- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is undergoing rapid digital transformation. From automotive assembly lines in Pune to pharmaceutical plants in Hyderabad, Operational Technology (OT) and Industrial Control Systems (ICS) are being connected to IT networks at an unprecedented pace. This convergence—driven by Industry 4.0 mandates, real-time analytics, and remote monitoring requirements—has created a vast and largely unprotected attack surface that adversaries are actively exploiting.
In 2024 and 2025, Indian manufacturing, energy, and utilities companies have faced an escalating wave of ransomware attacks, nation-state intrusions, and targeted OT disruption campaigns. The consequences go beyond data theft: a compromised SCADA system can halt a production line, damage physical machinery, or—in critical infrastructure scenarios—cause safety incidents. For Indian enterprise IT and OT leaders, securing industrial networks is no longer a future concern; it is an urgent operational priority.
Traditional IT security frameworks were built for office environments: patch regularly, segment networks, deploy EDR on endpoints. OT environments break almost every one of these assumptions:
The Purdue Enterprise Reference Architecture (PERA) model provided a theoretical segmentation framework for decades, but in practice the boundaries between Level 0 (field devices) through Level 4 (enterprise IT) have collapsed into a tangled mesh of direct connections, remote access jump boxes, and cloud-connected historian databases.
Indian organizations operating critical information infrastructure (CII) face specific regulatory obligations that make OT security a compliance matter, not just a risk management choice.
CERT-In Directions (April 2022, updated 2023): The Ministry of Electronics and Information Technology’s directives require organizations to report cybersecurity incidents within six hours of detection. For OT environments, this creates a critical dependency: if your SOC cannot correlate an alert from a compromised HMI with broader network activity in near real-time, you will miss the six-hour window. The directions also mandate 180 days of log retention—a requirement that is difficult to meet when OT devices produce proprietary, non-syslog data that most SIEM platforms cannot ingest natively.
Digital Personal Data Protection (DPDP) Act, 2023: While primarily focused on personal data, manufacturing companies that collect biometric data for shop-floor access control, process employee safety telemetry, or maintain customer delivery records must treat those data flows as in-scope. An OT breach that exfiltrates personnel data from a connected manufacturing execution system (MES) triggers DPDP obligations—a scenario that is increasingly realistic as IT/OT convergence deepens.
Understanding the actual threat patterns helps security teams prioritize controls. The following vectors have been most active against Indian industrial organizations:
Vendor remote access is the single most exploited entry point into OT environments globally. Many Indian manufacturers maintain permanent VPN tunnels for equipment OEMs—tunnels that are rarely reviewed, often protected by shared credentials, and sometimes connected directly to Level 1/2 OT networks with no intermediary inspection. Adversaries compromise the vendor’s own infrastructure and use legitimate remote access channels to traverse into the target’s OT network.
A phishing email lands in the IT network. Attackers establish persistence on a Windows workstation. From there, they pivot through the IT/OT DMZ—often using legitimate RDP sessions to historian servers or engineering workstations—and eventually reach OT assets. Without proper micro-segmentation and OT-aware inspection at the IT/OT boundary, this lateral movement is nearly invisible.
SCADA software updates, historian database patches, and engineering workstation software packages have all been used as supply chain attack vectors internationally. Indian organizations that auto-update OT software or apply vendor patches without verification are exposed to this vector.
OT credentials are rarely rotated, often shared, and almost never governed by PAM (Privileged Access Management) solutions. A disgruntled operator or compromised contractor credential provides immediate, authenticated access to industrial systems.
Zero Trust Network Access (ZTNA) is frequently discussed in IT contexts, but the principles apply directly to OT security with appropriate adaptation. The core principle—never trust, always verify, least-privilege access—maps naturally to industrial environments.
Practically, a Zero Trust OT architecture means:
PJ Networks deploys and operates Fortinet’s OT security stack as a core component of industrial cybersecurity engagements. Fortinet’s portfolio is purpose-built for the constraints of OT environments:
For Indian manufacturers, a particularly important consideration is the ability to deploy FortiGate in IPS-only or transparent bridge mode on existing OT network segments—enabling inspection without requiring a network re-architecture. This allows security controls to be introduced on live production networks with zero downtime.
