Crystal Ball 2025: The rise of resilient manufacturing

A note from Scott Achelpohl, managing editor of Smart Industry:

Welcome to the Crystal Ball Report for 2025, which is appearing in this web space into January as a series of contributed pieces from esteemed experts in manufacturing technology.

We've invited these thought leaders to look into their "crystal balls" and tell us what's ahead (with an emphasis on data, AI, and cybersecurity). So please enjoy the series and, from all of us at SI, have a prosperous and profitable new year.

As we approach 2025, cybersecurity in the industrial sector is on the brink of transformation.

The evolving convergence of information technology and operational technology has opened up a multitude of opportunities for efficiency and productivity gains, but it has also created an ever-expanding attack surface for cybercriminals.

Best of 2024: SI looks back at our favorite features

Moreover, with increasing world turmoil, the Cybersecurity and Infrastructure Security Agency (CISA) has issued severe warnings about state actors infiltrating critical infrastructure networks.

Nation-state adversaries such as China, Russia, North Korea, and Iran pose an elevated threat, often leveraging advanced persistent threat (APT) activities to target critical sectors. These actors aim to conduct cyber espionage, disrupt systems, and exploit vulnerabilities for network intrusions.

What's to come in the Crystal Ball series:

Insights on 2025 from talks with manufacturers, by Josh Cranfill, Quickbase
AI, automation, and insider threat detection, by Chris Scheels, Gurucul
Business leaders should look inward to identify what they can control, by Michael van Keulen, Coupa
Cybersecurity trends that will reshape private content security, by Patrick Spencer, Kiteworks
Configurability, modularity, and AI: The 2025 challenges, by Damantha Boteju, Henrik Hulgaard, and Daniel Joseph Barry, Configit
The rise of resilient manufacturing, by Aron Brand, CTERA
2025 prediction thread, Part 1, by various authors
2025 prediction thread, Part 2, by various authors
Your opinion counts: Results from SI's reader poll on 2025, by Scott Achelpohl, Smart Industry

Key trends and predictions for industrial cybersecurity in 2025:

Zero-trust becomes standard in industrial systems

In the new year, zero-trust architecture will be nonnegotiable for manufacturers and industrial operators. As more connected devices permeate industrial environments, the traditional "castle-and-moat" approach to cybersecurity is proving insufficient.

A zero-trust model assumes that threats can come from anywhere—internal or external—and requires continuous verification of users, devices, and network activities.

Podcast: Tighter cybersecurity starts with better password practices

Expect to see widespread adoption of zero-trust across industrial control systems (ICS), including programmable logic controllers (PLC), human-machine interfaces (HMI), and supervisory control and data acquisition (SCADA) systems.

By implementing strict identity verification and privilege management, industrials will reduce the risk of unauthorized access and make it harder for adversaries to navigate within their networks.

AI-driven threat detection and response

Artificial intelligence will be at the forefront of the industrial defense strategy by 2025, with organizations deploying sophisticated machine learning models to monitor both IT and OT networks in real-time.

AI-powered anomaly detection will allow for quick identification of potential threats, especially those involving “living-off-the-land” techniques, where cyber attackers use built-in tools to evade detection.

As cyber adversaries increasingly leverage AI to find weaknesses and deploy intelligent attacks, manufacturers must embrace proactive AI-powered security. AI will enhance not only detection but also rapid incident response by analyzing data in real time, suggesting remediation actions, and even executing them autonomously where safe to do so.

Rise of air-gapped and immutable backup systems

Ransomware has become more sophisticated, with attackers focusing on targeting backup systems to leave businesses without recovery options. In response, manufacturers will adopt air-gapped and immutable backups as a central tenet of their resilience strategies.

These backups are isolated from main networks—either physically or logically—ensuring that even in the case of a compromise, there are untampered, recoverable copies of critical data.

The AI trap: Why manufacturers fail without the right data

Immutable storage, using technologies like AWS Object Lock or similar, will allow manufacturers to create “write once, read many” (WORM) backups that cannot be altered or deleted. This is crucial for ensuring the availability of recovery options even when primary systems are compromised.

Expansion of defense-in-depth with network segmentation

Segmentation will continue to be a key strategy to mitigate risk. In 2025, manufacturers increasingly will adopt a defense-in-depth approach, wherein IT and OT systems are compartmentalized into isolated segments, each requiring separate security verification. Segmentation limits the ability of attackers to move laterally across the network, thereby containing potential breaches.

Think of network segmentation as the bulkheads of a ship—if one compartment is breached, the others remain safe. By applying this principle to ICS environments, organizations can prevent the spread of ransomware or malware from less critical systems to those that manage core operations.

Addressing IoT complexity and securing industrial devices

The number of IoT devices in industrial environments will continue to surge in 2025, growing to more than 17 billion, according to some estimates. These devices often lack standardized security features, making them prime targets for attackers. IoT-enabled systems, such as smart sensors, connected alarms, and monitoring equipment, bring high efficiency but also considerable risk.

Manufacturers must implement strong access control measures like multi-factor authentication (MFA), robust encryption protocols, and anomaly-based monitoring to prevent unauthorized access to IoT systems. Additionally, segmenting IoT devices from core OT networks will ensure that breaches of peripheral systems do not impact critical infrastructure.

Embracing IEC 62443 as the backbone of industrial cybersecurity

The IEC 62443 standard will see broader adoption across the industrial space by 2025. With the convergence of IT and OT, this standard serves as a unified framework to guide cybersecurity practices across diverse environments.

IEC 62443 covers everything from secure system architecture and product development to ongoing risk management, offering a holistic approach to securing industrial automation and control systems (IACS).

Industrials will rely heavily on this framework to drive their compliance initiatives, secure supply chains, and protect proprietary manufacturing processes. The standard will play a critical role in bridging the gap between IT and OT, facilitating collaboration between engineers, security professionals, and operators.

Honeypot and decoy technologies to lure and identify attackers in networks

In 2025, manufacturers will increasingly leverage honeypot and decoy technologies to lure cyber adversaries and identify attack methods before they can inflict damage. Honeypots act as bait, mimicking critical systems and enticing attackers to interact with them, while decoys create convincing but false environments that distract attackers from actual production systems.

By deploying these technologies, organizations can gather valuable intelligence on attack vectors, behaviors, and tools used by cybercriminals, enhancing their defensive posture. Honeypots and decoys not only help identify attackers but also provide early warning signals, allowing for proactive mitigation before a real attack escalates. As cyber threats grow more sophisticated, these technologies will be instrumental in staying one step ahead of attackers.

Call for industrial cyber resilience

In 2025, the convergence of IT and OT will bring both opportunity and significant risk to the industrial landscape. To thrive, manufacturers must evolve their cybersecurity strategies just as rapidly as adversaries are evolving their methods of attack.

A proactive approach, one that embraces AI-driven security, honeypot decoys, air-gapped backups, network segmentation, and standards like IEC 62443-is essential to building resilience.

As the digital and physical worlds become even more intertwined, the ability to withstand and recover from cyberattacks, including those initiated by state actors, will determine whether industrial organizations can truly capitalize on the promise of Industry 4.0.

Cyber resilience is no longer a luxury; it is a fundamental requirement for keeping the business running and building a safer, more secure future for industrial operations.

See also: The 2024 Crystal Ball Report