On a factory floor, a cyber attack stops more than email. Lines halt, orders back up, and customers who run just-in-time schedules start calling within hours.
Cyber insurance for manufacturers can pay for the response, the rebuild and the lost production. It is also one of the harder sectors to place, because of operational technology. This page explains how underwriters see it and what evidence helps your case.
Why insurers look closely at manufacturing
Manufacturers run two worlds: office IT and operational technology (OT), the systems that control machines. OT often uses old software that cannot take regular patches, and machine vendors often need remote access to it.
Some proposal forms ask you to confirm that your main activity is outside industrial sectors that rely on OT, such as manufacturing, energy, mining and utilities. An answer that puts you in that group usually sends the application to an underwriter for referral. Other forms ask directly whether you operate SCADA or industrial control systems, and whether your OT sits separate from IT and the internet. Appetite varies by insurer, and a clear answer with evidence makes a real difference.
For example, a food packaging plant with 90 staff runs two lines from a control PC that still uses an unsupported operating system. The underwriter will want to know exactly how that PC connects to everything else.
The cyber risks underwriters see in manufacturing
- Ransomware crossing into the plant. An attack starts in office email and spreads to the systems that run production.
- Legacy systems. Machines depend on old workstations that no vendor still supports.
- Vendor remote access. A machine supplier's remote connection stays open all the time, with a shared password.
- Damaged hardware. Malware leaves controllers or devices unusable, and replacement beats repair.
- Design theft. Criminals copy drawings and product designs.
- Supplier payment fraud. A fake email from a raw materials supplier changes bank details before a large payment.
What underwriters usually ask manufacturing businesses
- Do you operate SCADA, industrial control systems or other OT? Describe the systems and where they sit.
- Is OT separate from your IT environment and the internet? A network diagram and firewall rules are the evidence.
- How do machine vendors connect? Show a protected gateway with MFA, and no remote access open to the internet. An external scan helps.
- Do you run any end-of-life software or hardware? An asset inventory answers it. Where a legacy system must stay, show how you isolated it.
- Do you apply critical and high patches within one month on IT systems? A patch report is the evidence.
- Do you keep backups offline, with a restore test of key servers and configurations in the last six months? A dated test record covers it.
- Have you set recovery time and recovery point objectives, and does your continuity plan cover production downtime? Your continuity plan answers both.
- Can you calculate a business interruption loss? Show how finance would prove lost production and extra costs.
Cover that matters most for manufacturing
- Business interruption and increased cost of working. Lost income after the waiting period, plus overtime or outsourced production to keep orders moving.
- System damage and rectification. Specialists and contract staff to rebuild data and systems.
- Hardware replacement. Some wordings replace devices that a cyber event made unusable.
- Voluntary shutdown. Some wordings cover income lost when you take systems offline on purpose to contain an attack.
- Contingent bodily injury. A few wordings cover injury caused by a cyber event where no other policy responds.
- Funds transfer fraud. Cover for supplier payments diverted by criminals. Check the sublimit.
Physical damage to machines or stock from a cyber event often falls outside cyber wordings, and some property policies exclude cyber causes too. Some wordings also set lower limits for exploits of end-of-life or unpatched software. Ask your broker where the gaps sit between your cyber and property cover.
How PrismX helps manufacturing businesses get insurance ready
- Discover records your sites, IT systems, OT, data, suppliers and people.
- Assess checks each control, including OT separation and vendor access, and shows how your answers read on the insurer's own question set.
- Improve turns each gap into an action with an owner and a date, for example "move vendor access behind the gateway".
- Verify gives each document you upload, such as the network diagram, asset inventory and restore test, an AI check and advisor verification.
- Submission pack: PrismX builds a signed pack with a sha256 fingerprint.
- During an incident: in the pilot, PrismX follows the notification clocks in your wording.
- Before you start: our backup and restore checklist helps you plan the test.