Unpopular opinion: the biggest risk in your factory is the gap between IT and engineering.
It is 3.07am and a production line has stopped. Is it a fault, a hack, or both?
The operator can't restart it and the screens show a communications fault. They ring the on call engineer, who thinks it looks like a network problem. The engineer rings IT, who point out that the plant network isn't theirs, they only look after the office. Nobody is being unreasonable. Nobody has a current drawing of what is connected to what.
Half an hour in, nobody can say whether this is a fault, an attack or both, and nobody is quite sure whose job it is to find out. Someone is woken up to connect in remotely and reboot the equipment. To get the line running again, a process interlock is forced in the PLC so it will start.
By morning the line is running. Nobody can say for certain what happened, who connected, what was changed or whether that interlock was ever restored.
This is a story based on actual calls we have received in the middle of the night. If it sounds familiar, you already know the problem.
The problem is the join
The biggest risk in that story isn't a lack of care, a missing tool, or support. It is the gap between Information Technology (IT) and Operational Technology (OT), and more precisely, how the network is set up where the two meet. The point where the office network joins the plant network is often undocumented and unplanned, has grown quite complicated over many years, and has no owner. Each side guards its own patch, and nobody looks after the seam between them.
That gap exists for the following reasons:
They really are different. Different systems, different protocols, different language. IT talks about patching and endpoints. Engineering talks about PLCs and interlocks. Many industrial protocols, Modbus being the classic example, were designed for closed networks and have no security built in.
They have different priorities. IT ranks confidentiality first, then integrity, then availability. In OT it flips, with safety first, then availability, integrity and confidentiality, as NIST SP 800-82 sets out. A reboot that is basic hygiene in an office can stop a line or disable an interlock. Engineers work to rules such as PUWER and IEC 61508, and change control exists for a reason. That is why they distrust changes from IT, and why they are right to.
They have different histories. Plant equipment is bought over decades from different vendors and runs for 15 to 25 years, while IT refreshes every three to five. The two also report to different people. IT usually sits under finance, whilst engineering sits under operations. In an ESET survey, only 22% said cyber accountability had moved up to the board, while 55% said it was still with IT.
Everyone is selling a quick fix: On top of that, the industry keeps selling point tools. A firewall here, an EDR agent there. Tools matter, but they don't add up to resilience if nobody owns what sits between them.
What is changing?
In late summer 2025, Jaguar Land Rover was hit by a cyber attack and production stopped for about five weeks. The Cyber Monitoring Centre put the cost to the UK economy at about £1.9 billion, the most damaging cyber event in UK history. That is the cost to the economy, not JLR's own loss.
What stands out is who else stopped. JLR stopped placing orders, and its suppliers had nothing to build. Four suppliers temporarily laid off roughly 6,000 staff, and the SMMT said up to a quarter of suppliers had paused work or cut jobs. These were not the businesses that were attacked. They were tied to someone who was.
That is why supply chains are becoming the focus. Customers are pushing security requirements down to their suppliers, and many manufacturers are looking at shorter, simpler chains after Ukraine and other shocks. A simpler chain has fewer links to break, but it also has fewer fallbacks, so one stopped plant hurts more. Make UK found that 30% of manufacturers had an incident either directly or through a supplier.
Regulation is pushing the same way. The EU's NIS2 directive doesn't apply to the UK directly, but it requires in scope EU businesses to manage supply chain risk. That means security questionnaires, contract clauses and audit rights flowing down to UK suppliers. If you sell into the EU, expect those requests to arrive.
Insurance is catching up too. Almost a third of manufacturers had no cyber cover or weren't sure whether they had it, and insurers want evidence of basic controls such as MFA and tested backups, not just a tick in a box.
It is not just cyber, it is continuity
Most of this gets filed under cyber. It is really a story of cyber and business continuity. Whether the cause is an attack, a failed switch or a supplier's remote session gone wrong, the questions are the same. Who can isolate a line, and can they do it without ringing three people? How long does recovery take if the network is the problem? What is the manual fallback if the screens go dark?
Most plants can't answer those quickly. Make UK found that only 51% of manufacturers have a formal incident response plan. ESET found that 78% of UK manufacturers had a cyber incident in the past year, and more than half of those hit lost revenue.
Unplanned downtime costs UK manufacturers an average of about £5,100 an hour, ranging from under £500 at smaller firms to over £10,000 at larger ones. For a smaller manufacturer the hourly figure is modest. The real cost is the customer who walks.
Isolating a line is a business and safety decision, not a technical one. It needs to be agreed in daylight, with engineering in the room, not made badly at 3am.
Run that night again
Now picture the same night in a plant where the IT and OT network is understood, configured properly and has controlled remote access.
Same line, same time, same fault on the screens. This time there is one agreed escalation, so the engineer and IT are on the same call within minutes, looking at the same network map. Nobody argues about whose problem it is. Because they know what is connected and what normal looks like, they can tell quickly whether it is a fault or something on the network. The supplier connects through a managed route with named access and a record of who did what, and a named person has the authority to isolate the line if needed. The line restarts with its protections intact.
None of that needs a miracle product. It needs the seam to be understood and owned.
The biggest risk in your factory is the gap between two good teams, and it has no owner yet.
Why we work with Hale Engineering
Over the past few months, we have started working Hale Engineering. Hale's expertise is the plant, covering control systems, automation and machine safety. Arlio's expertise is the IT side, covering managed IT, cyber security and Microsoft 365. Neither of us can see the whole seam alone, which is why we work together.
Hale has written a similar article on the same subject from an engineering perspective, and it is worth reading alongside this one.
Next steps
If you want to find out where your own seam sits, the Hale x Arlio Joint Discover Asset Connectivity Baseline Service is where to start.
Over three to four weeks, Hale's engineers walk the plant while Arlio reads the network, and together we reconcile the two into one evidenced record covering every OT and IT asset, how the office and the plant connect, and every route in, including suppliers. It is read only and passive, so nothing on the plant floor is changed.
You get one team, one report and the facts you need before anyone decides what to fix.
Scott
Managing Director
Comments