The factory floor has never been more intelligent, or more exposed. Automation, cloud-connected platforms, advanced robotics, and AI can improve productivity and operational resilience while transforming how manufacturers compete.

At the same time, they introduce new exposure across information technology (IT), operational technology (OT), third-party connectivity, and industrial data environments. While the tech transformation momentum is real, so is the risk that comes with it. 

Every new connection can create another path for an attacker. Frontier AI, the most capable emerging AI models, can help threat actors accelerate vulnerability discovery, exploit development, and attack planning, increasing pressure on response processes built around human-paced analysis and approvals.

For a sector in which a cyber incident can disrupt production, compromise safety or quality, expose intellectual property, and affect the broader supply chain, the stakes are especially high. The question manufacturers face today isn't whether their connected operations can be targeted. It's whether they'll be able to understand what's happening and act fast enough to remediate. 

Frontier AI has changed the rules

These capabilities can compress parts of the attack lifecycle, leaving manufacturers less time to assess exposure and act. Where remote access, exposed systems, or weak segmentation create a path into connected operations, the consequences can extend beyond IT into production environments. As factories adopt more sophisticated technologies such as digital twins, robotics and physical AI, protecting these systems is increasingly critical amid these advanced AI capabilities and threats. 

Yet many manufacturers still rely on response processes designed for legacy environments with fragmented asset visibility, manual prioritization, and unclear decision rights across cyber, operations, engineering, and business leadership. 

In this environment, a compromised system doesn't just mean a data breach. It can mean a halted production line, a safety incident, exposed IP, or cascading failures across suppliers and customers.

Closing the operational response gap

The deeper issue isn't just that attacks are getting faster but rather that most manufacturers haven't redesigned their response models to keep up. What’s more, organizational complexity creates additional friction. Security teams, plant operators, engineering leaders, technology teams, and third-party partners may each own part of the response process, but often no single group is positioned to make rapid, enterprise-wide decisions.

Meanwhile, workforce shortages continue to challenge the sector, with approximately 2.3 million manufacturing job openings anticipated between 2025 and 2030, according to Deloitte’s Expanding the Skilled Manufacturing Workforce with AI report.

Resilience in a frontier AI environment is not simply a matter of countering AI-enabled attacks with more AI. It requires secure technology and an operating model that brings together visibility, clear decision authority, and safe, timely action.

Five steps manufacturers can take now to secure the connected factory

Manufacturers can start with five practical actions:

1. Establish unified governance across cyber, operations, and engineering

It’s important for smart manufacturing teams not to operate in silos. Bring together cybersecurity leaders, plant operations, engineering, and business leadership in a standing forum to review exposure, set remediation priorities, and define escalation paths and pre-authorize response actions within agreed safety limits. Resilience requires shared accountability, not just shared awareness.

Assign a named decision owner for each response action and define in advance who can isolate equipment, restrict vendor access, or authorize a production interruption, including the conditions requiring operations and safety approval.

2. Map what actually matters

Not every vulnerability is equal. Start by identifying the systems and processes whose disruption would have the greatest operational consequences, such as production lines, safety systems, quality controls, supply-chain interfaces. Use that operational context to drive prioritization. Treating every alert as equally urgent is a fast path to decision fatigue and missed critical threats.

3. Use AI to strengthen your defense but with guardrails

The same AI capabilities accelerating attacks can also serve as defense. AI-enabled tools can support vulnerability triage, anomaly detection, attack-path analysis, threat correlation, and remediation sequencing. Governance and human oversight must guide deployment.

Define least-privilege access and permitted actions for AI agents, require human approval for high-consequence changes, maintain auditable action logs, and provide a way to suspend agent access. Validate the complete AI-enabled workflow in an isolated environment representative of OT conditions before deployment.

4. Build and test a response model designed for machine-speed threats

Tabletop exercises aren't enough. Test your IT/OT visibility, segmentation, privileged-access controls, and incident playbooks in controlled environments with real, measurable use cases. Track metrics that reflect operational reality, including time to triage, time to authorize action, time to contain, time to restore safe operations, remediation latency, third-party exposure, and production impact.

Apply these learnings and continuously rehearse and update to be as prepared as possible when a real incident occurs. Faster response does not mean making untested changes to production systems. Where immediate patching is unsafe or impractical, use validated containment measures and compensating controls until remediation can be completed safely.

5. Share cybersecurity knowledge across the workforce

AI tools can help experienced operators and technicians make more informed security decisions in the moment, extending specialized knowledge to a broader workforce. Pair that capability with clear training programs, defined escalation paths, and regular workforce exercises so your people are as prepared as your technology.

Manufacturers shouldn't wait for a major incident or a new frontier model to reveal the distance between detection and response. The enterprises best positioned to lead will close that gap proactively through better visibility, clearer decision rights, stronger workforce capabilities, and AI governance built into the operating model from the start. The threats are moving at machine speed. The priority is to turn available capabilities into a tested, accountable response model that protects production and safety.