When security gets in the way of production
One thing I hear regularly from manufacturing and logistics clients is that security is getting in the way of the work it is supposed to protect.
A control can make perfect sense to the IT team but be much harder to live with on the plant floor. A connection gets blocked. A device stops communicating. Data doesn’t reach the person who needs it. An engineer can’t get the access they need. A routine request is rejected because it looks too risky.
That’s when the tension becomes obvious. Operations sees security as a barrier to getting the job done. IT sees operations asking for exceptions that could increase the company’s exposure.
And when neither side can make the call, the issue gets pushed upwards, often to senior leadership.
From my conversations with manufacturing and logistics organisations, that’s usually a sign of a bigger problem. It means cyber security decisions are not being made with enough understanding of how production and warehouse operations actually work. Closing every door may appear to be the safest option, but it can also prevent the business from functioning as it should.
Why security and production pull in different directions
Manufacturing plants and logistics operations are complicated, connected environments. Production equipment, warehouse management systems, scanners, maintenance systems, dashboards, customer integrations, business applications and third-party services all need to work together. And they often need to work continuously.
The cyber threat is real too. IBM’s 2026 X-Force Threat Intelligence Index found that manufacturing accounted for 27.7% of the incidents observed, making it the most targeted industry for the fifth year running.
But a control that looks sensible from a corporate IT perspective can have a very different effect on the plant floor.
For example, blocking a remote connection might reduce cyber risk but leave a maintenance engineer unable to access the diagnostic data needed to restart a production line. In a warehouse, a tightly controlled device policy might prevent scanners from reconnecting to the warehouse management system after a software update, slowing order fulfilment while the team waits for IT approval.
IT has a responsibility to reduce exposure, meet compliance requirements and prevent incidents. Operations has to keep production moving, while managing output, quality, safety and continuity.
The problem comes when each side assesses risk from its own perspective, with little structured communication between departments and no shared process for weighing cyber exposure against operational impact.
Why senior leadership can end up making the call
When IT and operations sit in separate parts of the organisation, their first common decision-maker may be a senior leader. That can make sense for a major investment or a significant business risk, but it doesn’t make much sense for everyday questions about access, connectivity, architecture or operational risk.
When disagreements move upwards through the management chain, senior leadership is presented with a choice: accept more cyber risk, or accept the operational impact. Neither is a particularly good choice. Both result in slower decision-making and more uncertainty over who owns the risk. The aim should be to resolve most of these issues long before they reach senior leadership.
For organisations covered by NIS2, there is another reason these questions move upwards. Article 20 says management bodies must approve cyber security risk-management measures and oversee how they are put into practice. That makes senior leaders accountable, but it shouldn’t mean every day-to-day decision lands on their desk. In Belgium, the Centre for Cybersecurity Belgium’s CyberFundamentals Framework, or CyFun, can also give organisations a practical starting point for deciding which measures they need.
Put a practical decision layer in place
Manufacturing and logistics organisations don’t need another large committee. They need a practical forum where the right people can assess cyber and operational risk together and make a decision. That could include IT security, plant or warehouse operations, engineering or OT, maintenance, quality and compliance, depending on the issue.
The key thing is that these people understand both sides of the problem and have enough authority to make a decision.
The conversation needs to move away from: “Can we allow this?” to: “What are we trying to achieve, what is the risk, and what is the safest practical way to do it?”
That is a much more useful conversation.
Six ways to make cyber security work for the plant and warehouse
Start with what the plant needs to achieve
Before discussing the control, understand the outcome. Does an engineer need remote access? Does a new device need to connect? Does production data need to be available somewhere else? Does a line need to keep running?
Starting there changes the conversation. You are looking for a safe way to achieve the outcome, rather than simply deciding whether to approve or reject a request.
Look at operational and cyber risk together
Cyber risk is only part of the picture. You also need to consider downtime, lost production, delayed maintenance, safety and quality. Honeywell’s September 2026 OT Cybersecurity Benchmark Report found that respondents reported an average of 16.2 hours of downtime from their most significant OT cyber security incidents.
But the same principle works in the other direction. A security control that creates significant operational risk needs to be looked at just as carefully. On the plant floor, there is little room for ambiguity: the scanner connects, the maintenance data arrives and the line keeps moving, or the process slows down. Honeywell found that 21% of incident-affected respondents estimated downtime costs above $100,000 per hour, including 4% who put them above $500,000 per hour. The question is not simply “Is this secure?” It is “Is this the right level of risk for the business?”
Be clear about who can make the decision
Not every security decision should need senior executive approval. Be clear about what can be decided at site, functional and executive level. If an exception has agreed safeguards and sits within an established risk threshold, the people closest to the issue should be able to make the call. It also helps to agree standard approaches in advance, such as one way to manage vendor remote access or onboard a new device. That way, teams don’t have to reopen the same discussion every time. Save escalation for decisions with wider business, regulatory or safety implications.
Look for practical alternatives
Sometimes the ideal security control simply isn’t practical in a production environment. That doesn’t mean the answer has to be no. There may be other options: segmented access, time-limited permissions, stronger authentication, additional monitoring or a controlled maintenance window. IEC 62443 gives IT and OT teams a useful way to talk about this. Systems with similar security needs can be grouped into zones, with clear rules for how information moves between them through conduits. That makes segmented access more concrete. The goal is to reduce the risk without stopping the work.
Measure whether security is helping
It’s easy to measure vulnerabilities, incidents and blocked attempts. But I would also look at what security is doing to the operation. How much downtime is linked to security controls? How many exceptions are being requested? How long do approvals take? How often do the same issues get escalated? Those measures tell you something important: whether security is helping the plant become more resilient, or creating new friction that someone else has to manage.
Design for limited capacity
Capacity matters too. Strict security requirements can consume scarce network, security and engineering time, especially when teams support many systems across different sites. People can end up assessing the same kinds of requests again and again, or working through large volumes of logs to find the alerts that really matter. Standard approaches, reusable controls and sensible triage can help teams focus their time where it has the most value.
Automation and AI can help with jobs such as sorting logs or checking proposed changes. But they are only useful when they are well governed and working with complete, accurate data in the right context.
Security and productivity are not opposing goals
From the conversations I have with manufacturing and logistics organisations, I don’t see security and operations as two sides that need to win an argument. They’re trying to protect the same thing: a business that needs to keep operating.
Less security is obviously not the answer. Nor is it to put more and more controls around production and logistics operations without considering how they will work in practice. It’s to make better decisions together. When IT, security and operational leaders understand each other’s priorities, have a practical way to balance risk and have the authority to make decisions at the right level, fewer issues need to reach senior leadership.
And security is much more likely to do what it is supposed to do: protect production, rather than get in its way.
Break down silos with Total Quality
Resillion’s Total Quality approach brings teams together to provide a more integrated approach to assurance.
In one logistics engagement, we joined up quality engineering, performance, OT and cyber assurance across a connected ferry-services environment. That gave different parts of the business a shared view of risk and how the operation worked as a whole, rather than assessing each area in isolation. We take the same approach with manufacturing, transport and logistics organisations: adding specialist capacity and joined-up assurance while the client’s own team retains ownership.
Speak to a sector expert about putting Total Quality into practice.