One of the most persistent challenges in OT security is operational: IT security teams using conventional SIEM and monitoring tools, and OT teams using proprietary asset management platforms, with no unified view across both environments. A ransomware attack that begins in IT and crosses into OT will transit this operational blind spot.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner, and we deploy and operate the platform for clients requiring converged IT/OT visibility. Ora addresses the IT/OT gap through four integrated pillars:
SIEM with MITRE ATT&CK Mapping: Ora’s SIEM ingests logs from IT endpoints, FortiGate firewalls, OT historians, and industrial protocol gateways into a unified correlation engine. Events are mapped to MITRE ATT&CK for ICS (a dedicated matrix covering OT-specific tactics like Inhibit Response Function and Impair Process Control), enabling security analysts to see attack storylines that span both IT and OT tiers. For CERT-In compliance, Ora’s tiered retention—hot, cold, and archive storage tiers—supports the 180-day in-country log retention direction without requiring organizations to maintain expensive hot-storage for all historical data. When your NOC/SOC receives a CERT-In inquiry, the evidence chain is accessible.
NMS for Multi-Vendor OT/IT Estates: Many Indian manufacturing organizations operate heterogeneous environments: Cisco switches in the corporate network, Hirschmann or Moxa switches on the plant floor, multiple firewall vendors across different sites, and wireless APs from several generations of procurement. Ora’s Network Management System provides unified observability across this diversity through LLDP/CDP topology discovery, network path tracing, and ML-based anomaly detection. For NOC teams managing both IT infrastructure and OT network segments, consolidated visibility eliminates the fragmentation that creates dangerous blind spots between control domains.
Video Surveillance (VMS) Integration: Physical security and network security converge in manufacturing environments. Ora’s video surveillance (VMS) module integrates ONVIF-compatible cameras, Hikvision, and Dahua systems with video analytics, bringing physical access events into the same operational dashboard as network alerts. For a factory that needs to correlate a badge-in event with a suspicious OT network login—or investigate a physical intrusion alongside a concurrent cyber alert—unified visibility under one operations view is a genuine operational advantage. This is particularly relevant for multi-site manufacturing and retail estates where physical and logical security have historically been managed by different teams with different tools.
SOAR for CERT-In’s Six-Hour Window: Meeting CERT-In’s six-hour incident reporting mandate is operationally challenging without automation. When a high-severity alert fires—say, unauthorized writes to a PLC register correlated with lateral movement from the IT network—Ora’s SOAR module can automatically isolate the affected OT segment by pushing blocklist updates to FortiGate, create an incident ticket, aggregate relevant logs into an evidence package, and generate a draft notification aligned with CERT-In’s reporting format. The automation is what makes the six-hour window realistic for teams managing complex IT/OT environments. Pre-built connectors for Fortinet products mean that response actions can reach the firewall layer within seconds of an automated decision, not after a manual approval chain that may itself take hours.
For manufacturing clients operating under both CERT-In obligations and DPDP requirements, Ora provides the audit trail and log evidence that supports compliance with these frameworks—without claiming that any technology product alone achieves regulatory compliance.
If you are an IT or OT leader in Indian manufacturing, here is a prioritized action list:
PJ Networks operates a 24×7 NOC/SOC with capabilities spanning FortiGate firewall management, ZTNA implementation, SD-WAN, and managed SIEM/SOAR services. We have deployed and operate OT security architectures for Indian manufacturing, pharmaceutical, and energy clients—environments where the constraints of legacy OT technology, regulatory obligations under CERT-In, and the speed of modern adversaries all meet in the same operations centre.
Our engagements typically begin with an OT network assessment: passive discovery, traffic analysis, and a gap review against the NIST Cybersecurity Framework for ICS and CERT-In requirements. From there, we design and deploy layered controls—FortiGate OT-aware segmentation, ZTNA for remote access, and unified monitoring through PrahiX Ora—and operate the resulting environment with our 24×7 team.
If you are a CISO or IT head at an Indian manufacturing organization concerned about your OT exposure, we would welcome a conversation about your specific environment. Our assessments are structured to deliver actionable findings, not theoretical risk scores—because in OT security, the consequence of inaction is measured in production hours, not compliance penalties.
Contact PJ Networks to schedule an OT security assessment for your industrial environment.