Manufacturing sector records highest industrial control system attack rate despite 56% drop in intrusion attempts: SonicWall report

By Express Computer On Jul 27, 2026

The manufacturing sector recorded the highest industrial control system (SCADA) attack detection rate among industries tracked by SonicWall in the first half of 2026, even as overall intrusion prevention events declined 56.2% year on year, according to the company’s latest threat report.

The 2026 Manufacturing Protect Brief, based on telemetry from more than one million security sensors, found that manufacturers continue to face targeted cyberattacks as operational technology (OT) becomes increasingly connected to enterprise IT environments.

While intrusion prevention system (IPS) detections fell to 474 million events during the first half of the year, SonicWall said the decline reflects more targeted attack strategies rather than lower cyber risk.

The report identified the Hikvision IP Camera Command Injection vulnerability (CVE-2021-36260) as the most prevalent IoT attack signature, generating 43 million detection events across manufacturing networks. Overall, IoT attacks accounted for 46.2 million detections, with more than half of manufacturing organisations recording attempted exploitation.

Legacy vulnerabilities also continued to be exploited. The Apache Log4j2 vulnerability generated 13.8 million detection events despite being disclosed more than four years ago.

Ransomware activity remained active, with 10 ransomware families targeting manufacturing organisations during the first half of 2026. According to the report, the Zhen ransomware family alone generated 22.2 million detections concentrated on two devices, indicating a targeted incident rather than a broad campaign.

“Manufacturing’s attack surface looks nothing like it did even five years ago, and the security model hasn’t caught up,” said Michael Crean, Senior Vice President of Managed Services at SonicWall.

The report attributes the sector’s growing exposure to increased connectivity between factory-floor operational technology and corporate IT systems, expanding the attack surface for cybercriminals.