Manufacturing & Industrial Penetration Testing

In the industrial compromises we investigate, the entry point is rarely an exotic OT zero-day. It is an internet-exposed remote-access service a vendor set up years ago, a flat network where an infected office PC can reach a control-system engineering workstation, or a shared password on an HMI that never rotated. We test for the mundane paths first because that is what real intrusions use.

For a discrete plant we look hard at robotic cells, machine controllers and the safety instrumented systems that must never receive an unexpected command. For process environments we focus on the SCADA layer and the historian, since visibility loss there can force an operator to run blind. Hybrid sites get both.

We build an asset picture using passive traffic capture, targeted nmap sweeps against agreed ranges, and interviews with your controls team. We identify every zone and conduit, flag any device answering on a protocol it should not expose (Modbus/TCP, S7comm, EtherNet/IP), and note where OT talks directly to the internet.

On the enterprise side we test like attackers who have phished a user. We chase privilege escalation, credential reuse and lateral movement toward the OT boundary, using Burp Suite for the web-facing MES and ERP portals and manual techniques for Active Directory abuse. Every step maps to MITRE ATT&CK for ICS so you can see the kill chain, not just a list of holes.

At the boundary we prove whether segmentation actually holds. Can a compromised office host reach an engineering workstation? Does the historian DMZ leak into Level 2? Where a client authorizes it, and only in a maintenance window or on a test rig, we demonstrate controlled interaction with a PLC to show impact. We never risk a running line to make a point.

You get an executive summary a plant manager can act on and a technical report an engineer can follow. Each finding carries a CVSS score, the business consequence in plant terms (lost shifts, scrapped batches, safety exposure), reproduction steps and a prioritized fix.

An office VLAN that can route straight to Level 2 control systems is the single most common critical finding. It turns a routine ransomware infection into a plant-wide outage, because the malware crosses into OT with nothing in the way.

Vendor maintenance links, forgotten RDP, and cellular routers with default credentials give attackers a front door that bypasses your firewall entirely. We routinely find these on internet scans before we even reach the plant.

Shared logins, hard-coded credentials in HMI projects, and engineering workstations running as local administrator let an intruder reprogram control logic once inside. Auth bypass and privilege escalation on these hosts are frequent findings.

The web front ends for production scheduling and monitoring are ordinary applications with ordinary bugs: IDOR exposing another site’s batch records, SSRF reaching internal control services, and injection flaws. We test them against OWASP ASVS and the Top 10.

We frame OT findings against IEC 62443 zones, conduits and security levels, so your controls and automation team can slot remediation into a framework they already recognise. Where you also hold ISO 27001, we cross-reference control A.12.6 on technical vulnerability management.

For operators of essential services, NIS2 raises the bar on risk management and incident readiness across the EU. We map OT findings to IEC 62443 and document the evidence NIS2 supervision expects.

If you hold ISO 27001, the report supplies the technical-testing evidence for A.12.6 and helps close customer security-audit questionnaires that increasingly demand proof of independent testing.

Every hour a line is down has a hard number attached: idle labour, missed shipments, contractual penalties. We quantify the paths that would cause that stoppage so you can justify the fix internally, in the language a finance director understands.

Product designs, process recipes and CAD files are as valuable as the machines that use them. Attackers who reach your PDM or engineering file shares can exfiltrate a competitive advantage that took years to build. We test the routes to those repositories, not only the routes to the factory floor.

A tampered process parameter or a disabled safety interlock is a physical-world risk, not just a data one. Where safety-instrumented systems are in scope, we treat them with the extreme caution they demand and report on how well they are isolated from the rest of the network.

A single factory gets a focused engagement. A group with several plants often starts with the most critical site, then rolls out a repeatable programme across the estate using the same rules of engagement and reporting format.

If you build machines or integrate control systems for others, a test on your product reduces the risk you pass downstream to customers, and increasingly answers a procurement questionnaire before you can win the contract.