Securing The Modern Shop Floor: Why Cybersecurity Needs Operational Trust

Claudio Laterreur, CIO/CDO, Technology and Business C-Suite Executive, Transformation, Turnaround, & Growth, Advisory and Board Member.

gettyA cyber incident may end with systems back online, yet a business still cannot be certain that its operations are safe. A restored server does not guarantee an unchanged production process, reliable product quality or equipment running within acceptable limits. Chief executives, operations leaders and cybersecurity professionals need to not only know whether their technology is working, but whether they can trust what is happening inside their operations.

Operational trust is the confidence that operations behave as intended, that material deviations can be explained and that recovery returns the business to a verified, known-good state. It does not replace cybersecurity or business continuity. It connects them to the realities of safety, production, customer commitments and financial performance.

Traditional security tools monitor identities, access, endpoints, networks, vulnerabilities and logs. Those controls are essential, but they do not independently explain why throughput declines, yields deteriorate, equipment behaves unexpectedly or production data no longer matches the shop floor.

Potential operational signals include unauthorized process or setpoint changes, abnormal machine behavior, unusual controller logic, historian anomalies, quality drift and unexpected automated recommendations. Such changes can be symptoms of a cyber event, but they can also result from maintenance, sensor errors, process variation or human mistakes. A deviation should initiate investigation, never serve as automatic proof of an attack.

The goal is to focus limited investigative capacity on issues that are material, abnormal and unexplained. Four tests can help leaders decide when to connect operational and cyber investigations:

• Business Exposure: Could safety, quality, delivery, revenue or margin be affected?

• Approved Tolerance: Is the condition outside a permitted range, sequence, operating state or authorized change?

• Operating Explanation: Can maintenance, production or process records adequately explain what changed?

• Cyber Pathway: Do access, identity, configuration, network or threat records support a credible technical explanation?

If operations can explain the event and independent data agrees, close it efficiently and preserve the learning. If not, escalate based on business materiality rather than alert volume.

Cyber and IT teams handle identities, remote sessions, configurations and network behavior. Operations teams oversee machine state, production orders, tolerances, quality records and the cost of disruption. Neither perspective is sufficient alone; confidence grows when independent data supports the same timeline and explanation.

1. Observe what changed. Establish normal conditions, approved changes and meaningful thresholds.

2. Prioritize what matters. Evaluate exposure to people, products, continuity and enterprise value.

3. Correlate the data. Compare operating behavior with access, change and threat records while testing non-cyber causes.

4. Respond and restore trust. Contain proportionately, then verify systems, people, product, process and production before closing the incident.

For example, an unusual privileged-account login becomes substantially more consequential when it coincides with an unauthorized process change and declining yield. Conversely, an apparent production problem may require security investigation once unusual access or network activity is discovered. Correlation creates the decision advantage.

The October 2026 cyberattack on supermarket refrigeration systems in France illustrates the stakes. According to the BBC, attackers manipulated connected refrigeration equipment, raising temperatures in hundreds of stores and forcing retailers to discard spoiled food. The initial signal was physical and operational: unexpected temperature and defrost behavior, followed by losses affecting inventory, continuity and customer confidence.

The lesson extends to manufacturers, logistics companies, utilities and other connected businesses. Disabling remote access or patching equipment may stop a technical threat, but recovery is not complete until affected assets, operating parameters and product condition have been inspected and validated. A business must prove it is safe to continue.

A consequential cyber event that changes physical operations should leave an operational footprint. Some of those signals may appear before an incident is technically confirmed. This is an investigative hypothesis, not a promise that every attack will be detectable from production data. Its value lies in testing meaningful deviations sooner, improving decisions and limiting the operational cost of uncertainty.

A practical model starts with four connected questions: What changed? What could explain it? What is at risk? What must be done to restore trust? Operational data identifies the trigger; cyber and change data test causality; business materiality determines urgency, and validated recovery closes the loop. That shared sequence gives executives a common language for response.

1. Can we see what is happening in critical operations?

2. Can we trust the underlying data?

3. Can we identify material deviations early?

4. Do cyber and operating teams investigate from a shared body of data?

5. Can we demonstrate, not merely assume, that recovery has returned us to a safe, known-good operating state?​

Cybersecurity can establish whether a threat has been addressed; operational intelligence helps establish whether the business is behaving as intended. Continuity plans can restore service, but they cannot, alone, prove that the technical pathway is gone. Leaders should align all three disciplines before a crisis, with agreed thresholds, ownership and authority to act.

Investment creates controls. Integration creates resilience.

Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?