Manufacturing is the most targeted sector for ransomware, with attacks rising 56% year over year, according to OPSWAT. Verizon’s 2025 Data Breach Investigations Report recorded 1,607 confirmed breaches in manufacturing, an 89% increase. Up to 80% of new ransomware is now AI-generated, according to industry estimates cited by OPSWAT, and smart factory technologies adopted in 2026, including Unified Namespace (UNS), MQTT, Industrial DataOps, and agentic AI, are creating new exposure points as they connect previously isolated systems.
Where the New Attack Surface Sits
The convergence of IT and OT in AI-connected factories expands the perimeter beyond traditional network boundaries. Every file shared with a supplier, every firmware update delivered by USB, every contractor laptop plugged into an OT network represents a potential entry point. Roughly a quarter of OT incidents still involve removable media and transient devices, according to OPSWAT’s analysis. A plant operator plugging a personal phone into an HMI to charge it can unintentionally create a network bridge that bypasses an air gap in seconds.
Attackers have also shifted strategy. Modern campaigns increasingly prioritize data theft and extortion over pure encryption. Stolen designs, formulations, and operational telemetry can be resold, reused, and used to train future attack models, creating longer-term damage than a production halt.
What Readiness Looks Like in 2026
According to Matt Wiseman, Senior Director of Product Marketing at OPSWAT: “Legacy manufacturing systems and security procedures were not designed or implemented with ever evolving AI threats in mind. It is critical to frequently re-evaluate your process and security controls against the latest AI threats.”
OPSWAT’s analysis points to a growing investment mismatch: fewer manufacturers plan to invest in OT cybersecurity during automation initiatives, even as the threat surface expands. The full article recommends treating security as a precondition for AI adoption rather than a follow-on project, hardening the physical perimeter around transient devices, favoring outbound-only data architectures, and aligning with IEC 62443, NIST SP 800-82, and NIS2. OPSWAT also details how its MetaDefender platform addresses these risks and announces an upcoming webinar on manufacturing cybersecurity in the AI age.
Read the full article on OPSWAT.com.
Sponsored by OPSWAT.
Frequently Asked Questions
1. Why is manufacturing the top target for AI-generated ransomware?
Manufacturing is the most targeted sector for ransomware, with attacks rising 56% year over year. Up to 80% of new ransomware is AI-generated, according to industry estimates cited by OPSWAT. Smart factory technologies adopted in 2026, including UNS, MQTT, and agentic AI, connect previously isolated OT systems and create data flows that legacy security architectures were not built to inspect.
2. How should manufacturers secure AI-connected factories against ransomware?
OPSWAT recommends treating cybersecurity as a precondition for AI adoption, hardening the physical perimeter around removable media and transient devices, favoring outbound-only data architectures, and aligning with IEC 62443, NIST SP 800-82, and NIS2. Roughly a quarter of OT incidents still involve removable media and transient devices.
