Penetration testing for manufacturing is a controlled, authorised attack on your factory’s IT and connected production systems. It finds the weaknesses that could stop a line before a criminal does. For most UK manufacturers the real question is how to test without halting production. This guide covers what a test includes, what it costs you in downtime (it should be close to nothing), and how to get started.
Table of Contents
Why does penetration testing for manufacturing matter now?
Because stopping a factory costs money every hour, and attackers know it. That is the case for testing before an incident, not after. The Cyber Monitoring Centre put the cost of the 2025 attack on Jaguar Land Rover at £1.6 billion to £2.1 billion. Its most likely figure was £1.9 billion. The estimate covers the carmaker, its supply chain and dealerships, and ITPro reports that more than 5,000 UK organisations were affected.
Smaller firms feel the same pressure. A survey of 500 UK manufacturing decision-makers by ESET, covered by ITPro, found that 78% had a cyber incident in the past year. Some 53% reported an impact on revenue, and 44% cited supply chain effects.
You do not need to be a household name to be on the list. If a larger customer relies on your parts, then you are part of their risk.
What does a manufacturing penetration test actually cover?
Penetration testing for manufacturing should follow the routes an attacker would take, from the internet to the shop floor. Typical areas include:
- External systems: websites, remote access, VPNs and anything else reachable from outside.
- Office network and Active Directory: weak passwords, over-powered accounts and unpatched servers that let an intruder move around.
- The IT and OT boundary: whether a compromised office PC can reach controllers, engineering workstations or historians.
- Third-party access: vendor remote support links and maintenance accounts.
- Staff: phishing and social engineering, since most intrusions start with a person.
The aim is a ranked list of what an attacker could really do, with fixes you can act on, so it is not a long list of theoretical flaws.
Can you test operational technology without stopping production?
Yes, if the testers know what they are doing, though it takes care. Older controllers can fail when poked by tools built for office networks. The National Cyber Security Centre says in its guidance on OT architecture that active scanning can overwhelm legacy devices with limited processing power, causing slowdowns, freezes or crashes.
The same guidance suggests a safer approach:
- Use native industrial protocols and tools that the equipment maker has validated.
- Tell your security operations team the date, time and scope of any scan.
- Schedule the work in planned maintenance windows.
In practice, most of the value sits on the IT side of the boundary. Attackers usually arrive through the office network first, so testing there and checking the route into the plant gives you most of the answer with little operational risk. If you need a deeper look at control systems, our guide on whether you need ICS or SCADA testing explains how to scope it safely.
Who should carry out the test?
Look for a provider with industrial experience. A general pen test brand is not enough. The NCSC advises, in a blog post on what industry pen testers told it, that organisations should use CHECK-assured providers and ensure the people they hire have relevant experience in OT. Without it, testers may miss industrial weaknesses. They may also disrupt a physical process by accident.
Ask any provider these questions before you sign:
- Have you tested environments with PLCs, SCADA or similar systems before?
- How will you avoid disrupting live production?
- Who on your team will be on site or on call during testing?
- What does the report contain, and is there a debrief?
Our article on how to choose a penetration testing company lists more red flags worth checking.
How do you scope a test for a factory?
Scoping is where most of the safety is built in, so take your time over it. The NCSC’s penetration testing guidance says scoping should involve the risk owners, technical staff who know the system, and a representative of the test team. It should end with a written plan. That plan sets the boundaries, test types, effort in days and any special handling needs.
For a manufacturer, agree these points up front:
- Which systems are off limits, and which can only be tested out of hours.
- A named technical contact who can answer the phone during the test.
- What happens if testers find something critical mid-test.
- Any customer or insurer requirement the report must satisfy.
Our preparation checklist covers the practical side. It runs from test accounts to asset lists.
How often should penetration testing for manufacturing happen?
At least once a year, and after any major change such as a new remote access route, a plant network redesign or a merger. The NCSC makes the point that a test only validates your systems on the day it runs, and a gap of a year or more leaves problems unseen. Because of that gap, pair each test with regular patching, asset tracking and monitoring in between.
What does penetration testing cost a manufacturer?
The price of penetration testing for manufacturing depends on scope, such as the number of sites, networks, applications and any OT work. A single-site office and external test is much cheaper than a multi-site engagement with industrial systems. Any honest provider will price after a scoping call rather than quote blind. If your asset list is complete, the quote will be more accurate.
To put a number against the budget, compare it with the downtime figures above. One lost day of output can cost more than a test. That makes penetration testing for manufacturing a sound investment for most plants.
Frequently asked questions
Will a penetration test shut down my production line?
It should not, because careful scoping, maintenance windows and testers who understand industrial kit keep the risk low. The NCSC itself warns that no one can promise zero unexpected reactions. Keep a contact on hand and a rollback plan ready.
Is penetration testing the same as a vulnerability scan?
No. A scan lists known flaws automatically. A pen test has a person chain weaknesses together to show what an attacker could actually reach.
Do my customers expect a pen test?
Increasingly, yes. Large buyers and insurers often ask suppliers for recent test evidence, so a clean report can help you win and keep contracts.
We have no dedicated security team. Can we still do this?
Yes. A provider can handle the testing and explain the results in plain terms. You will need someone to own the fixes afterwards.
Should we test before or after a ransomware assessment?
Either works. A ransomware readiness assessment reviews your defences and recovery plans, while a pen test proves whether attackers can get in.
Getting started
If you run a plant or supply parts to one, begin with a scoping conversation about penetration testing for manufacturing sites like yours. Aardwolf Security can help you plan a safe engagement through our UK penetration testing service, and you can get in touch to talk through your sites and constraints. But whatever you decide, do not wait for an incident to find out where your weak points are.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
