Securing connected production with OT security

Connected production systems enlarge the attack surface for cybercriminals, and AI-powered tools shorten the time between the publication of a vulnerability and its exploitation to just a few hours. At the same time, NIS2, the Cyber Resilience Act and the Machinery Regulation are tightening the requirements for operators, machine builders and manufacturers. Mid-sized industrial companies in particular need clear procedures to capture assets, risks and regulatory obligations.

The challenge: connected production increases security risks

For a long time, production systems were largely closed technical systems. They ran for many years and industrial controllers were renewed only very rarely. Changes to a working system were the exception. This classic model fits less and less with today's industrial production, because industrial systems (operational technology, OT) are increasingly converging with IT or IoT applications and external services.

Larger attack surface and regulatory pressure

This creates a need for communication and networking that ultimately increases the attack surface. At the same time, new legal requirements are tightening the demands on operators, integrators and manufacturers, including in OT security.

• The NIS2 Directive obliges companies in 18 sectors to take measures on cybersecurity, risk management and the reporting of security incidents. It already applies to companies with 50 or more employees or 10 million euros in revenue. Violations can lead to heavy fines, and management is liable for implementation. In addition, the CER Directive strengthens the resilience of critical entities, for example in energy and transport.
• The Cyber Resilience Act (CRA) governs the cybersecurity of products with digital elements across their entire life cycle. Since 11 September 2026, manufacturers have had to report actively exploited vulnerabilities, and all requirements apply from 11 December 2027.
• For machine builders, the decisive regulation is the EU Machinery Regulation, which applies from 20 January 2027. Among other things, it requires control systems to be protected against manipulation. This makes the CE marking a security issue as well: without adequate protection, a machine may no longer be sold in the EU.

Then there is a new factor: artificial intelligence. Manufacturers are obliged to publish vulnerabilities in their products. Automated AI agents now read these reports and try to generate attacks from them on their own. According to WAGO's security experts, this often succeeds in less than an hour. Companies therefore no longer have weeks or days to close known gaps, but often only hours.

SMEs under security and resource pressure

Small and medium-sized companies in particular are coming under pressure as a result. They have to meet rising security requirements, even though they often have only limited staff and frequently lack sufficient know-how. They also lack large in-house IT or security departments.

This makes it clear that security questions are also economic questions. A key question, for example, is how long a production system may be down before financial damage occurs. After all, the failure of a conveyor belt, a CNC machine, a power supply system or building automation can affect manufacturing and the ability to deliver.

The solution: introducing OT security as a continuous process

The company uses its experience as a manufacturer of automation and interconnection technology to build vendor-independent consulting on secure production environments. The consulting can then be supplemented by technical implementation, continuous monitoring and further security measures. This approach is particularly useful for mid-sized industrial companies.

From gap analysis to continuous monitoring

The consulting is based on the IEC 62443 series of standards, which is considered the gold standard of OT security. Laws usually only stipulate that companies must take “appropriate” care of security. The standard, by contrast, specifies requirements and responsibilities for operators, system integrators and manufacturers as well as four security levels. Today, security level 2 is usually the target; in a few years, level 3 is likely to become the benchmark.

WAGO uses a multi-stage security consulting approach that starts from the systems already in place at the company and takes the technical and regulatory context into account. The consulting ranges from analysis and recommendations to monitoring and technical implementation:

• The first step is a gap analysis. It shows which system is being considered, how it is structured and which requirements apply to it. The consultants then compare the current status with the normative and regulatory requirements. They check which rules apply to the specific use case and where there are deviations.
• This is followed by a detailed risk analysis that examines potential attack paths, analyzes vulnerabilities and describes the consequences of an attack. A typical example is an older CNC machine that still runs on Windows 95. There are no more updates for it, and replacing it does not make economic sense. Here, compensating measures must limit the risk. The decisive factors are what residual risk a company is willing to accept and what availability is required. The same system can have very different protection goals: if a public charging park for electric cars fails, that is annoying. If the fire brigade can no longer charge its vehicles, it is critical.
• Based on the results, the consultants develop a security concept with policies, alarms and measures. The technical implementation then integrates suitable hardware and software solutions into the OT environment. The consulting is vendor-independent, and existing control technology is usually not replaced. However, if the analysis shows that additional hardware is needed, WAGO can offer its own components as a solution. The consulting usually takes around ten person-days, spread over three to four months.
• Continuous analyses create additional transparency, as the task does not end after a one-off inventory. Networks change their structure, new devices are added, configurations are adjusted and new vulnerabilities are published. WAGO therefore recommends continuous monitoring. Companies can run it themselves or hand it over to WAGO. If required, WAGO assesses conspicuous events together with the customer and derives new recommendations from them.

WAGO's advice is not just theoretical. As a manufacturer, the company falls under the Cyber Resilience Act, and as an operator, it is itself subject to NIS2. WAGO's Chief Information Security Officer (CISO) works closely with the consulting team and also accompanies customer meetings when needed. A consulting project on building automation is also currently under way on WAGO's own campus in Minden.

Network transparency as the foundation

WAGO also offers the network analysis as a one-off network-based risk assessment. Typical findings are unencrypted FTP connections over which user names and passwords are transmitted in plain text, unnecessarily open ports or a Wi-Fi access point nobody knew about. Malware such as WannaCry, which spread through networks via SMB shares, would also have been noticed early by the anomaly detection, because it creates new, atypical communication relationships.

Network Sight also supports asset and vulnerability management. The solution matches information on known vulnerabilities, attack patterns and signatures with the detected assets. Changes to configurations or firmware as well as edge devices being switched on and off are also monitored and logged. Three further tools complement Network Sight:

Container management automates updates

Portainer handles container management and serves as a tool for deployment and patch management. New containerized applications and security updates, for example for Codesys applications, are distributed to the devices automatically. The software also runs on smaller WAGO devices. This makes it possible to extend container management all the way to the control cabinet.

This is not only about efficiency but also about security: any form of software distribution can itself become an open interface. Portainer enables controlled, secure deployment. In view of AI-powered attacks that exploit known gaps within hours, an automated update process is indispensable. Portainer is one building block of a holistic solution: each company still has to establish the organizational processes around updates and security itself.

The result: more transparency and resilience in production

WAGO's consulting approach turns an OT security situation that is often hard to keep track of into a structured process that can be managed on an ongoing basis.

• The consulting creates clarity about which assets exist, which regulatory requirements apply, where security gaps exist and which risks arise from them. On this basis, companies can prioritize measures according to their actual criticality.
• Another result is greater transparency in industrial networks. Assets, protocols and communication relationships become visible automatically, and a model of normal network behavior is created. This makes unexpected devices, open connections, configuration changes or malicious communication patterns easier to spot.
• Continuous monitoring extends this snapshot into ongoing control. New communication relationships and other anomalies are detected. In addition, information from several sites or network segments is brought together. This creates a central view of alerts and security data.
• At the application level, Portainer removes a typical bottleneck: software updates no longer have to be installed manually on every edge device, and known vulnerabilities can be closed faster. This enables companies to turn OT security from selective protection into a permanent part of production operations.