Need to Know

• Manufacturers’ IT and OT departments need to work together to combat AI-enabled hackers
• Danfoss refrigeration controllers and Siemens S7 controllers have shown vulnerability to attack
• Automation companies have partnered with managed detection and response (MDR) vendors to help food plants find exploits

"In 2010, manufacturing had about 8.8 billion connected devices and, in 2025, there are approximately 41.2 billion," said Anand Edke, cybersecurity officer, Siemens, in an August 2026 webinar.

These devices reside in operations technology (OT) environments, but increased IT and OT collaboration is needed to counter AI-enabled hackers finding vulnerabilities in new areas, such as unsecured devices and publicly available control libraries. Moreover, chief financial officers have recognized the serious implications of AI and view investments as operational reliability.

Cybersecurity Investments Seen as Reliability

AI technology and its implications are well understood in today’s manufacturing world, at all levels of food manufacturing. According to Rich Witucki, principal consultant at Dragos Inc., convincing management on OT security is easier now. "The pitch now sounds like a reliability project, and CFOs already know how to fund those," Witucki says. "Every CFO understands what a 12-hour stoppage on a packaging line costs."

Siemens' 2024 True Cost of Downtime report puts unplanned downtime for a typical fast-moving consumer goods plant, including food and beverage, at about $36,000 an hour. Hence, a 12-hour outage approaches half a million dollars before spoiled product is counted. "Ransomware now confirms that number as reality," Witucki adds. "Dragos tracked 119 ransomware groups targeting industrial organizations in 2025, up from 80 the year before, and we don't expect that curve to flatten in 2027."

"The more that a CISO can demonstrate an appreciation of the broader context and speak the language that the audit committee cares about, the stronger the chance that an OT security initiative will speak the love language of CEOs and CFOs and will resonate," said Grant Geyer, chief strategy officer at Claroty in 2025.

"The plant managers I see getting funded walk in prepared knowing two things: the specific failure they want to prevent and what it would cost the business," Witucki adds. "In 2027, I expect more of that spending to be built into modernization and new-line capex from day one."

Dark web groups continue to make headlines in 2026. In July, a hacker group called Anubis claimed responsibility for shutting down production at four Coca-Cola Fairlife facilities for 10 days. The company reported it as ransomware, and the hacker group claimed it stole one terabyte of data from Fairlife and threatened to publish it unless it received an unspecified ransom, according to a Reuters news story.

In August, Claroty's Team82 research team uncovered vulnerabilities in Danfoss refrigeration controllers, showing how a compromised controller could shut off cooling while still reporting normal temperatures to staff. Claroty provides cyber-physical systems protection and asset visibility services that enable brands to map assets automatically and virtually segment networks.

"According to our research, refrigeration controllers are a prime target that often go overlooked by security teams," says Aamir Preminger, CTO of Claroty. "The compromise of refrigeration infrastructure can have severe operational consequences for many different types of organizations – supermarkets, cold-storage facilities, warehouses, pharmaceuticals, chemical manufacturing, and more."

Siemens S7 series of controllers also didn’t escape headlines this summer as hackers continued to target the S7 control platform, which has a large installed base at food and beverage plants. The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) released a Cybersecurity Advisory in late August to warn owners and operators of an active cyber threat to Siemens S7 Series PLCs and provide relevant mitigations to protect and defend them.

Hackers have accessed the control platform’s Snap7 libraries and extracted data from the communications module. The 2026 Dragos OT Cybersecurity Report, released earlier this year, reports that a Python-based tool forces Siemens S7-300/S7-400 PLCs into STOP mode via the Snap7 communications protocol.

The report says 45% of S7 PLCs are vulnerable older models, and one reason attacks are accelerating is that ICS protocols lack authentication and their libraries are publicly available.

"The S7 communication security vulnerability has been known, but it can be exploited even more easily through AI," added Michael Grollmus, CEO at Grollmus, in a video report. "You can create software using a large language model that can locate S7 controllers without writing a single line of code, stop an S7-300 and manipulate values in a data block."

How IT and OT Can Recognize Asset Exploits

Many automation companies, including Siemens and Emerson, have partnered with numerous managed detection and response (MDR) vendors to help food plants find exploits. Emerson also offers OT asset inventory through its Guardian Digital Platform, but relational asset context on the production line is becoming increasingly important.

"We help companies answer which devices can actually change what happens on the production line," Witucki adds. "Knowing how each device behaves and which processes it supports tells you when something has changed and whether it matters."

Dragos offers xOT, or Extended Operational Technology, a new solution for securing the full operational environment based on operational impact rather than device category. The solution includes PLCs and HMIs, plus the surrounding systems that influence the process: packaging robots, refrigeration controls, IIoT sensors, remote access gateways and the IP camera watching the loading dock.

The dramatic increase in connected devices has challenged OT leaders and IT departments. "The (security) programs that hold up are the ones where operations get an equal vote," Witucki says. "IT tends to own the security budget and staff, and it has a fair claim to the lead: roughly 70% of OT incidents originate in IT, according to Dragos’s annual OT Cybersecurity Report."

In a 2025 cybersecurity webinar from FOOD ENGINEERING, the session revealed that 33% of webinar attendees had executed an OT cybersecurity risk assessment, while IT-focused cybersecurity risk assessments came in at 55%.

Successful mitigation depends on IT leaders, plant managers and engineers working together to leverage plant-floor equipment expertise. IT needs to hand over operational decisions to plant leaders.

Many companies dealing with legacy networks bring in outside experts to help with architecture reviews and tabletop exercises. "In a tabletop, the hardest question tends to be who has the authority to stop a production line. Plenty of teams have never settled it," Witucki adds. "Through 2027, I'd expect more manufacturers to name an operations lead on the security program."