Securing sensitive data across the manufacturing supply chain

By Nilesh Bhojani, Chief Product and Technology Officer, Seclore

A manufacturer can control who receives a product design. The harder question is what happens to that design once it leaves the organisation.

Every manufacturing programme depends on sensitive information moving across a network of suppliers, tooling companies, contract manufacturers, testing laboratories and other partners. CAD files, engineering drawings, bills of materials, specifications, production plans and pricing details routinely move between organisations to keep production running. Once that information leaves the manufacturer’s environment, however, the organisation’s ability to govern its use becomes limited.

The challenge becomes more complex as suppliers engage their own partners. A design shared with a tier-one supplier can move to a specialist tier-two vendor and potentially further down the chain, creating multiple points at which sensitive information can be accessed, copied or shared.

For Indian manufacturers expanding production capacity and integrating more deeply into global supply chains, protecting sensitive information across this extended ecosystem is critical. Securing the systems that store and process data remains essential. The next question is whether security can remain effective wherever that data goes.

The data that leaves the plant by design
Consider what moves during a single manufacturing programme. CAD files and tolerance drawings go to tooling vendors. Bills of materials and process sheets reach contract manufacturers. RFQ packs containing designs, volumes and commercial information may be shared with multiple bidders. Test reports move to certification bodies, while supplier pricing is accessible through sourcing platforms.
Each exchange increases the number of organisations that may have access to sensitive information.

The threat environment makes this exposure significant. IBM’s 2026 X-Force Threat Intelligence Index identified manufacturing as the most targeted industry for the fifth consecutive year, accounting for 27.7% of incidents observed in 2025, with data theft emerging as the most common impact. The report also found that large supply chain and third-party compromises have nearly quadrupled since 2020.
For manufacturers, the security challenge therefore extends beyond their own infrastructure. They need visibility into how sensitive information is accessed and used after it reaches external parties.

Where conventional security reaches its limit
Manufacturing organisations have invested heavily in securing the environments where their data resides. Networks are segmented, operational technology is separated from IT, endpoints are managed, and access to “product lifecycle management (“PLM”)” and ERP systems is governed through established controls.

These measures remain important. Their reach becomes harder to maintain once information moves outside the organisation.

A drawing exported from a PLM system and sent to a supplier may move through email, a supplier portal, a partner’s design environment or another third-party system. The manufacturer’s original policy may define who should receive the file, while ongoing enforcement depends on the systems and processes operated by the recipient.

The supply-chain structure adds another layer. A tier-one supplier may engage specialist tier-two or tier-three vendors, allowing information to travel several steps beyond the organisation that originally created it.

This creates a gap between knowing who was authorised to receive information and knowing how that information is subsequently accessed, used and shared.

Applying Data Security Intelligence
One way to address this gap is through Data Security Intelligence, which combines discovery, contextual understanding, policy enforcement and evidence of activity across the information lifecycle.

Before a manufacturer can protect a drawing, it needs to know which files matter. Discovery and classification across shared drives and other repositories help identify sensitive design files and establish their level of protection.

Once identified, policies can be associated with the document itself. A manufacturer can define which users or organisations can access a drawing, what actions they can perform and how long that access remains valid. These protections can continue to apply as the document moves across approved external environments.

Consider an RFQ. Once a contract is awarded, unsuccessful bidders may still retain copies of the original information. Persistent protection gives the manufacturer a way to withdraw access at that point, , reducing reliance on recipients to locate and delete every copy.

This also allows security to operate across existing supply-chain infrastructure. Suppliers can continue using their established systems while the manufacturer applies policies to the sensitive information it shares. The protection stays connected to the data, providing greater consistency across employees, suppliers and third parties.

Visibility needs to extend beyond access
Protection also needs to be supported by evidence.

Security teams and business owners need to understand which recipients accessed sensitive information, when they accessed it and what actions they performed. This evidence can support intellectual property investigations, customer audits, regulatory requirements and disputes involving designs or specifications.

It becomes particularly relevant when a supplier relationship ends. Manufacturing partnerships change as programmes conclude, vendors are replaced and sourcing strategies evolve. Information accumulated over several years can remain with former partners long after the commercial relationship has ended.

Persistent protection lets organisations withdraw access during offboarding while retaining an audit trail of earlier activity. If a design is later suspected of reaching an unauthorised party, that history can establish which recipients accessed the information and when.

AI is extending the data boundary again
AI introduces another dimension to the same data security challenge.

Engineering and sourcing teams are beginning to use AI assistants to analyse design documents, summarise specifications, compare supplier quotations and support technical decision-making. These systems can create significant productivity gains by working across large volumes of enterprise information. They also introduce new contexts in which sensitive data can be accessed and processed.
They also introduce new contexts in which sensitive data can be accessed and processed.

Data context and policy enforcement are therefore essential. An AI system needs access to the information required for a specific task, while the organisation needs mechanisms to determine what information can be accessed, under which conditions and for what purpose.

Data Security Intelligence can extend across employees, suppliers, applications and AI systems. Policies can take into account the sensitivity of the information, the identity and context of the user or application, and the purpose for which the data is being accessed. This provides a consistent foundation for governing sensitive information as AI becomes embedded in manufacturing workflows.

Building data security into the supply chain
Manufacturers already apply rigorous controls to the physical movement of goods. Tooling is tracked, batches are traced, equipment is calibrated and production processes are documented. The information that enables those physical processes requires the same level of discipline.

A resilient Data Security Intelligence strategy brings together four capabilities: Discover, Contextualize, Enforce and Prove. Discover identifies and classifies sensitive information across repositories.

Contextualize establishes its sensitivity and the circumstances in which it is accessed. Enforce applies policies and keeps protection as information moves beyond the enterprise. Prove provides evidence of access and activity for audits, investigations and accountability.

For a sector built around collaboration, data security needs to support information exchange while preserving organisational control over sensitive data. Embedding these capabilities across the supply-chain architecture gives manufacturers a stronger foundation for protecting intellectual property, managing third-party exposure and governing the growing use of AI across their operations.