In its report for the year 2025, the French National Cybersecurity Agency (ANSSI) describes a threat that no longer targets only large corporations: SMEs, micro-enterprises, and mid-cap companies constitute the category of entities most affected by the ransomware attacks it handled (ANSSI, 2026).

Yet, when the subject is brought up in executive committee meetings, the discussion turns to firewalls, antivirus, and backups. Rarely to the question that decides everything: how many people outside the company can, tonight, connect to production equipment? The answer exists nowhere. Not because it is confidential — because no one has ever established it. Every access was opened for a good reason, one day, by someone who may no longer be there.

A few figures to quantify the actual pressure on production sites:

• 3,586 security events handled by ANSSI in 2025, representing an 18% decrease compared to the previous year (ANSSI, 2026)

• 1,366 incidents brought to the Agency's attention in the year 2025 alone (ANSSI, 2026)

• 128 ransomware compromises handled in 2025, with 37% affecting SMEs, micro-enterprises, and mid-cap companies (ANSSI, 2026)

• 196 data exfiltration incidents handled in 2025, compared to 130 in 2024 (ANSSI, 2026)

• 4,875 incidents recorded in the European Union between July 2024 and June 2025, with 2.9% in the manufacturing sector, according to the European Union Agency for Cybersecurity (ENISA, 2025)

• 21.3% of initial accesses obtained by exploiting vulnerabilities (ENISA, 2025)

PLCs, HMI screens, maintenance PCs: the network that your IT department does not manage

In almost every site we visit, there are two types of IT. One is managed, inventoried, patched, and backed up. The other runs in the workshop, under the responsibility of production, and is treated like mechanical equipment: you don't touch it as long as it works.

This second type of IT is Operational Technology (OT): PLCs, HMI supervision screens, test benches, and maintenance PCs running frozen operating systems because the vendor's software only works there. It has three characteristics that, combined, create an attack path.

A flat network: the office workstation of the methods department and the PLC of line 3 often talk to each other without barriers. What compromises the former reaches the latter.

Equipment that is never restarted: a security patch requires a shutdown, the shutdown requires a window, and the window is negotiated a year in advance. Thus, known vulnerabilities remain open long after their publication.

An aging edge: equipment exposed at the network border concentrates the risk. ANSSI notes that they have been "affected by numerous vulnerabilities, when it was not a matter of technical weaknesses inherent to their design" (ANSSI, 2026). Vulnerability exploitation remains one of the top vectors of initial access in Europe (ENISA, 2025).

The result is an absurd geometry: a latest-generation firewall at the headquarters' entrance, and an armored door placed in a drywall partition at the workshop's entrance.

Your security is only as strong as your least rigorous maintenance provider

None of these accesses were opened out of negligence. Each has a story.

The commissioning of a line, where the integrator requests a connection for configuration. A breakdown on a Sunday evening, where the manufacturer can only intervene remotely and production is waiting. A remote maintenance box delivered with the machine, preconfigured by the supplier, and plugged in by an electrician. A subcontractor's laptop connected to the workshop network to read a PLC log.

Each of these decisions was the right one at the time. What is missing is what comes next.

No inventory: accesses do not appear in any common registry because they were opened by production, by maintenance, by the integrator, never by the same person.

No expiration: an access opened for three days remains open for three years. Nothing in the configuration carries an end date.

No revocation: when a maintenance contract ends, the contract ends. The access, however, remains.

The net effect is that your security level becomes that of the least rigorous third party in your machinery pool, and ANSSI notes that data exfiltrations are "sometimes subsequent to the compromise of a service provider" (ANSSI, 2026). You were not targeted. You were bypassed.

A regulatory timeline also exists, and it is behind schedule. Directive (EU) 2022/2555, known as NIS2, adopted on December 14, 2022, and published on December 27, 2022 (EUR-Lex), was supposed to be transposed before October 17, 2024. The European Commission referred Ireland, Spain, France, and the Netherlands to the Court of Justice of the European Union on July 8, 2026, for failing to notify their transposition measures (European Commission, 2026), and the French transposition was still under parliamentary review at the last documented state by the Agency (ANSSI, 2025). This timeline will set obligations. It does not close any access.

Attackers do not look for an important target, they look for an accessible target

The objection is always the same: "we are not a vital infrastructure, we make parts." It assumes a selection based on importance. The selection is made based on exposure.

An automated internet scan does not read your revenue. It spots an open remote access service running on a version with a public vulnerability. What the attacker knows about you, they learn after entering. And they then discover what makes a manufacturer interesting: stopping a production line creates a pressure to pay that few other sectors can match.

The shutdown scenario is not the only one. The documented trend also points to theft, with exfiltration incidents increasing significantly year-over-year (ANSSI, 2026). For you, this means blueprints, manufacturing ranges, purchasing conditions, and qualification files. This heritage triggers no alarm upon leaving and goes unnoticed the next morning. It reappears two years later in a competitor's offer, without any link being establishable.

Finally, there is a faster channel than the regulator: your customer. A contracting entity covered by NIS2 must master its supply chain, and it will do so by passing contractual requirements down to you, backed by proof. We showed, in 53% of MCP servers are hacker nests, how quickly a technical brick adopted without a framework becomes an entry point.

4 concrete actions to take back control of your access

1. Inventory the paths, not the equipment. An inventory of machines says nothing about risk. What matters is the list of points through which a flow enters or leaves the workshop: remote maintenance access, USB update drives, connections to the MES, data uploads to the ERP. This list is established by interviewing maintenance staff, not by scanning the network.

2. Set an end date for every third-party access. Supplier access should be requested, opened for a specific duration, tracked, and then closed. As long as it is permanent, it is equivalent to an administrator account entrusted to a company whose workstations, departures, or passwords you do not control.

3. Decouple instead of segmenting. Segmentation by virtual network segment (VLAN) quickly reaches its limit with legacy industrial protocols. Architectural decoupling, where every exchange goes through a mediation point that knows the expected flow, holds up better over time. This is what we call agile software urbanization, and the approach is detailed in Digital Transformation.

4. Write the incident reporting chain before you need it. Who identifies, who qualifies, who decides to isolate a line, who notifies management and clients. This procedure costs nothing to write ahead of time, and it is impossible to improvise on a Sunday morning.

Opening access without exposing the system requires an intermediary that knows the expected flow. This is the principle on which akawan built Kaptngo, a gateway designed to replace aging hardware firewalls and Virtual Private Networks (VPNs): it supports machine-to-machine exchanges, legacy applications and protocols, license servers, and TCP and UDP transport protocols, with an initial constraint to adapt to needs without disrupting existing systems. The functional scope is detailed on the Kaptngo page.

You cannot secure a workshop you have not inventoried

There will not be a single moment when your workshop becomes safe. There will be a list of accesses, managed by someone, reviewed at fixed intervals, and reduced at each review. This is unglamorous work, which does not present well in committee meetings, yet decides what will happen the day an automated scan finds your maintenance gateway.

This work is within the reach of a mid-cap company because it requires neither an exceptional budget nor rare expertise. It requires consistency, and it progresses at the pace of shutdown windows, not at the pace of announcements. This is exactly why it must be started before you are forced to: a missed shutdown window cannot be caught up.

The question to ask your team this week fits in one line: how many remote accesses exist today to our production equipment, and who, by name, can close them?

Who are we?

akawan is an independent expert IT services company based in Toulouse, specializing in artificial intelligence, digital transformation, information systems architecture, and agility. We support companies and industries in modernizing their software ecosystem, enabling technical and operational departments to leverage their data and secure their growth.