SonicWall Research Finds Manufacturing Cybersecurity at a Breaking Point as Factory Floors and Corporate Networks Collide

MILPITAS, Calif. — July 22, 2026 — SonicWall today released its 2026 Manufacturing Protect Brief, a vertical-specific companion to the SonicWall 2026 Cyber Protect Report. The findings show that factories are increasingly opening up critical new entry points for hackers. Consequently, while the total volume of cyberattacks on the manufacturing sector has actually decreased, hackers are executing much more precise, highly targeted strikes on these digital gaps. 

Manufacturing recorded a 56.2% year-over-year decline in intrusion prevention (IPS) volume in the first half of 2026, the steepest drop of any tracked vertical. But the decline does not reflect reduced risk. Absolute volume remains significant at 474 million events, and as more operational technology connects to IT infrastructure, the attack surface is expanding even as attackers grow more selective about where they strike. 

"Manufacturing’s attack surface looks nothing like it did even five years ago, and the security model hasn’t caught up," said Michael Crean, SonicWall SVP of Managed Services. "Every connection added for operational convenience, remote monitoring, predictive maintenance, vendor access to production systems, is also a connection an attacker can walk through. A stolen credential shouldn’t be able to reach the production floor, but in most manufacturing environments today, it can." 

SonicWall’s Manufacturing Protect Brief draws on data from SonicWall’s global network of more than one million security sensors to document the specific attack patterns, legacy vulnerabilities and ransomware campaigns defining the manufacturing threat landscape in the first half of 2026. 

Key Findings from the 2026 SonicWall Manufacturing Protect Brief 

• The Hikvision IP Camera Command Injection vulnerability (CVE-2021-36260), disclosed in 2021, continued to generate 43 million hits in H1 2026, the single largest IoT attack signature across any industry SonicWall tracks.
• IoT attacks were manufacturing’s second-largest attack category by volume, generating 46.2 million hits, with more than half of manufacturing networks detecting exploitation attempts.
• Manufacturing recorded the highest SCADA attack detection rate of any tracked vertical.
• Ten ransomware families were active against manufacturing networks in H1 2026; the Zhen family alone generated 22.2 million hits concentrated on just two devices, a pattern consistent with an active, ongoing incident rather than a broad campaign.
• Apache Log4j2 generated 13.8 million detection events on manufacturing networks, more than four years after the vulnerability was first disclosed.

Unlocked Doors 

Between networked security cameras, industrial sensors, and smart building controls, today's factories are packed with connected devices that were never designed with modern security in mind. They run on old software, are rarely patched, and sit on the exact same networks as critical production lines. This means old vulnerabilities never really go away. For example, a well-known Hikvision camera flaw from five years ago is still one of the most common threats detected on factory networks today. 

The danger multiplied as companies connected their corporate offices to their physical plant floors to allow for remote monitoring and automated maintenance. Because these networks are linked, a single employee password stolen through a phishing email is often all a hacker needs to jump from the front office straight into the systems that control physical machinery. 

"Manufacturing doesn’t have a sophistication problem, it has an architecture problem," continues Crean. "The factory floor is now part of the corporate network. Until we start continuously verifying every user and restricting their access to only the specific apps they need, one stolen password will continue to be enough to shut down a plant." 

The Architecture Problem Has a Known Solution 

The vulnerabilities documented in the Manufacturing Protect Brief are well understood, and the controls that address them exist. SonicWall Cloud Secure Edge applies Zero Trust principles to every access request, granting application-level access only and continuously re-verifying identity and device posture rather than treating a validated credential as a blanket pass to the network behind it. 

For manufacturers managing vendor and maintenance access to production systems, remote monitoring tools and ERP integrations, replacing broad VPN-based access with application-level Zero Trust removes the condition that makes credential compromise consequential: a stolen login no longer grants a path to the systems that run the production floor. 

To learn more, visit SonicWall at www.sonicwall.com.   

About SonicWall 
For more than 30 years, SonicWall has championed a partner-first model that combines purpose-built technology, cloud-delivered security services and real-time threat intelligence to help businesses prevent breaches, reduce risk and stay operational in the face of evolving modern threats. We are committed to deliver the best security outcomes for our customers where others deliver features and functions.  Through its unified cybersecurity portfolio and global community of over 17,000 partners, SonicWall enables managed service providers to actively manage, continuously optimize and measurably protect networks, cloud environments, endpoints and applications. The company is redefining cybersecurity around outcomes that matter to business leaders, including breach prevention, compliance achievement, cost efficiency and reduced human error, because protection is not about what a product can do but about what it actually delivers.