Why industrial sites, and not someone else

In IBM’s X-Force data, manufacturing has been the most attacked industry three years running. That is a statement about volume. The more useful question is why industrial sites in particular, because there are two answers, they come from different attackers, and they call for different defences.

Reason one: because it pays

Ransomware is a business, and industrial targets are good business.

When an office network is encrypted, the company loses access to its data. It hurts, it is recoverable, and the clock runs in days. When a production line stops, the company loses output per hour, and the cost is on a spreadsheet by lunchtime. Perishable product spoils, a batch in progress may be lost entirely, and delivery penalties start to run. In regulated manufacturing, restarting is not a matter of pressing a button either: it may need an investigation, deviation handling, sometimes requalification.

A stopped line pays faster than a stolen database. Ransomware groups understood that years ago, which is why they invested in tooling that reaches manufacturing environments.

The consequence deserves to be said plainly: the attacker does not need to touch a single PLC. Encrypting the MES, the historian and the recipe server stops the line just as well, and it takes nothing more exotic than the commodity ransomware used against a law firm. Most industrial ransomware incidents look exactly like that: an IT attack whose consequences happen to be industrial.

Reason two: because it is strategic

The second attacker has no interest in a payment.

In a modern conflict, factories, energy, water and logistics are treated as targets of strategic value, and state-backed groups act accordingly. They gain access to industrial networks and then stay there, quietly, without doing anything visible. This is called pre-positioning. The aim is not damage today but the option of causing damage at a moment of their choosing.

That is a very different problem. There is no ransom note, no encrypted file, no outage, nothing that makes anyone look. When the intrusion is found at all, it is because someone examined traffic that had no business being there, and on a network with no baseline of normal traffic, nobody can tell.

The World Economic Forum’s Global Risks Report 2025 ranks cyber espionage and warfare fifth among global risks over the next two years, a category about states and their proxies rather than ordinary crime.

Why the distinction matters

A control that works well against one of these attackers does very little against the other.

Against the ransomware economy, the controls that work are the unglamorous ones: offline, tested backups; segmentation so that an IT compromise does not reach production; controlled remote access; a restore you have actually timed. Success is measured by how fast you come back.

Against a pre-positioned actor, backups do not help, because nothing has been destroyed. What works is visibility: an asset inventory, a baseline of normal traffic, and someone who actually looks at it. Success is measured by whether you would notice.

Most of the industrial sites we assess have a partial answer to the first threat and nothing for the second. That is understandable, since the first one announces itself and the second does not. It still means the site is defended against the attacker who would have told you he was there, and blind to the one who never will.

The question that changes

The question that still dominates management meetings is will we be targeted? In both cases it is the wrong one. Commodity ransomware is opportunistic, so you are already in the population. A strategic actor chooses according to geopolitics, not according to anything you control.

Two questions are worth asking instead: would we see it in time, and how long would it take us to come back. Both have measurable answers, and neither requires predicting an attacker.

References

• IBM, X-Force Threat Intelligence Index, 2024 edition: manufacturing the most attacked industry for the third consecutive year.
• World Economic Forum, Global Risks Report 2025, January 2025: two-year global risk ranking.