor to log in, and a date when the access is reviewed and removed. A tool a technician installed during a service call two years ago, on an account nobody owns, is not access. It is an open door with the shop’s name on it.
What the week looks like at a shop that did the work
The ransom note still appears, because no control is perfect. But it appears on one machine in a segment that cannot reach the servers, and the monitoring that watches the shop around the clock sees the encryption start and isolates the machine before it finishes. The office PCs and the ERP are untouched. If the worst happens and a server is hit anyway, the owner knows there is a copy in the cloud from an hour earlier and that the last restore drill took under an hour. First shift loses a morning. The customer’s quality records go out with the shipment on Thursday.
A thirty-eight-person metal fabrication shop we work with started from the other side of this story: passwords shared informally, laptops not encrypted, no formal backup plan, no multi-factor authentication and no training. What moved them was a lost opportunity rather than an attack, when a prime contractor asked for documentation the shop could not produce and the subcontract went elsewhere. We ran a readiness assessment, put MFA on email and remote access, put patching and antivirus in place, set standard access and device policies, moved the sensitive files into Microsoft 365 with access control and cloud backup, wrote short policies the staff could actually follow, trained everyone, and met with leadership weekly. They passed their CMMC Level 2 assessment in July 2026 and won a multi-year defense contract. Their operations manager said it best: “We didn’t want another vendor. We needed a partner. And that’s exactly what we got.”
Three questions for whoever runs your IT
- Which machines on our floor are running operating systems that can no longer be patched, and what sits between them and the ERP?
- When did you last restore our ERP and file server from backup as a test, and how long did it take?
- Can you send me today the list of every outside party with remote access to anything in this building, and when each one was last reviewed?
A provider who manages manufacturers answers the first with a drawing, the second with a date and a number of minutes, and the third by the end of the day.
How we handle it for manufacturers
Our work with manufacturers starts with a walk through the plant. We tour the facility, map which systems depend on which, and schedule every change around shifts and ship dates with a rollback plan for anything that touches production. We support the industrial PCs, CNC controllers and production-line networks as well as the office, and we segment and protect the production systems without disrupting output. Monitoring runs across every site around the clock, with on-site technicians when something needs hands. For shops that supply primes, the same work produces the evidence those customers ask for, including a current self-assessment score and a plan of action, so the next documentation request is a file you already have rather than a scramble.
If you want a plain read on where the shop stands, the three-minute IT and security scorecard turns your answers into a written roadmap, and the conversation after it is free. You can also read more about how we work with manufacturers.
