Manufacturers are getting better at fixing known software flaws, but a new report shows they are still leaving the door open through weak identity and access controls, and ransomware crews are taking notice.
Cyber risk firm Black Kite released two reports this month examining the sector’s largest companies: one focused on baseline security hygiene, the other on ransomware trends across manufacturing and distribution. Together, they paint a picture that should factor into cybersecurity risk management for any organization handling sensitive data or supporting a supply chain, not just manufacturers.
The Numbers Behind Manufacturing Cybersecurity Today
Black Kite scanned the 1,000 largest manufacturing firms and found real improvement alongside real exposure:
- Roughly three-quarters of firms were running software with at least one critical vulnerability, down from 80 percent in 2024
- Exposure to vulnerabilities that the Cybersecurity and Infrastructure Security Agency has confirmed hackers are actively exploiting fell from 67 percent to 54 percent
- Employee or system credentials tied to roughly 70 percent of the manufacturers analyzed were found for sale on the dark web, the product of information-stealer malware
- More than one-third of firms showed signs of botnet infections, close to three in ten had already experienced a data breach, and nearly half had been impersonated in phishing campaigns
Identity Is the Weak Link Patching Cannot Fix
The pattern is telling. Manufacturers have made real headway closing known software vulnerabilities, the kind of gap a patch management program is built to catch. Identity and access management is a different discipline entirely, and it is where the sector is falling short. Stolen credentials, one of the most common cyber attack vectors, do not require an attacker to find an unpatched system; they only require one employee’s login to end up in a criminal marketplace.
Researchers have also pointed to a related gap: many manufacturers still lack the automated provisioning and de-provisioning that would catch former employees, contractors, or seasonal workers whose access should have been cut off but was not. Add in weak email authentication, more than one-third of firms had not properly configured their anti-spoofing controls, and the openings multiply well beyond what patching alone can close.
Why Mid-Sized Manufacturers Are in the Crosshairs
Manufacturing has ranked as the most targeted sector in Black Kite’s broader ransomware research for four consecutive years, accounting for over one-fifth of all publicly disclosed ransomware victims. Attacks on manufacturers climbed nearly 40 percent year over year in the first seven months of 2026 alone, and roughly seven in ten victims generated between $10 million and $100 million in annual revenue.
That is not the largest, most defensible tier of the industry; it is the mid-sized supplier layer that larger companies depend on to keep production moving. When one of those suppliers goes down, the disruption does not stay contained, which is why knowing how to prepare for a cyberattack matters as much for a supplier as for the manufacturers that depend on it.
“These numbers describe a sector that is patching the vulnerabilities it can see and missing the credentials it cannot,” said Joshua Schmidt, Partner, Cyber and IT Advisory at BPM. “Identity and access gaps do not show up on a vulnerability scan, which is exactly why so many manufacturers have gone this long without addressing them.”
Close the Gap Patching Alone Cannot Reach
If your patching program is solid but you cannot say with confidence who has access to what, or whether a departed employee’s credentials are still active, you have the same exposure Black Kite is describing. That is a gap a one-time vulnerability scan will not surface.
BPM’s cybersecurity services pair hands-on assessments that map both your software vulnerabilities and your identity and access practices with Managed IT services that keep the fixes in place: credential reviews, de-provisioning, monitoring, and documentation that holds up when a customer, an insurer, or a regulator asks how you manage access.
Connect with BPM’s Cybersecurity team to find out whether your identity and access controls are keeping pace with your patching program, before an attacker finds out first.