The Holy Grail of the connected factory often runs into a chilling statistic: 75% of industrial cyberattacks start with a simple breach in the office network (IT). This is not just a problem for giants: in 2024, 37% of ransomware victims were SMEs.

The Jaguar Land Rover shockwave

On August 31, 2025, the manufacturer experienced the worst-case scenario. A flaw at a logistics supplier allowed attackers to infiltrate the very heart of the factories.

• The intrusion: Attackers compromised a logistics supplier through social engineering.

• The vulnerability: They exploited a SAP NetWeaver vulnerability to infiltrate.

• The paralysis: Lacking segmentation, they reached the PLCs and SCADA, bringing factories in the UK, Slovakia, Brazil, and India to a grinding halt.

• The bill: Between £5 and £10 million in losses per day, sales down by 25%, and subcontractors pushed into bankruptcy. In total, over £2 billion. 

• Result: Total shutdown of global production the following day.

And the detail that hurts: JLR had not finalized its cyber insurance policy. The entire bill was on them.

The mechanism is always the same: the attack enters through the office, spreads due to a lack of segmentation, and ends up paralyzing the PLCs. If your PLC is on a "flat" network, you are the next target.

Five concrete actions to connect your machines without opening the door

We are not going to throw away machines that work. The challenge is to build a secure bridge between two technological eras.

1. Map before you connect: You cannot protect what you do not know. Identify equipment and "rogue connections" set up on the quiet years ago.

2. The smart intermediary: Never connect a PLC directly to the IT network. Use an Edge device or a gateway that encapsulates the data. If the intermediary is compromised, the machine remains unharmed.

3. Zero Trust Segmentation: Forget simple VLANs. Zero Trust requires every flow to be authenticated. Divide the factory into micro-perimeters: if one segment falls, the others hold.

4. Unidirectional flow on critical systems: For your most sensitive PLCs, data must go out for analysis, but no commands must be allowed in. This is the difference between observing a machine and giving the keys to the first comer.

5. Encapsulate "Legacy": Your old protocols (Modbus IP, BACnet IP) are not the problem; their insecurity on the network is. They are transported in an encrypted tunnel without touching the original configuration.