Skip to content
info@rootsektor.de
24/7 emergency: +49 2932 465265-0 Request a pentest quote Report an emergency
Emergency

Contact

Phone & 24/7 emergency hotline+49 2932 465265-0 Emailinfo@rootsektor.de

Mon–Fri 8:00 a.m.–5:00 p.m. CET/CEST · outside business hours: 24/7 emergency hotline

Request a pentest quote Report an emergency

Industries

Cybersecurity for Manufacturing & Industry

Secure production. Protect know-how.

Connected machinery, remote maintenance, and ERP integrations make your production efficient – and vulnerable. Effective cybersecurity for manufacturing starts with knowing where you stand: our penetration test shows how well your production environment is protected and whether attackers could make their way from office IT to your machines. For machine builders, manufacturers, and automotive suppliers – in Germany and internationally.

  • Fixed price after scoping
  • Free retest
  • Quote within 24 hours
Request a pentest quote Schedule a consultation

Challenges

Cybersecurity for manufacturing: the challenges

For a long time, production networks were isolated. Today, MES, ERP, cloud services, and remote maintenance access connect the shop floor to the outside world. A single compromised user account or an open maintenance access point can become an entry point – potentially bringing entire production lines to a standstill.

  • Challenge 1

    Legacy equipment that is hard to patch

    Controllers, operator panels, and control systems often run on outdated operating systems for many years. Updates are only possible during maintenance windows or have not been approved by the manufacturer – which makes segmentation and hardening all the more important.

  • Challenge 2

    Valuable know-how

    Design data, CAD models, formulations, and production parameters are attractive targets for industrial espionage. The GeschGehG (German Trade Secrets Act) only protects information as a trade secret if it is safeguarded by appropriate confidentiality measures.

  • Challenge 3

    Costly downtime

    A ransomware attack can paralyze production for days. In just-in-time supply chains, this immediately hits your customers as well – complete with delivery delays and contractual penalties.

How well is your production environment isolated?

Tell us about your machinery, networks, and remote maintenance access. We’ll propose a scope that fits your maintenance windows and security requirements.

Schedule a consultation

Benefits

Benefits of penetration testing for manufacturing and industry

No network diagram can tell you whether the firewall between your offices and the shop floor really keeps them apart – only a hands-on attempt can. A penetration test reveals which paths an attacker could actually take and which measures reduce your risk the most.

  • Identify attack paths into production

    We check whether an attacker could get into production networks from the office network, via VPN, or through remote maintenance – and whether your IT/OT segmentation, the cornerstone of OT security, holds up in practice.

  • Prevent downtime

    Ransomware spreads through weak passwords, unpatched servers, and overly permissive networks. We show you these paths so you can close them before a production line comes to a standstill.

  • Protect know-how effectively

    We test whether unauthorized parties could access design data, formulations, or development projects – and provide evidence of appropriate protective measures.

  • Evidence for customers and audits

    The report and test certificate document your security measures for OEMs, auditors, and insurers – for example, for TISAX, NIS2, or ISO/IEC 27001.

Services

Services for manufacturing and industry

We combine the tests that fit your production – from the control level to the supplier portal.

  • OT, ICS/SCADA & IoT

    Controllers, operator panels, SCADA and process control systems, and industrial protocols such as Modbus/TCP, PROFINET, or OPC UA – with passive analysis before every active step.

  • Network & Infrastructure

    External and internal infrastructure, firewalls between office and production networks, VPN gateways, and remote maintenance routers.

  • Active Directory Assessment

    Active Directory is often the key to engineering workstations and production servers. We uncover misconfigurations and attack paths.

  • Web Applications & Online Shops

    Supplier and dealer portals, B2B shops, and the web interfaces of MES and ERP systems.

  • Code Review & Reverse Engineering

    Do you build connected machines or components? We analyze the firmware, interfaces, and source code of your products.

  • Social Engineering & Physical Testing

    Access to your plant premises, phishing aimed at purchasing and accounting, or rigged USB sticks – we test the human factor.

Compliance

Regulations and standards in manufacturing

Penetration tests provide technical evidence for audits, customer requirements, and legal obligations. They do not replace a certification or a conformity assessment.

  • Industrial automation

    IEC 62443

    This series of standards describes the security of industrial automation and control systems. At its core is the division of facilities into zones and conduits with defined security levels. Our tests show whether this separation withstands a targeted attack.

    • Testing of zone transitions, firewall rules, and remote access
    • Technical evidence for system requirements under IEC 62443-3-3
    • Component tests for manufacturers as a building block for IEC 62443-4-2 and the Cyber Resilience Act

  • Legal obligations

    NIS2 & BSIG

    The NIS2 Directive (EU) 2022/2555 covers large parts of the manufacturing sector for the first time, such as machinery and vehicle manufacturing or the electrical industry. In Germany, the directive is implemented through the amended BSI Act (BSIG) – the law governing Germany’s Federal Office for Information Security (BSI).

