MANUFACTURING CYBERSERCURITY RESEARCH
Manufacturing Network Exposure: Why Internet Facing Systems Create Risk
As part of its research, Accent Consulting analyzed 1,625 anonymized cybersecurity findings from 21 manufacturing organizations between 2023 and 2026. Across the assessed organizations, the findings included open RDP ports, firewall issues, and network weaknesses that may increase exposure to manufacturing systems.
What is Network Exposure in Manufacturing?
Network exposure occurs when a system, service, device, or port can be reached from outside an organization.
For example, an internet-facing server, open RDP port, public web service, cloud application, or remote-access tool may create a path into a business or manufacturing environment.
Some public services are necessary for business operations. However, each exposed service should have a clear purpose, strong protection, an owner, and regular review.
Why Does Network Exposure Matter?
Attackers can scan internet-facing systems from almost anywhere. They may look for open ports, weak passwords, old software, poor firewall rules, or exposed remote-access tools.
Exposure does not prove that an attack occurred. Instead, it shows that a system or service may be reachable and should be reviewed.
Therefore, manufacturers should know:
- which systems are visible from the internet;
- why each system is exposed;
- who owns the system;
- what the system can reach; and
- whether the exposure is still needed.
Why Manufacturing Network Exposure Often Starts Quietly
Most manufacturers do not intentionally leave their environments exposed. Instead, exposure can develop as teams add remote access, publish business services, open network ports, or connect systems to support daily work.
For example, a support team may need temporary access to a system. A vendor may need a remote connection to maintain equipment. A project team may open a service during testing and forget to close it later.
Over time, these changes can create unnecessary paths into the environment. The concern is not only the open port. It is also what the service can reach and what could happen if someone gains access.
Accent Consulting analyzed 1,625 anonymized cybersecurity findings from 21 manufacturing organizations. The research identified 60 open RDP ports and 118 firewall and network vulnerabilities.
Network and firewall-related findings represented 7% of the total findings in the research sample. This percentage describes the assessed organizations. It does not represent every manufacturing environment or prove that an attack occurred.
For manufacturers, the key question is simple: which public systems are necessary, and how well are they protected?
21
manufacturing organizations assessed.
7%
of identified findings were network or firewall-related.
60
Open RDP
Ports Identified
118
firewall and network vulnerabilities identified.
Source: Accent Consulting analysis of 1,625 anonymized cybersecurity findings from assessments of 21 manufacturing organizations conducted between 2023 and 2026.
WHERE MANUFACTURERS DIFFER
How Network Exposure Can Affect Manufacturing Operations
Internet-facing systems can create a direct path into a manufacturing environment. When attackers find a public system, they may test its login controls, software, ports, and settings.
If the system has a weakness, an attacker may try to use it to reach other systems. The risk becomes greater when an exposed system connects to production systems, engineering applications, business applications, remote administration tools, sensitive data, or operational technology.
For example, an exposed business system may not control production directly. However, it may connect to systems that support engineering, maintenance, or daily operations.
As a result, manufacturers should review both the exposed service and the systems behind it. The goal is not to remove every internet connection. Instead, the goal is to keep only the services that are needed, protect them well, and review them often.
NETWORK SEGMENTATION
Why IT and OT Separation Is Important
Manufacturers should separate information technology, or IT, from operational technology, or OT, when possible.
IT systems support business work, such as email, finance, and user devices. OT systems support production, including control systems, sensors, engineering tools, and plant equipment.
When these networks connect without strong controls, a problem in one area may affect the other. Therefore, manufacturers should use firewalls, access controls, traffic rules, and monitoring to control connections between IT and OT.
Strong network boundaries can limit the spread of an attack and reduce the chance that an internet-facing issue affects production.
How IT and OT Network Segmentation Works
A segmented manufacturing network separates business systems from production systems. Firewalls, controlled connections, traffic filtering and monitoring help manage the data that moves between these environments.
