Manufacturing.

OT cyber resilience for process plants, discrete plants, and the quality & safety systems that sit across both.

IEC 62443
IEC 61511
NIS2

The problem is now operational, not theoretical.

Manufacturing has become one of the most-targeted sectors for ransomware, for a simple reason: when a plant stops, the loss is immediate, visible and hard to recover.

For a plant director the threat is not data theft in the abstract, it is a line freezing mid-shift, a batch lost, a safety system behaving unpredictably, or a critical supplier going dark.

OT environments were never designed for this: decades-old PLCs and DCS, flat networks, permanent OEM remote-access links, and safety systems sharing infrastructure with everything else. Connectivity has arrived faster than the controls to govern it.

£1.9bn

Jaguar Land Rover, 2025

A five-week production shutdown that rippled across ~5,000 supply-chain businesses, reported as the most economically damaging cyber incident in UK history.

£300m

Marks & Spencer

Estimated lost profit from a single breach earlier the same year.

4/wk

Nationally significant incidents

Now handled every week by the UK's National Cyber Security Centre.

Three capability areas

Our work is organised into three capability areas. Each maps directly onto the manufacturing problems that follow, process plants, discrete plants, and the quality & safety systems across both.

Industrial Resilience

Prepare for, withstand and recover from cyber incidents and operational disruption.

NEXION Cyber Resilience Platform
Readiness for major incidents
Governance, Risk & Compliance
Penetration testing

Operational Technology

Secure and modernise industrial control systems and OT environments.

OT Programme Design & Delivery
Site Enablement
OT Security Due Diligence
Data & AI Governance in OT
OT Supply-Chain Security & GRC

Industrial Tech & Innovation

Help industrial organisations navigate operational reality and digital innovation.

Industrial domain advisory
Agentic BPMN
AI-ready data architecture
AI governance
Data governance

We are vendor-, tool- and standard-agnostic. We map to the frameworks you already answer to, without locking you into any one of them.

IEC 62443
IEC 61511
NIS2

Where it breaks

Our work maps directly onto the manufacturing problems operators face, process plants, discrete plants, and the quality & safety systems across both.

01Manufacturing

Process plants

Continuous and batch operations, chemicals, food & beverage, pharmaceuticals, distilling, energy and water treatment.

The problem

Continuous and batch operations cannot simply be paused and resumed. The control estate, DCS, SCADA, PLCs and instrumentation, has a 15-to-30-year lifecycle, runs unpatched by design, and increasingly reaches back to corporate IT and out to OEM support. A ransomware event can force an uncontrolled shutdown, spoil in-progress product, and leave operators blind. Recovery is rarely restore-from-backup: control logic, recipes and historian data must all come back in the right state and order.

OT Programme Design & Delivery
Site Enablement
Readiness for major incidents
NEXION Platform
OT Supply-Chain GRC

How we solve it

Build asset visibility and a defensible network architecture (Purdue / IEC 62443 zoning) without disrupting live production, delivered on site by engineers who have commissioned this equipment.
Establish OT-specific backup and recovery for control logic, configs and historian data, tested against a realistic restart sequence.
Stand up continuous monitoring and a single view of resilience posture across sites.
Bring third-party and OEM remote access under control, with supply-chain assurance.
Align to NIS2 and sector obligations (e.g. COMAH) with board-ready reporting.

Production continuity, with a rehearsed path to safe shutdown and restart.

Lower unplanned downtime and faster, more predictable recovery.

Demonstrable regulatory alignment and a stronger position with insurers.

Decisions made by people who understand the process, not just the protocol.

02Manufacturing

Discrete plants

High-throughput, just-in-time manufacturing, automotive, electronics, aerospace, assembly.

The problem

Discrete manufacturing runs on throughput and just-in-time supply, leaving almost no buffer to absorb a stoppage. A single compromised cell, MES or line controller can halt the whole line, and a compromised supplier can halt you without ever touching your network. The Jaguar Land Rover shutdown is the clearest illustration: a cyber incident that rippled across roughly 5,000 supply-chain businesses and stopped production for over a month. Robotics, PLCs and converged IT/OT all widen the attack surface.

OT Programme Design & Delivery
OT Supply-Chain GRC
Readiness for major incidents
Penetration testing
OT Security Due Diligence

How we solve it

Segment and harden line-level systems, cells, MES, line controllers, and validate the separation with OT-safe testing.
Tier and assure your supplier and OEM base by cyber risk, with continuous assurance, not one-off questionnaires.
Put line-down incident readiness in place: playbooks, rehearsals, and a recovery sequence that restores throughput fast.
Maintain a live view of posture across lines and sites.
Assure cyber posture at the point of capex, new lines, automation, acquisitions, before risk is built in.

Protected throughput and reduced exposure to single points of failure on the line.

Supply-chain resilience, visibility of, and leverage over, the partners that can stop you.

Faster recovery and a rehearsed response when a line does go down.

Cyber risk priced into investment decisions, not discovered after go-live.

03Manufacturing

Quality & Safety

The systems that prove product quality and keep people safe, across both process and discrete plants.

The problem

Cyber risk crosses into the physical world through two systems that must never be wrong: the ones that prove product quality, and the ones that keep people safe. Tampering with setpoints, recipes or batch records can produce out-of-spec or unsafe product; manipulating historian or MES data undermines the integrity regulators rely on (GxP, 21 CFR Part 11). Where safety instrumented systems share infrastructure with the control network, a cyber event becomes a safety event. Functional safety and cybersecurity have been governed separately, and the gap between them is where incidents live.

Data & AI Governance in OT
Data governance
Industrial domain advisory
Penetration testing
AI governance

How we solve it

Govern the integrity of quality-critical data end to end, historian, MES, batch records, so what auditors and regulators see can be trusted.
Establish and verify segregation between safety instrumented systems and the wider control network, under a single assurance view.
Govern any AI or analytics touching quality or safety: what data it uses, what it can act on, and how it is overseen.
Embed quality and safety obligations into the governance framework, not a separate compliance silo.

Protected product quality and demonstrable data integrity for audit and inspection.

Safety-case integrity maintained as systems become more connected.

Reduced exposure to recall, liability and regulatory action.

A single, defensible line of sight across quality, safety and cyber.