When cyber risk becomes production risk. By Daniel Voss
Even though having comprehensive visibility across complex and connected environments is still a challenge, manufacturers do have greater visibility into their cybersecurity posture than ever before. Security teams can monitor vulnerabilities, track threats, assess control effectiveness and gather large amounts of operational data across connected IT and operational technology (OT) environments. But even where this information is available, it does not necessarily mean organizations understand what a specific cybersecurity risk could mean for production and operations.
The big challenge now is about the translation of risk, not visibility. Cyber risk is often communicated using technical measures such as vulnerability counts, severity ratings, patching levels, and compliance scores. These measures are valuable for security teams, but they don’t always explain which exposures could affect production, how an attack could disrupt a critical process, or where investment would make the greatest difference to the organization’s overall risk.
This is particularly important for manufacturers because cyber risk rarely stops at the boundaries of the IT environment. Digital transformation is closely connecting production systems, business applications, suppliers, and other parts of the operational environment. As these dependencies increase, a cyber incident affecting one part of the organization can have consequences beyond the original technical problem, disrupting production, delaying deliveries, affecting customer commitments, and creating wider financial and operational impacts.
This means understanding cyber risk in the context of business-critical processes is essential, and not every technical finding should be treated as if it has equivalent risk. For example, a vulnerability with a high severity rating may have limited business impact if it affects an isolated system and effective controls reduce the likelihood of exploitation. On the other hand, a lower-rated vulnerability could be more significant if it forms part of an attack path to a production environment or supports a process on which the business depends.
Cyber risk quantification (CRQ) provides a way to make this connection. Instead of starting with a generic severity score, this is a threat-informed approach that considers realistic attack scenarios, the business process or service being targeted, the technology and controls supporting it, and the potential consequences if the scenario occurs. Financial modelling can then help express the potential consequences in financially meaningful terms. While precise figures can be difficult given the availability and quality of underlying data, using realistic loss ranges will provide a practical view of cyber exposure. This allows it to be compared more easily with other business risks and better support the prioritization of investment decisions.
This scenario-based approach changes the way organizations think about controls. The presence of a control does not mean that it will provide the same level of protection against every threat. Control effectiveness must be considered in the context of the specific scenario, including how controls are implemented, evidenced, and expected to perform. This provides a much more useful basis for deciding whether strengthening a control will reduce exposure and by how much.
It is important that this quantification doesn’t become another periodic reporting exercise. Manufacturing environments are continually changing as production systems are upgraded, new technologies are introduced, suppliers and dependencies evolve, and threat activity changes. A risk assessment that accurately reflected the environment at one point in time may quickly become less relevant as conditions change.
The best approach is to have an ongoing, dynamic view of exposure using evidence from security operations, exposure management, control validation, and changes in business criticality.
And it is here that CRQ moves beyond just putting a financial figure on cyber risk. Its full value comes from putting threat conditions, business criticality, control effectiveness, and potential loss into a decision framework. For a manufacturing organization, that means being able to identify which scenarios pose the greatest threat to critical production processes; which controls are most important; and where additional investment would have the greatest effect on reducing exposure.
This is not about replacing vulnerability management, threat intelligence, exposure management, or other established security practices. These are the activities that provide much of the evidence needed to understand and manage cyber risk. The difference is that their findings can start to be considered in a whole business context and not in isolation. This gives security, operational, and business teams a shared understanding of which risks matter most and why.
Manufacturing is only going to become even more connected and dependent on digital systems, making cyber risk inseparable from operational risk. Organizations must be able to turn their security data into decision-quality insight, understanding where exposure could materially affect production, financial performance and operational continuity, and where intervention is likely to reduce that risk most effectively. This is where cyber risk quantification becomes part of a broader resilience strategy, helping organizations prioritize what matters most and strengthen their ability to continue operating when disruption occurs.
Daniel Voss
www.obrela.com
Daniel Voss is Sales Director at Obrela, a global provider of cybersecurity services, delivering Managed Detection and Response (MDR) and risk-led security solutions that help organizations prevent, detect and respond to cyber threats. Through its integrated platform and expert-led approach, Obrela enables organizations to align cybersecurity with business risk, ensuring resilience in an increasingly complex threat landscape.
