Shining a light on cyber threats hiding on the plant floor
What happened
Dragos By Nicholas Tangey* Friday, 10 April, 2026 Each year we analyse threat data from across the industrial sector and publish what we find. In 2025 one pattern stands out: manufacturing remains the most targeted industrial sector for ransomware. This matters for MRO & Site Consumables because capacity and lead-time signals can move supplier prioritization, award timing, and contingency lanes with 10, 2026, 2025 as the clearest commercial anchors; buyers should plan for minimum order changes
Buyer takeaway
For MRO & Site Consumables, this is a staffing-shape signal: remote operating models can shift work offsite and change which suppliers, systems, and service levels matter most
Cost / money
The cost angle is directional, not quantified: moving work offsite can cut travel, rotation, and accommodation exposure, but only if the remote setup stays reliable
Supplier / commercial
Expect scope to move toward software support, communications uptime, cyber obligations, and clearer downtime liability instead of only offshore headcount or hardware supply
Safety / operations
Fewer people offshore can reduce exposure and emergency-response load, but the operating model becomes more dependent on connectivity resilience, remote support readiness, and cyber hygiene
What to watch
Watch bandwidth resilience, latency tolerance, cyber obligations, and who carries downtime cost if the remote link drops
Key facts
- Dragos By Nicholas Tangey* Friday, 10 April, 2026 Each year we analyse threat data from acros
- In 2025 one pattern stands out: manufacturing remains the most targeted industrial sector for
- The Dragos 2026 OT/ICS Cybersecurity Report tracked 119 ransomware groups targeting industria
- A compromised supplier or vendor connection can become an entry point across multiple sites