    • Risk management under Art. 21, including an assessment of its effectiveness
    • Approval and oversight of the measures by management
    • Supply chain security – requirements also reach suppliers

  • Automotive & ISMS

    TISAX & ISO/IEC 27001

    Many car manufacturers require their suppliers to hold a TISAX label based on the VDA ISA catalog, which is aligned with ISO/IEC 27001. The assessment itself is carried out by an approved audit provider.

    • Evidence of technical vulnerability management (ISO/IEC 27001:2022, Annex A 8.8)
    • Testing of network separation and hardening
    • Physical tests for prototype protection

How your manufacturing pentest works

The safety and availability of your equipment take priority in every phase. Our methodology is the same across all industries – pace, testing techniques, and time windows are tailored to your production.

Initial consultation

You tell us about your production, networks, and goals. If you wish, we sign a non-disclosure agreement beforehand.

Scoping with production and maintenance

Together, we define systems, exclusions, testing techniques, and maintenance windows – and who may stop the test immediately if in doubt.

Fixed-price quote within 24 hours

Within 24 hours of scoping (on business days), you receive a fixed-price quote – with no extra charges for the agreed scope.

Careful testing

We start passively, move step by step to active tests, and coordinate sensitive steps with your contact person. We report critical vulnerabilities immediately – during the test, by phone or email to the agreed contact person.

Report and debrief

An executive summary, technical details with CVSS ratings, and measures prioritized by their importance for your production. If you wish, we discuss the results with IT, production, and management.

Retest and test certificate

We retest remediated vulnerabilities free of charge. At the end, you receive a test certificate to present to customers, auditors, and insurers.

FAQ

Frequently asked questions about penetration testing in manufacturing

Didn’t find your question? Call us at +49 2932 465265-0 or email info@rootsektor.de.

Will a penetration test put our ongoing production at risk?

Careful planning keeps the risk as low as possible. For each system, we decide together with you whether we test it actively, only observe it passively, or leave it out entirely. We schedule sensitive steps during maintenance windows or downtime, or perform them on identical test systems – and your contact person can stop the test at any time.

Do you also test PLCs, HMIs, and SCADA systems directly?

Yes – with particular caution. We start with a passive analysis of network traffic and configurations and only move on to active tests after explicit approval, preferably on test or spare components. Often, the decisive vulnerabilities lie at the transitions anyway: in remote maintenance, engineering workstations, and insufficient segmentation.

Do you also test our machine manufacturers’ remote maintenance access?

Yes, because external maintenance access is a typical gateway into production networks. We check how access is implemented – via VPN, remote maintenance router, or cloud portal – and whether it uses multi-factor authentication, is time-limited, and is restricted to individual machines. We also show how far an attacker could get with compromised maintenance access.

We’re an automotive supplier. Will the pentest help us with TISAX?

A penetration test does not replace a TISAX assessment, but it provides solid evidence for requirements of the VDA ISA catalog – for example, on handling technical vulnerabilities, network separation, and prototype protection. Our report documents scope, methodology, findings, and measures in a traceable way. You can present the test certificate to your audit provider and your customers.

Does NIS2 apply to our company?

That depends on your activities and size. Covered entities include manufacturers of machinery, motor vehicles and vehicle parts, electrical equipment, and data processing equipment – generally those with 50 or more employees or more than €10 million in both annual turnover and annual balance sheet total. The BSI’s NIS2 applicability check offers initial guidance. Even if you are not directly covered, customers subject to NIS2 often pass their requirements on to their suppliers.

Can you also test our own products?

Yes. If you manufacture connected machines, controllers, or IoT devices, we test firmware, web interfaces, communication interfaces, and cloud connections – using reverse engineering where needed. That way, you find vulnerabilities before your products go into operation at customer sites and lay the groundwork for requirements under IEC 62443-4-2 and the Cyber Resilience Act.

Talk to us about your production

Whether it’s your production network, remote maintenance, or your own products: tell us about your situation. For OT tests, we come to your plant – in Germany and abroad. We perform internal network and Active Directory tests either on-site or remotely, via VPN or a provided test system. For your penetration test, you receive a fixed-price quote within 24 hours of scoping (on business days).

Fields marked with * are required.

For questions or a callback

We will get in touch and, if you wish, sign the non-disclosure agreement before our first conversation – including on the basis of your own template.

We use your information solely to process your request. For more information, see our privacy policy. Please do not send passwords or login credentials through this form.