In manufacturing, threats keep multiplying and adding to the monitoring workload. The sector has ranked as the most-attacked sector for five years running and the security arithmetic isn’t getting much better – Common Vulnerabilities and Exposures (CVE) disclosures are on track for a historic annual high and dwell time in industrial ecosystems (the period between infection and attack) is extending past 40 days.

In September, Paessler released a cross-industry survey of more than 1,000 IT leaders and found that just 2 to 5 people are responsible for network monitoring at most midmarket operations. In industrial ecosystems, this means these relatively small teams are expected to simultaneously manage the corporate network, the plant-floor systems that keep production running, and newly connected legacy machinery. Drowning in volume, 58% name anomaly detection as the capability they’d value most, and four in ten want smarter alert noise reduction.

“Doing more with less” is the expectation amid AI-driven, novel threats. To achieve this, lean teams are increasingly looking for ways to let smart systems (safely) shoulder some of the monitoring load.

Network tension between small teams and automated attackers

Our survey found that about 75% of midmarket respondents have just 2 to 5 people responsible for monitoring. Meanwhile, even among large, dispersed organizations with monitoring teams in the double digits, only about one in six bring OT and industrial systems into the same view. This matters because it suggests the plant floor is still largely monitored separately regardless of company size, which can silo data and decision-making.

Although network metrics are usually gathered automatically, most teams struggle to analyze and interpret them. Consider that a traffic spike during a batch run can look identical to something malicious on a fixed threshold. If left unaddressed, false positives like this can quickly pull admins in the wrong direction. Legacy infrastructure compounds the problem by making things more analog and harder to track. Older controllers and protocols add another layer for teams that haven’t yet bridged the cultural and technological differences between OT and IT.

At the same time, manufacturing operates in a much faster-moving threat landscape with AI accelerating the identification of software flaws. Determining which new vulnerability touches what is a tall order, especially when successful breaches cause more damage the longer they go unnoticed.

All of this helps explain why 58% of all respondents (rising to almost two-thirds among decentralized organizations) want anomaly detection. Many feel there are just too many threats across too large a monitoring surface to adequately oversee everything.

Lightening the load with automation

I can certainly see where they’re coming from. For me, teams that let the system take first watch (and preemptively address the low-hanging security fruit) are best placed to protect the scarce resource of admin attention.

The impact is immediately apparent in automated checks and noise filtering. For example, across networks with united IT and OT, smart systems can make it easier to ensure assets run normally (removing the need for duplicate or redundant manual checks) and periodically check software and firmware status. Such automation can also reduce alert fatigue when something does break. If one switch fails, dependency mapping means the team gets one alert rather than separate (and distracting) notifications across the ecosystem.

Establishing clear thresholds for network activity is a good way to define what “normal” looks like. Over time, weekly patterns paint a picture of regular activity. This also works with PLCs by monitoring registers and gateways for scan time, I/O status, CPU and memory indicators. Information from controllers and everything they talk to can suggest regular performance and flag when something’s operating out of the ordinary.

For more serious incidents, smart systems also escalate and loop in the team for a closer look. I've seen this firsthand at a global food processor [https://blog.paessler.com/from-scada-to-sensors-how-prtg-delivers-end-to-end-monitoring-for-ot-environments] that fed PRTG network alerts into its SCADA system, enabling preventative action when a switch supporting a critical refrigeration controller began to fail.

Ultimately, smart monitoring is proving valuable in flagging what needs attention and when. Much of the decision-making – particularly in instances involving control logic and safety systems – remains with the admin for the final say (and rightly so). The major benefit is removing grunt work while keeping a human in the loop.

Rebalancing the security equation in manufacturing

Remember that most automated monitoring relies on a streamlined posture and strong foundation for best results. Before even automating anything, admins should create the conditions for success by understanding what’s under their watch and ranking assets by criticality. Core switches and production-line controllers likely get the tightest watch, especially since hackers target these tried-and-tested production assets knowing that downtime is expensive.

Likewise, baseline a full production cycle before alerting for deviations. Otherwise, shift changes and maintenance windows will surface as false anomalies. And route alerts to the people who own the asset and where they already look, so they don’t have to check a second dashboard.

Teams also need to be realistic: automated monitoring gives manufacturing teams an edge but can’t handle everything. Instead, think of it as another (powerful) tool that buys time and augments judgment rather than replaces it. Review performance and application quarterly and share this with leadership to demonstrate the return on investment.

Here, in furthering the case for greater monitoring resources, loop in compliance. About half our respondents share that compliance is a critical or major factor in how they choose monitoring tools. Logged alerts, uptime records and review notes are key to demonstrating compliance with NIST CSF and SOC 2. Making this paper trail readily available to both company leaders and auditors removes yet another item from admin to-do lists.

Making it work with a team of five

Smaller teams in this sector need to pack a bigger punch. If anything, the security outlook is only getting worse, so monitoring teams of five or fewer need systems that help with the heavy lifting. Understanding performance and surfacing the biggest threats quickly make the difference in this new network normal.