SonicWall today released its 2026 Manufacturing Protect Brief, a vertical specific companion to the SonicWall 2026 Cyber Protect Report.
The findings show that factories are increasingly opening up critical new entry points for hackers. Consequently, while the total volume of cyberattacks on the manufacturing sector has actually decreased, hackers are executing much more precise, highly targeted strikes on these digital gaps.
Manufacturing recorded a 56.2% year-over-year decline in intrusion prevention (IPS) volume in the first half of 2026, the steepest drop of any tracked vertical. But the decline does not reflect reduced risk. Absolute volume remains significant at 474 million events, and as more operational technology connects to IT infrastructure, the attack surface is expanding even as attackers grow more selective about where they strike.
“Manufacturing’s attack surface looks nothing like it did even five years ago, and the security model hasn’t caught up,” said Michael Crean, SonicWall SVP of Managed Services. “Every connection added for operational convenience, remote monitoring, predictive maintenance, vendor access to production systems, is also a connection an attacker can walk through. A stolen credential shouldn’t be able to reach the production floor, but in most manufacturing environments today, it can.”
SonicWall’s Manufacturing Protect Brief draws on data from SonicWall’s global network of more than one million security sensors to document the specific attack patterns, legacy vulnerabilities and ransomware campaigns defining the manufacturing threat landscape in the first half of 2026.
Key Findings from the 2026 SonicWall Manufacturing Protect Brief
- The Hikvision IP Camera Command Injection vulnerability (CVE-2021-36260), disclosed in 2021, continued to generate 43 million hits in H1 2026, the single largest IoT attack signature across any industry SonicWall tracks.
- IoT attacks were manufacturing’s second-largest attack category by volume, generating 46.2 million hits, with more than half of manufacturing networks detecting exploitation attempts. • Manufacturing recorded the highest SCADA attack detection rate of any tracked vertical. • Ten ransomware families were active against manufacturing networks in H1 2026; the Zhen family alone generated 22.2 million hits concentrated on just two devices, a pattern consistent with an active, ongoing incident rather than a broad campaign.
- Apache Log4j2 generated 13.8 million detection events on manufacturing networks, more than four years after the vulnerability was first disclosed.
Unlocked Doors
Between networked security cameras, industrial sensors, and smart building controls, today’s factories are packed with connected devices that were never designed with modern security in mind. They run on old software, are rarely patched, and sit on the exact same networks as critical production lines. This means old vulnerabilities never really go away. For example, a well-known Hikvision camera flaw from five years ago is still one of the most common threats detected on factory networks today.
The danger multiplied as companies connected their corporate offices to their physical plant floors to allow for remote monitoring and automated maintenance. Because these networks are linked, a single employee password stolen through a phishing email is often all a hacker needs to jump from the front office straight into the systems that control physical machinery.
“Manufacturing doesn’t have a sophistication problem, it has an architecture problem,” continues Crean. “The factory floor is now part of the corporate network. Until we start continuously verifying every user and restricting their access to only the specific apps they need, one stolen password will continue to be enough to shut down a plant.”
The Architecture Problem Has a Known Solution
The vulnerabilities documented in the Manufacturing Protect Brief are well understood, and the controls that address them exist. SonicWall Cloud Secure Edge applies Zero Trust principles to every access request, granting application-level access only and continuously re-verifying identity and device posture rather than treating a validated credential as a blanket pass to the network behind it.
For manufacturers managing vendor and maintenance access to production systems, remote monitoring tools and ERP integrations, replacing broad VPN-based access with application-level Zero Trust removes the condition that makes credential compromise consequential: a stolen login no longer grants a path to the systems that run the production floor.
