As operational technology and information technology move toward each other in manufacturing and other industries, cybersecurity risks rise.
The rising risk and how it impacts Industry 4.0 development led the Northeast Wisconsin Manufacturing Alliance to host a cybersecurity gathering Sept. 23 at the Black Sheep event center in New Franken.
Industry 4.0 surveys conducted by the NEWMA show cybersecurity is among the biggest investments companies are making, according to NEWMA Executive Director Ann Franz.
But those investments have not always been well planned, said Thomas Freeman of Ghostscale, a Madison firm that provides cybersecurity training, education and services.
Freeman said the 2024 NEWMA survey results show that manufacturers invested more in cybersecurity than they did in anything else — including industrial Internet of Things (IoT), which brings machines and sensors together to collect operational data.
“Cybersecurity is a huge investment and yet … only 15% of them said they had a specified plan, a program, a way of managing it. The money has been spent, but there’s no clear plan,” Freeman said.
Gaps create vulnerabilities
Freeman said lack of a clear plan leaves gaps that make companies vulnerable to attacks.
Erik Cunningham, who has 25 years of experience in IT, said business leaders need to understand that the risks are not just an IT problem; they are operational threats.
Two out of every three industrial ransomware attacks are against manufacturers, largely because it can be lucrative. Some companies say they will just pay the ransom, but for many intellectual property is highly valuable and downtime is not affordable.
Freeman pointed to a ransomware attack in September 2025 against Jaguar Land Rover. It shut down the company for six weeks and cost the British economy £1.9B. It affected 5,000 downstream suppliers.
It leaves manufacturing cybersecurity experts searching for answers through industry frameworks and “patching” security solutions onto systems that might be out of date.
The vulnerabilities go beyond stealing data, according to Freeman. He said if someone can take over a piece of manufacturing equipment, they can stop production or, even worse, subvert the process to do real physical damage to people and products.
“We need to have connections in order for us to build our products, in order for us to be innovative and continue to grow,” Freeman said.
As a result, there is what Freeman called a “healthy tension” between security and operational needs.
AI applies more pressure
Just like companies can’t completely take machines and sensors offline, they also can’t ignore artificial intelligence.
“You’re going to have to use AI,” Freeman told attendees at the NEWMA event. In most cases, employees and competitors are already using it. He says people will find a workaround or way to use AI whether it is approved or not.
Freeman cited an AONA Enterprise Study in 2026 that shows 82% of the companies in the study have AI in use that had not been approved or secured.
“We need AI governance,” Freeman said, “and we need something that allows us to properly measure when is AI safe and when is it not.”
Vendors and supply chain
Supply chain and vendor risk management can be a challenge, according to Freeman. So can legacy equipment.
Some manufacturers may operate equipment with controls or data collection systems that can no longer be updated. Freeman said they sometimes solve the legacy equipment problem by isolating equipment or connecting it for short periods.
Joe LaChapell, chief technology officer of M2 Logistics, said he considers vendors to be a “petri dish” that will bring in whatever virus is out there and act accordingly.
“Supply chain risk management is a weakness we see over and over again,” Freeman agreed, adding that he advises companies to closely manage who has access to equipment and how they use that access. They also need to examine where the equipment was manufactured and who manufactured it.
Ideas and solutions
The Global Lighthouse Network helps frame solutions for manufacturers, according to Freeman. The network includes more than 150 companies that are recognized by the World Economic Forum for adopting advanced technologies.
A panel assembled by NEWMA also offered some insights on the day‑to‑day solutions they are implementing to address cybersecurity concerns.
Cunningham, who has worked in healthcare and hospitality settings, said the first step to seeking solutions for cybersecurity is to assess the situation.
“You need to know what you will solve,” Cunningham said. “You need to have visibility.”
Cunningham added that having a recovery plan in place is important as well.
Jason Schwoerer, senior manager of IT operations and security at Lakeside Foods, suggests translating the risks and opportunities into language that helps the rest of the team, from leadership to machine operators, make decisions and act within guidance.
LaChapell agreed with Schwoerer that the need to communicate is critical to finding solutions. He said there can be tension between operations and IT.
“So, IT going in and asking questions first to understand the business and understand the processes works wonders, instead of going in and [starting] to dictate controls,” LaChapell said.
Communication helps team members understand why they have to use laptops isolated from the network for certain updates or why some legacy equipment is only brought online for data collection for short periods.
Schwoerer said Lakeside has been able to move quickly to improve security because it has had buy‑in and he has been able to assemble a team that brings different skills together.
Lakeside has done that through incentivizing cooperation, and Schwoerer, who has a military background, created challenge coins that have driven adoption of security measures.
Finally, Freeman advised, “You need a risk committee; it allows you to identify risk at an enterprise level.”
