Cyber resilience starts on the factory floor

A production line grinding to a halt due to a cyberattack is every management team's nightmare. Geopolitical tensions and the increasing digitalization of machinery are increasing the likelihood of this happening. The fact that the industry senses this lurking danger was evident from the great interest in Industrial Cyber Security on October 29, 2026, in 's-Hertogenbosch. One question was central to the event: how do you prevent a minor incident from escalating into a complete factory shutdown?

Digital autonomy as a foundation

OT security is no longer the exclusive domain of security specialists. It impacts the architecture, operations, and ultimately the continuity of all business processes. It is therefore of great importance to ensure that you maintain control over every part of the production line. And this goes beyond technical measures, as became clear during the opening presentation by Liesbeth Holterman, Director of Cyberveilig Nederland.

She takes her audience on a fascinating journey through time, from the invention of the printing press around 1450 to digital sovereignty in 2026. For according to Holterman, the greatest threat to our cybersecurity lies not in flawed technology, but in our heavy reliance on external, non-European parties. As a result, we maintain insufficient control over our data and digital infrastructure.

However, the desire to be digitally autonomous sometimes clashes with the need to collaborate with supply chain partners., as becomes apparent from the following lectures in the program. After all, many companies depend on hardware and software suppliers, cloud environments, and external security providers for their digital infrastructure. This applies in particular to OT environments.

A security measure that is acceptable within a regular IT environment can have adverse consequences for availability and even physical safety in a production environment. Production processes, power supplies, and industrial installations *must* continue to function. This tension between security measures and the operational demands of daily practice was one of the main themes of the event.

Regulation penetrates engineering

A second common thread was regulations, including NIS2 and the Cyber Resilience Act (CRA). Various presenters addressed the question of how to link these new regulations to existing OT architectures, industrial products, and machine building.

Topics ranged from the impact of CRA and NIS2 on industrial organizations to the deployment of identity and access management and the question of how the Cyber Resilience Act contributes to safer industrial products. The link with IEC 62443 was also discussed.

The central message was that engineers, machine builders, system integrators, and asset owners must take cybersecurity requirements into account early in the development cycle. By incorporating security early in the technical process, you prevent delays and high costs at a later stage of development. Determining the appropriate security level remains a challenge in this regard.

You cannot protect what you do not know.

Before organizations can assess and manage risks, they must know which business assets (assetsbe present. Asset visibility It was therefore a much-discussed topic on the exhibition floor. Insight into all resources and components within an OT environment helps to comply with the new cybersecurity obligations. But what does this mean in practice?

The first step is to compile a list of existing OT assets, a so-called OT asset inventory. This is no simple task, as several presenters noted. Installations evolve over decades, are modified in the interim, and contain components with widely varying lifecycles. Moreover, there are often different technical and organizational parties responsible.

When we talk about vulnerability management (vulnerability management) we cannot project IT practices one-to-one onto OT environments. Vulnerability scanners, management systems, and regular patch cycles are commonplace in offices, but less common in industrial installations.

A systematic, risk-driven approach is of great importance in OT. Which vulnerabilities actually pose a risk? Which firmware update is necessary and when can it be performed safely? And how does an organization deal with a zero-day security breach when it is not possible to shut down a system without significant consequences for production? In answering these questions, attack routes play a key role, among other things, exploitability and the criticality of assets plays a role.

Zero trust and availability

The tension between the protection and availability of OT assets also recurred in the presentations on zero trust, secure remote access, and the management of digital certificates.

These themes are becoming more important as industrial installations become more closely connected. After all, remote managers want to be able to perform maintenance remotely, and engineers need access to various systems to do their work. In short, it is becoming increasingly common for data to be exchanged between OT, IT, cloud environments, and other platforms.

The classic security question of who is allowed access to the network is therefore no longer sufficient. With zero trust, access is granted explicitly and as restrictively as possible. It is determined who gains access to which system, under what conditions, for what period, and with what rights.

However, zero trust in an industrial environment does not mean that availability is subordinate to security. The challenge is precisely to enable controlled access without jeopardizing process continuity. And this involves not only network security, but also identities, authorizations, and controlled data flows.

Human and organizational side

The extensive attention paid to the human and organizational aspects of cybersecurity was striking. After all, tools alone do not make a factory cyber-secure. Organizations must also practice with incidents, define responsibilities, and make cybersecurity part of their decision-making and investments.

This raises governance questions. For example, who is responsible for NIS2 when the parent company determines the cybersecurity policy, but separate plants bear the operational risks? And who makes the decision during an incident to shut down a plant or to keep it running? The answers to these questions must be discussed and documented in advance.

Monitoring software can signal anomalies, and network segmentation helps to contain an attack. But if it is unclear who acts next, technology provides only part of the solution.

Cyber resilience requires clear responsibilities and collaboration between IT, OT, management, and, where necessary, suppliers – was one of the conclusions during the afternoon program.

From security to resilience

The goal is not to rule out every cyber incident, but to reduce risks and to be able to respond adequately when things do go wrong.

Naturally, as a security professional, you want to protect a factory against an attack. But at least as important is the question of how processes continue to function when systems are affected, credentials are leaked, a supplier is attacked, or a vulnerability cannot be remedied immediately.

This requires multiple layers of defense: insight into assets, segmentation, secure access, monitoring, appropriate security levels, incident response, and an organization that knows who is responsible for what. In addition, organizations must assess safety, security, and availability in conjunction.

Cyber misery has never been so much fun

By 2026, OT security will evolve from a technical specialization into a structural part of industrial business operations. There is no ready-made technical solution for cyber resilience. It arises from the combination of technology, engineering, processes, and people.

All these themes recurred in a playful manner in the closing keynote by author and cyber researcher Chris van 't Hof (DIVD). In a dark, unlit room, he told the audience about a fictional three-day European blackout in which even the OT security company goes dark. The audience hung on his every word. At the end of his lecture, Van 't Hof handed out one of his books for free: 'Cyber Misery Was Never So Fun'. All copies were gone within one minute. The most important lesson: do not passively wait for the next cyber incident, but learn from the cyber misery of others.

More information: fhi.nl/industrialcybersecurity