Manufacturing has ranked as the most targeted sector for ransomware attacks four years in a row and the pressure is intensifying. Manufacturers now face roughly 1,585 attacks per week, a figure that has climbed 30 percent year over year. These incidents are part of a sustained campaign against an industry that attackers see as both accessible and high value.
Most security efforts still focus on plant-floor systems and internal infrastructure. Attackers are getting around them by using third-party relationships to gain access, then moving across connected systems where detection is slow, and response is even slower. Breaches will continue to increase until manufacturers redirect their attention to where risk actually exists.
The Door Was Already Open
Modern manufacturing depends on an ecosystem of vendors, suppliers, and service providers. Every one of those relationships involves some degree of access to systems, networks, or sensitive data.
Consider what happened to Volvo Group North America in 2025. The commercial truck and equipment manufacturer confirmed a breach traced back to Conduent, a third-party business services provider in its network. Attackers gained access to employee names, Social Security numbers, health insurance data and medical information. Volvo's own infrastructure was never directly compromised.
Volvo’s story isn't unique. Across manufacturing, vendors and contractors at every tier of the supply chain create the same risk: access into larger organizations with fewer controls around it. Smaller partners often don’t have the same security resources, and that exposure goes unmonitored. Attackers don't need to break through a hardened perimeter when a trusted partner opens the door for them.
Connected by Design, Exposed by Default
Digital transformation has reshaped how manufacturing environments run, connecting IT systems with operational technology (OT) across the floor. This improves efficiency, but it also expands the attack surface.
With IT and OT tightly linked, attackers who get in face fewer barriers to moving deeper into the environment. Many of the IoT devices embedded across these operations are deployed and maintained by third- or fourth-party vendors. They often sit outside centralized risk programs, even though their technology is core to daily operations.
Deloitte found that while 90 percent of manufacturers say they have detection capabilities in place for cyber events, very few have extended that monitoring into OT environments. Many OT systems were built decades ago, and often no longer receive support or updates.
Modernizing them means taking production offline, which is downtime manufacturers can’t afford. The irony is that avoiding that disruption creates a far worse one. When ransomware reaches these systems, production stops anyway, orders go unfulfilled, and the damage spreads fast through every operation connected to them.
A Different Kind of Defense
Knowing where the threat lives is only useful if it changes how organizations respond. A mature third-party risk program puts that into practice through the following steps:
- Start with your vendor inventory. Know who your vendors are and who their vendors are. Start by mapping every relationship that touches your systems, including the indirect ones, to gain the visibility needed to make informed decisions about where risk lives across the supplier base.
- Treat cybersecurity as a vendor requirement. Evaluate vendor security practices before granting access and set expectations in contracts as a non-negotiable condition of doing business.
- Move from point-in-time assessments to continuous monitoring. A vendor that looked secure while onboarding may look very different a year later. Regular auditing and ongoing monitoring of third parties is what keeps programs current with how those relationships evolve over time.
- Use TPRM technology to scale what manual processes can't. Managing third-party risk across hundreds of vendor relationships can't be done through spreadsheets and siloed systems. A centralized, purpose-built platform consolidates risk data and processes into one place, giving teams the coordination and control needed to manage third-party risk across the extended enterprise.
- Make third-party risk a business priority. IT, OT, procurement and leadership all need shared accountability for managing vendor risk. When that responsibility sits with one team, critical gaps form across the others.
Ransomware continues to succeed in manufacturing because the threat has evolved faster than the programs designed to stop it. The steps above aren't complex. But they require an honest accounting of where risk actually lives across the full supply chain.
Manufacturers who get it right will build the kind of resilience that modern manufacturing demands: one that accounts for every vendor, every connection, and every system that stands between their operations and the next attack.
