Hexagon recently unveiled its annual report on the state of U.S. manufacturing. The findings show a disconnect between how connected manufacturers believe their operations are, and how effectively data actually moves across design, production, quality and business systems. The study also shed light on the harsh realities of how secure all of this data really is. Some key findings included:
- 77 percent describe their operations as connected, but only 40 percent have fully connected data across the organization.
- 67 percent lack a unified view of operational data.
- 85 percent face barriers to increasing automation, including cybersecurity concerns, and difficulty demonstrating cost and ROI.
I recently sat down with Hiren Kumbhojkar from Hexagon Manufacturing Intelligence to discuss some of the key themes highlighted by the report.
Jeff Reinke, editorial director: Given the high number of manufacturers that believe having cybersecurity controls in place is critical, why do you think asset visibility continues to be an issue?
Hiren Kumbhojkar: Manufacturing environments combine long-lived OT equipment, newer connected systems, software, and increasingly cloud services. Many assets were never designed to provide a complete digital inventory, so organizations often lack a continuously updated view of what is connected, what software is running, and where the vulnerabilities are.
In short, manufacturers believe in cybersecurity, but asset visibility is a continuous operational discipline, not a product purchase. It depends on legacy-safe discovery, cross-functional ownership, and linking network data with the engineering and maintenance context. Organizations that treat it as an ongoing process tied to asset management, rather than a one-time security project, tend to close the gap.
JR: What barriers are manufacturers facing when introducing more cybersecurity tools or strategies?
HK: Manufacturers find it hard to add cybersecurity tools because production uptime and legacy, vendor-locked equipment limit what can be changed, OT security skills are scarce, and IT and OT don’t share ownership. On top of that, ROI is hard to prove while the true costs are high, networks are flat and tools don’t integrate, and there’s often no clear framework-based roadmap.
Basically, the main barriers are legacy systems, integration complexity, cost and a shortage of specialist skills, and all of them are made harder by the need to keep production running. Manufacturers also must balance security improvements with availability: a control that is straightforward in IT may be difficult to deploy on a production system that must run continuously and has a long lifecycle.
JR: What role is AI playing?
HK: AI strengthens both sides. Defenders can use it for faster threat detection, vulnerability analysis, anomaly detection, and automation. At the same time, attackers can use AI to scale social engineering, discover weaknesses, and automate attacks.
The practical implication is that AI output and AI agents need the same disciplined security controls as other software: clear identities, least privilege, controlled access, auditability, and human oversight where consequences are significant. Another aspect is the role of AI generated deepfake voice or video used for payment or supplier fraud. These are real threats that are often downplayed.
JR: The human factor is a big part of cybersecurity. Are there any strategies you've seen that work better in helping employees play a larger role in keeping an organization secure?
HK: Make security part of normal work rather than an annual compliance exercise. Short, role-specific training, realistic phishing or social-engineering exercises, simple reporting mechanisms, and a culture in which people report mistakes quickly are more effective than relying only on policies.
Employees should understand not just what the rule is, but why it matters in their daily work. There are still more people plugging USB sticks of unknown provenance into their laptops than it should.
The common thread is to make secure behavior easy, relevant to the person’s job and positively reinforced, and build it into existing routines like safety meetings and shift handovers rather than adding it as a separate compliance task.
JR: What advice would you offer on how to share data more efficiently and securely?
HK: Start with classification and minimize what is shared. Give users and systems only the access they need, use approved platforms, encrypt sensitive data in transit and at rest, and retain an audit trail. For AI specifically, public, internal, and confidential information should be handled differently, and sensitive company data should only be used in appropriately approved enterprise environments.
In a nutshell, classify the data, move it through governed, brokered and encrypted channels with least-privilege identity-based access, and share only what’s needed, so that the secure path is also the easiest and fastest one.
JR: Are there any major trends you're watching that could have a significant impact in the next 12-18 months?
HK: I would watch three areas: AI becoming part of both attack and defense at scale; increasing cybersecurity obligations for manufacturers and software products, including the EU Cyber Resilience Act; and the growth of connected and agentic industrial systems.
As software and AI gain greater access to production data and actions, identity, least privilege, secure-by-design development, software-component visibility, and auditable human control will become increasingly important. As AI is becoming increasingly used by end-users to build their own integrations, it creates a new form of shadow IT.
For example end users can now develop an MCP server, but can they effectively ensure its reliability, maintenance and security. Overall, the next 18 months reward manufacturers that get their asset visibility, vulnerability handling and incident reporting processes regulator-ready, govern AI adoption, and harden identity and third-party access.
