As cyberattacks increasingly adopt AI-driven techniques to exploit firmware and software vulnerabilities, a single weakness in one device can now be rapidly scaled across entire industrial deployments, with serious operational consequences.

The compromise of a single asset can trigger significant operational and economic disruption, with the recent JLR breach a prime example. Syed Zaeem Hosain, co-founder and chief evangelist at Aeris, argues that manufacturers can no longer afford to treat IoT security as a deployment issue; they must take responsibility for security throughout the entire device lifecycle.

The manufacturing sector has become one of the most targeted for IoT and operational technology (OT) attacks, where cyber incidents directly threaten production continuity and equipment integrity. In industrial IoT and OT environments, attackers may deliberately interfere with physical processes, for example, forcing motors to operate beyond safe limits and destroying bearings. In highly interconnected factories, weaknesses introduced through a single compromised device rarely remain isolated, increasing operational risk across entire production environments.

From overlooked risk to design priority

The industry is undergoing a fundamental shift, from treating security as an add-on to recognising it as both a commercial necessity and a regulatory obligation. With regulations such as the Cyber Resilience Act (CRA) and NIS2 coming into force, OEMs and IoT solution providers are being held accountable for how devices are secured, updated, and monitored long after they leave the factory floor. Siloed security models, where devices, networks, and applications are treated in isolation, are exposing organisations to avoidable operational disruption and compliance risk.

For many years, IoT and OT security was overshadowed by traditional corporate IT security. That approach no longer reflects the reality of modern manufacturing operations. Escalating threats, combined with regulatory pressure, are forcing a reassessment of how connected devices are designed and deployed. As a result, manufacturers, OEMs, and IoT solution providers are converging around three core principles:

  • The first is security by design - developing connected products from scratch with security built in from the outset and applying the best security practices available for the class of connected device. This includes fully leveraging the hardware-based security features embedded within device components, with hardware-rooted trust now shaping IoT device architecture itself and forming the foundation for identity, integrity, and long-term trust. Devices developed without a security-first mindset inevitably contain inherent vulnerabilities.
  • This must be reinforced by security by default, which is a deployment mindset that ensures the designed security features in the devices are actively enabled by default. It ensures that embedded security measures, whether hardware or firmware, are being properly utilised, and the device can be fully monitored on a network once it goes live.
  • The market is also increasingly responding to security by demand, a term introduced by the Cybersecurity and Infrastructure Security Agency (CISA) in the US. Security in connected devices is no longer a ‘nice to have’, it’s a prerequisite that will be demanded by end users, especially customers and buyers under IoT regulations, who will insist that devices are secure and compliant.

Lifecycle accountability and long-term trust

Designing secure devices is only the starting point. In manufacturing environments, where connected assets may operate for many years, long-term trust depends on the ability to maintain, update, and verify device integrity throughout the lifecycle. Active security testing across the software development lifecycle is essential to identify vulnerabilities, including those introduced through open-source libraries and third-party components.

Software Bills of Materials (SBOMs) are becoming central to this effort. By providing a detailed inventory of software and hardware components, SBOMs enable manufacturers to establish accountability across complex supply chains and respond more effectively when issues arise. As regulatory reporting requirements expand under the CRA, supply chain transparency is no longer a best practice, it is becoming a condition of compliance and market access.

The unresolved challenge of end-to-end security

Despite these advances, the industry’s biggest challenge remains achieving true end-to-end security across the industrial IoT ecosystem. Devices, networks, and cloud-based applications have different security requirements and cannot be secured in isolation. Many connected devices operate beyond traditional enterprise boundaries, where breaches may go undetected by conventional IT security controls.

What works for cloud and enterprise IT security does not translate directly to IoT environments and OT environments on the factory floor. Addressing this gap requires a coordinated approach that aligns standards, certification, and continuous monitoring across the entire IoT stack, connecting device behaviour, network activity, and application-layer visibility to reduce risk and protect manufacturing operations.