.png?width=900&name=Breaking%20News%20(1).png)
Key Points
- Ransomware attacks on industrial firms rose 87% in 2022, and A&D suppliers are a primary target.
- Hackers pursue four goals in this sector: IP theft, supply chain infiltration, physical equipment compromise, and ransomware for financial gain.
- Security at all levels means every employee, every process, and every network segment — not just the IT department.
- Industrial environments are especially exposed because operational technology (OT) networks often lack basic segmentation and monitoring.
- A&D suppliers who treat cybersecurity as an engineering and operations problem — not just a compliance checkbox — will be better positioned as requirements tighten.
The Deloitte Take — and What It Means for Suppliers
Deloitte published a perspective piece asking where aerospace and defense companies should focus to better mitigate cybersecurity threats. The piece targets enterprise leadership. The data it surfaces, though, has direct consequences for precision manufacturers and component suppliers sitting deeper in the A&D supply chain.
The framing matters. Deloitte identifies supply chain infiltration as one of four primary hacker objectives — alongside IP theft, physical equipment compromise, and ransomware. If you're a Tier 2 or Tier 3 supplier to a prime contractor, you are not a bystander to this threat. You are a target.
See It In Action:
- DoD Telecommunications Case Study: How Modus Advanced supported a defense telecommunications program with precision manufacturing and compliance-ready processes
- Medical Device Manufacturing Case Study: Quality systems and documentation discipline applied to a mission-critical manufacturing program
What the Data Actually Says
The numbers Deloitte cites are worth sitting with. According to a Financial Post report cited in the piece, ransomware attacks on industrial firms increased 87% in 2022. The number of ransomware groups specifically targeting operational technology systems and networks grew 35% in the same period.
Jason Hunt, senior manager in Risk Advisory at Deloitte US, put it plainly: "As we add additional network connectivity to enable smart manufacturing and operations, we must keep cybersecurity front of mind, as this connectivity can provide a bad actor easier access to vulnerable systems in industrial environments."
That's the core tension for manufacturers right now. Smart manufacturing requires connectivity. Connectivity expands the attack surface. Closing that gap takes deliberate architectural choices, not just better passwords.
Hunt also noted that industrial environments frequently lack basic controls: limited network segmentation, no active monitoring of operational systems, and relaxed access management for privileged users. These aren't exotic vulnerabilities. They're gaps attackers already know how to exploit.
Essential Background Reading:
- Guide to CMMC: A foundational overview of the Cybersecurity Maturity Model Certification framework and what it requires of defense suppliers
- Aerospace & Defense Manufacturing at Modus Advanced: Overview of precision manufacturing capabilities built for mission-critical A&D applications
- CMMC Certified Manufacturing: How CMMC certification integrates with manufacturing operations and quality systems
Why Industrial OT Environments Are the Exposed Flank
Most cybersecurity conversations in the A&D sector start with IT systems. That's where the classified data lives, where email phishing lands, where endpoint protection gets deployed. IT security has matured significantly over the past decade.
Operational technology is a different story. CNC equipment, dispensing systems, and production control infrastructure were designed for reliability and uptime — not network security. Many of these systems run on legacy software with limited patch support. Some can't be patched at all without disrupting production.
This is where the Deloitte piece's point about enterprise architecture becomes directly relevant to aerospace and defense manufacturers. Network segmentation between IT and OT environments, monitoring for anomalies in production systems, and strict access controls for anyone touching manufacturing equipment aren't optional hardening measures. They're foundational.
The table below summarizes the risk profile differences between IT and OT environments in a manufacturing context.
| Factor | IT Environment | OT/Manufacturing Environment |
|---|---|---|
| Primary asset | Data, systems | Physical production, equipment |
| Patch cadence | Regular, automated | Infrequent, often manual or deferred |
| Downtime tolerance | Low | Very low to none |
| Monitoring maturity | High | Often minimal |
| Attack consequence | Data breach, ransomware | Production halt, physical damage |
| CMMC applicability | Directly applicable | Increasingly in scope |
Related Content:
- CMMC Certified CNC Machining: How CMMC requirements apply specifically to CNC machining environments and production systems
- CMMC Certified FIP Gasket Dispensing: CMMC compliance applied to form-in-place gasket dispensing operations on the production floor
- CMMC for Subcontractors: What subcontractors and Tier 2/3 suppliers need to know about CMMC flowdown obligations
- DFARS and CMMC Resources: A curated resource center covering DFARS clauses and their relationship to CMMC requirements
What Suppliers Should Be Doing Right Now
The Deloitte piece emphasizes a security-at-all-levels culture and enterprise architecture alignment. For manufacturers, those principles translate into specific operational decisions, and some of them are overdue.
The following areas represent the highest-leverage points for A&D suppliers working to close their exposure:
- Network segmentation: Isolate OT systems from general IT networks. A compromise in your email environment should not be able to reach your production floor controllers.
- Access controls: Limit privileged access to manufacturing systems to personnel who genuinely need it. Audit those access lists regularly.
- Monitoring and detection: Deploy anomaly detection on OT networks. If something unusual is happening on a CNC controller or a dispensing cell, you need to know before it affects production.
- Incident response planning: Document what happens when a system is compromised. Who gets called, what gets isolated, what the recovery path looks like. The plan needs to exist before the incident.
- Vendor and supply chain vetting: Your suppliers have access to your systems and sometimes your CUI. Their security posture affects your compliance status.
CMMC Level 2 certification, required for defense contractors handling Controlled Unclassified Information, addresses many of these gaps through the 110 practices mapped to NIST SP 800-171. Certification is a floor, not a ceiling.
Next Steps:
- CMMC Resource Center: Deep-dive resources on CMMC levels, practice requirements, and what certification means for your supply chain
- CMMC Level 2 Requirements: A detailed breakdown of the 110 NIST SP 800-171 practices required for Level 2 certification
- Manufacturing Partner Evaluation Scorecard: A structured tool for evaluating whether a manufacturing partner meets your program's security and quality requirements
- Custom Manufacturing Services Resource Center: Overview of Modus Advanced's full manufacturing capability set for defense and aerospace programs
The Compliance Angle Is Real, but It's Not the Point
Deloitte's piece focuses primarily on strategic risk for enterprise A&D organizations. The practical reality for suppliers is that regulatory pressure from CMMC, combined with increasing prime contractor flowdown requirements, means cybersecurity posture is becoming a contract qualification question.
Suppliers who treat this as a box-checking exercise will find themselves exposed twice: once to actual threat actors, and once to customers who start requiring evidence of genuine program maturity, not just a certification letter.
A mature cybersecurity program and a well-run manufacturing operation share the same underlying discipline. Documented processes, controlled access, systematic monitoring, and a culture where every person understands their role in maintaining integrity. Those attributes show up in quality systems, in manufacturing efficiency, and in how well a supplier handles an audit.
At Modus Advanced, CMMC Level 2 certification is part of our quality infrastructure alongside AS9100 and ISO 9001. The engineers and program managers we work with are accountable for what their supply chain does, not just what it delivers. When lives depend on the systems you're building, your suppliers need to be part of the solution. Let's solve this together.
