Sometimes a USB stick left lying around is all it takes

If you make machinery, electronics, vehicles or medical devices, NIS2 applies from 50 employees or more than €10m in both revenue and balance sheet total. The technical benchmark is usually IEC 62443.

Aligned with IEC 62443
Experience with OT environments
Active tests only in the agreed window

24% How common real incidents are

Roughly one in four companies in mechanical and plant engineering reported a significant cybersecurity incident in the past two years.

Source: VDMA study “Industrial Security und Produktpiraterie 2024”, Fraunhofer AISEC, 100 surveyed VDMA member companies

From the break room to the controller: the layers and two ways in

Production environments combine decades-old control technology with modern IT.

Way in 1 · USB stick from the break room

What an attacker finds What we test

Office IT

Workstations, goods receiving, break room

A prepared USB stick lies in the break room, apparently by chance. Someone plugs it in out of curiosity.

Media dropping, phishing and pretexting for shift work, physical entry, Active Directory.

IT/OT boundary

Where office IT meets the production layer, network segmentation is often missing. Without it, PLCs and remote maintenance access are reachable from an office computer.

Production control

SCADA, control systems, remote maintenance access

Way in 2 · Remote maintenance without a second factor

Machine builders need remote access for service and maintenance. A way in without a second factor.

Remote maintenance access as part of the OT/ICS and Infrastructure Pentest, within the production window.

Control layer

PLCs, fieldbuses, industrial IoT

PLCs and fieldbuses are designed for availability and run for years without any patches.

On OT-adjacent systems we work passively: we read along, we do not write.

Spreading downwards

How we test without stopping the line Availability comes before test depth. Beforehand we agree with you which systems get actively tested, which are only analysed passively and which are excluded.

Where active tests are needed, they run in production windows agreed beforehand, with a defined emergency contact on both sides and a firm rule to stop immediately at any unexpected effect. Tests on machines and lines never happen without plant management at the table.

The modules behind it

Where IT, OT and the factory site meet, one test is not enough. Every module can be booked on its own.

Physical Pentest

Simulated entry into the factory grounds, goods receiving and the production hall, including tailgating attempts.

Social Engineering

Phishing, pretexting and media dropping simulations, tailored to shift work and third-party contractors.

OT/ICS Pentest

Targeted testing of PLCs, SCADA and remote maintenance access, scheduled around your production windows.

Infrastructure

Network segmentation between IT and OT, Active Directory hardening and the classic office IT inside the plant.

What ends up on the table

Manufacturing pentest report · Sample excerpt Sample

USB drop test: 3 out of 10 planted sticks were plugged in (example figure)
Awareness and endpoint control
No network segmentation between office IT and the production network
IT/OT segmentation
Remote maintenance VPN for machine vendors reachable without multi-factor authentication
Remote maintenance access
PLC firmware not updated for years on several lines
Patch and firmware management
Tailgating: entry into the production hall possible without a badge check (example figure)
Physical access control
Industrial device reachable with factory-default credentials
Credential hardening

Every finding rated by severity, exploitability and impact on operations, with mapping to NIS2 and IEC 62443.

Illustrative example, no real customer data.

People and premises: where the way in bypasses all technology

Goods receiving

Parcel deliveries, suppliers, truck drivers: this is where unfamiliar people and objects come into the building every day.

Third-party contractors

Service technicians and temp workers move through the plant with their own laptops, rarely through the same controls.

Break room

Where colleagues are relaxed and happy to help, an orphaned USB stick is at its most convincing.

Tailgating

A door held open, a smokers' exit, a badge check that only happens in the morning: the way into the hall bypasses all technology.

Questions from IT, plant and executive management

Are we even affected by NIS2 as a machine builder?

Probably yes, from 50 employees or once revenue and balance sheet total both exceed €10m. The manufacturing sector is one of the NIS2 sectors.

What is different about an OT pentest compared to a conventional IT pentest?

In OT, availability comes before everything else: a crashed controller can shut down a line for hours. We test more carefully, and often passively.

What exactly is IEC 62443, and do we have to comply with it?

The standards series for the security of industrial automation and control systems. There is usually no legal obligation, but it counts as the benchmark for the state of the art.

Is a USB drop test really representative?

Media dropping is a documented attack technique that is used in real attacks. Ransomware typically gets in through the IT side and spreads towards OT.

One vulnerability is enough to stop a line.

One conversation clarifies the scope and your NIS2 relevance, and after that you receive a fixed-price quote.

Access Granted delivers the penetration test and the technical evidence, not the NIS2 classification and not a certification.

Book an initial consultation Get in touch

hello@access-granted.de

+49 9281 5918506

Everything about the service: access-granted.de/en/branchen/manufacturing