The exact design will vary by organization. However, every manufacturer should know which systems can communicate, why they can communicate and how that traffic is monitored.
Example: IT and OT systems should use controlled network boundaries rather than unrestricted connections.
REMOTE ACCESS AND PERIMETER CONTROL
Why Open RDP and Weak Perimeter Controls Create Risk
Remote Desktop Protocol, or RDP, allows users to connect to Windows computers from another location. However, open RDP ports and weak firewall rules can give attackers a path into manufacturing systems.
The research identified 60 open RDP ports and 118 firewall and network vulnerabilities. These findings do not prove that an attack occurred. Instead, they show why manufacturers should review public services, open ports, remote access and firewall rules regularly.
Manufacturers should close unused ports, remove outdated firewall rules, use MFA, limit access, and monitor remote connections. In addition, every public service should have a clear business reason and a designated owner.
PERIMETER GOVERNANCE
What the data suggests about perimeter governance.
Accent Consulting identified 118 firewall and network-related findings, along with publicly reachable services and exposed ports. These findings suggest that perimeter risk is not limited to one protocol or tool. Instead, it can develop when old firewall rules, temporary exceptions, inherited settings, or unused services remain active longer than needed.
Over time, these gaps can create more paths for scanning, password attacks, and unauthorized access. Public management interfaces, exposed database ports, and unprotected web traffic may increase that exposure.
For that reason, manufacturers should regularly review public services, open ports, firewall rules, remote-access tools, and network traffic. Each exposed service should have a clear business purpose, a responsible owner, and the right security controls.
How IT and OT Network Segmentation Works
Internet-facing ports and public services can provide different paths toward internal systems. The risk depends on the service, its security settings, the accounts that can use it, and the systems it can reach.
Manufacturers should review each exposed port, confirm that it has a current business purpose, and close or restrict it when it is no longer needed.
Example: A public service may create a path toward internal servers, databases, or business applications when perimeter controls are weak.
COMMON QUESTIONS
How Manufacturers Can Reduce Network Exposure
What are the best practices for managing internet exposure?
Effective internet-exposure management starts with visibility and regular review. Manufacturers should maintain an inventory of internet-facing systems, close unused ports, secure remote access, review firewall rules and monitor public services.The goal is not to remove every internet connection. Instead, manufacturers should reduce the number of services attackers can find and test.
How can manufacturers improve perimeter security?
Manufacturers can improve perimeter security by limiting internet-facing services, closing unnecessary ports, using MFA, securing remote access, and reviewing firewall rules. In addition, teams should separate IT and OT networks when possible and control the traffic between them. Each exposed service should have a clear business purpose, a responsible owner, and regular review.
What are the biggest internet exposure challenges in manufacturing?
Common challenges include older systems, open ports, weak firewall rules, public remote-access tools, vendor connections, cloud services and unclear system ownership. Because manufacturing systems may require access for support and maintenance, teams must balance security with uptime. However, every connection should have a valid business reason and appropriate controls.
Why are open RDP ports a manufacturing risk?
Open RDP ports allow attackers to find and test remote login services from the internet. If an attacker obtains valid credentials or finds a system weakness, the connection may provide access to a computer or other systems. Therefore, manufacturers should avoid direct public exposure when possible and use secure gateways, MFA, limited access, monitoring and regular reviews.
How can manufacturers reduce ransomware risk through perimeter security?
Manufacturers can reduce ransomware risk by closing unused ports, limiting internet-facing services, securing remote access, using MFA, separating IT and OT networks, applying patches, monitoring important systems, and maintaining tested backups. Perimeter security is only one part of ransomware defense. Identity security, patch management, endpoint protection, network monitoring, recovery planning and response exercises also matter.
LEADERSHIP NEXT STEPS
Reduce the Paths Attackers Can Reach
Start by identifying internet-facing systems, reviewing open ports, securing remote access, and improving the controls between IT and OT networks.
Accent Consulting can help your organization assess external exposure, review firewall and network risks, and build a practical plan to reduce unnecessary access paths.