OEE and Smart Factory

OT Cybersecurity Risk Cost in Manufacturing Plants

This guide shows which inputs drive OT cybersecurity risk cost and where teams usually misread the number. Use it to make quotes, schedules, or improvement work more accurate.

OT cybersecurity risk cost in manufacturing is quantified using an annual loss expectancy (ALE) framework: ALE = Annualized Rate of Occurrence (ARO) x Single Loss Expectancy (SLE). SLE is the total cost of one successful cyberattack on operational technology, which includes production downtime during recovery, scrapped or contaminated product, remediation labor and consulting fees, recovery of compromised systems, regulatory notification, and potential customer penalties for missed deliveries. For a midsize manufacturer where a ransomware attack causes 7 days of production loss on a $150,000/day margin operation, plus $400,000 in remediation, SLE is approximately $1.45 million. If the probability of experiencing such an attack in a given year is assessed at 10%, ALE is $145,000 per year.

OT networks are increasingly targeted precisely because they are often less protected than IT networks and because production disruption creates immediate leverage for ransom demands. The 2021 Colonial Pipeline attack caused $4.4 million in ransom payments and $75 to $100 million in revenue impact. The 2017 NotPetya malware cost Merck $870 million and Maersk $300 million in manufacturing and logistics disruptions. Most of these incidents did not require a sophisticated attack: they entered through spear phishing emails, unpatched remote access vulnerabilities, or flat networks where OT and IT systems share credentials. Plants that have not performed an OT network segmentation audit are carrying unknown risk because the blast radius of an intrusion is unlimited when IT and OT share the same network.

The cost to protect against OT cyber risk is far lower than the cost to recover from an incident. Network segmentation with a demilitarized zone (DMZ) between IT and OT costs $20,000 to $80,000 in professional services and hardware for a single plant. An annual OT vulnerability assessment runs $15,000 to $40,000. Patching and hardening of exposed Windows-based HMI and SCADA systems costs $5,000 to $20,000 per year in managed services. Multi-factor authentication for all remote access points adds $5,000 to $15,000 per year. Total annual OT cybersecurity program cost for a mid-size plant: $50,000 to $150,000. Compare that to the $145,000 ALE calculated above, and the protection investment pays back in under 12 months and becomes a clear annual positive from year 2 forward.

Air-gapping is not the answer most plants think it is. Fully air-gapped OT networks (no connection to any IT or external network) do eliminate most remote attack vectors, but they also prevent the remote monitoring, data integration, and supply chain connectivity that modern manufacturing requires. They also still carry risk from insider threats and supply chain compromise through vendor service laptops and USB devices, which was the attack vector for the Stuxnet malware that damaged Iranian nuclear centrifuges. The practical answer is controlled segmentation with monitored interfaces, strict change control on OT systems, and an incident response plan that defines recovery steps before an attack occurs rather than improvising under pressure.

Incident response planning is the most frequently skipped OT cybersecurity investment and the one with the highest leverage during a real event. Plants without a tested response plan typically take 3x to 5x longer to recover from an attack than those with documented, practiced procedures, because unplanned recovery involves organizational chaos alongside the technical problem. A basic OT incident response plan covers: who is notified immediately (including production, IT, legal, and executive leadership), which systems are isolated, how production is continued on manual or backup systems, who the external forensics and recovery partners are (identified in advance, not during the incident), and how evidence is preserved for insurance and legal purposes. Writing and tabletop-testing this plan costs $10,000 to $30,000 in professional services and protects the entire SLE of the plant.

Published 2026-05-28.