- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is in the middle of a quiet but seismic shift. Smart factories, industrial IoT sensors, SCADA systems, and cloud-connected PLCs have replaced the air-gapped shopfloors of a decade ago. Industry 4.0 has brought enormous efficiency gains — and an equally enormous attack surface that most enterprise security teams are only beginning to reckon with.
In 2024 and 2025, several high-profile attacks on global manufacturing facilities demonstrated what happens when Operational Technology (OT) networks remain unprotected: production lines halted, proprietary process data exfiltrated, and in some cases, physical equipment damaged. India is not immune. As the country accelerates its manufacturing ambitions under schemes like PLI and Make in India, OT/ICS security must become a boardroom priority — not a checkbox on an annual audit.
Most IT security frameworks were designed for office networks: endpoints running modern operating systems, patching cycles measured in weeks, and workloads that can tolerate a few seconds of latency. OT environments break all of those assumptions.
The threat actors targeting OT networks are sophisticated and patient. Nation-state groups with documented interest in critical infrastructure — including manufacturing, power, and logistics — pre-position access months before launching a disruptive payload. Ransomware groups have learned that hitting OT systems multiplies their leverage: manufacturers cannot afford production downtime the way an office can absorb a few encrypted file servers.
Key threat patterns Indian security teams should track:
Under the CERT-In 2022 directive, Indian organisations must report cybersecurity incidents — including those affecting OT/ICS networks — within six hours of detection. This obligation does not exclude manufacturing or industrial environments. A ransomware hit on a SCADA system, unauthorised access to a DCS, or a data breach involving process data all fall within the reporting perimeter.
For manufacturers, this creates a practical challenge: OT incidents often manifest as physical anomalies (a pump running at the wrong speed, a temperature sensor behaving erratically) before any IT-side alert fires. Without OT-aware monitoring correlated with IT telemetry, detection is slow, and the six-hour window becomes almost impossible to meet.
“The six-hour CERT-In window was designed for IT environments. Meeting it for OT incidents requires automated detection and a pre-defined escalation path — not a manual log trawl.”
There is no single product that secures an OT environment. Defence in depth across five domains is the baseline:
The Purdue Enterprise Reference Architecture (levels 0–5) remains the practical segmentation model for most Indian manufacturers. The goal is to enforce strict, unidirectional or tightly controlled data flows between the field devices and control layer (OT core), the manufacturing operations DMZ, and the enterprise IT and cloud layers. FortiGate Next-Generation Firewalls with Fortinet’s OT security bundle understand industrial protocols natively — inspecting Modbus TCP, DNP3, and EtherNet/IP at the application layer, allowing policy enforcement on specific function codes rather than just TCP port ranges. Deploying FortiGate at the IT/OT DMZ boundary gives you a consistent Fortinet Security Fabric from the enterprise edge to the shopfloor.
You cannot protect what you cannot see. Passive protocol discovery — no agents, no active scanning that can disrupt PLCs — is the first step. Tools that speak industrial protocols and listen for device announcements can build an authoritative OT asset register in days, mapping every PLC firmware version, every HMI OS, and every rogue device a maintenance contractor left on the network.
Third-party vendor access is the highest-risk OT attack vector in India, where OEM support is often conducted remotely via VPN credentials that are never rotated. A Zero Trust Network Access (ZTNA) architecture — replacing always-on VPN with identity-verified, time-bounded, least-privilege sessions — dramatically reduces this exposure. Every vendor session should be recorded with automatic termination on idle timeout.
Alerts from OT sensors are meaningless in isolation. They need to be correlated with IT-side events — a credential compromise, a new lateral movement path — to reconstruct the full attack storyline. This is where IT/OT SOC integration pays dividends: a single pane of glass that shows both the phishing email that landed in an engineer’s inbox and the anomalous Modbus write that followed three days later.
Generic IT IR playbooks do not translate to OT. Isolating a compromised PLC may mean halting a production line — a decision that requires operations leadership, not just IT security. OT IR playbooks must define: who authorises isolation of OT segments; safe fallback operating modes; evidence preservation without disrupting physical processes; and CERT-In notification timeline and contact tree.
One of the persistent challenges in OT security is tool sprawl: separate consoles for network monitoring, SIEM, physical security, and compliance reporting — none of them talking to each other. For clients in manufacturing, retail, and multi-site industrial estates, PJ Networks deploys and operates PrahiX Ora, a unified SecOps platform built by PrahiX Tech Pvt Ltd, that brings IT and OT telemetry under a single operational view.
PrahiX Ora is built around four integrated pillars, each with direct relevance to the OT security problem:
The platform ingests log and event data from firewalls, endpoints, identity providers, cloud workloads, and — critically for OT environments — industrial network sensors and SCADA historians. Correlation rules mapped to the MITRE ATT&CK for ICS framework help distinguish legitimate engineering changes from attacker-induced anomalies. Graph-based attack storyline reconstruction connects the dots between an IT-side compromise and an OT-side impact, giving analysts context that per-device alerting never can. Tiered log retention (hot/cold/archive) supports CERT-In’s direction on 180-day in-country log retention — without the cost of keeping everything on fast storage.
Indian manufacturers often inherit multi-vendor OT environments from decades of piecemeal capital investment — Siemens PLCs alongside Allen-Bradley controllers, managed switches from three different vendors, SD-WAN links connecting remote sites. The NMS pillar provides unified observability across firewalls, switches, access points, and WAN/SD-WAN links, with LLDP/CDP topology discovery to automatically map what is connected where. Network path tracing and ML-based anomaly detection flag deviations from baseline traffic patterns, while auto-healing policies can trigger remediation actions before an alert even reaches the analyst queue. For NOC teams stretched across multiple sites, this replaces a fragmented console-per-vendor model with a single operational dashboard.
Physical security and network security have historically been managed by different teams with different tools. For manufacturing and retail clients with large physical estates — warehouses, assembly lines, distribution centres — this creates a blind spot: a physical intrusion that precedes a network compromise is invisible to the SOC, and a network alert that correlates with unusual physical access patterns goes unnoticed by the security desk. The video surveillance (VMS) pillar integrates ONVIF, Hikvision, and Dahua camera management with video analytics, surfacing physical security events alongside network and endpoint telemetry. For multi-site Indian manufacturers, this single-pane-of-glass view of physical and network security is a meaningful step toward true operational security convergence.
The most time-consuming part of incident response is not the decision-making — it is the manual steps: pulling logs, querying threat intelligence, drafting notifications, pushing blocklists to firewalls. The SOAR pillar automates these steps through pre-built playbooks and connectors, including direct integration with FortiGate to push updated blocklists in response to confirmed indicators of compromise. For Indian organisations facing CERT-In’s six-hour reporting obligation, SOAR is what makes that timeline realistic at scale. A confirmed OT incident can trigger automatic isolation of the affected network segment, evidence collection, and a draft CERT-In notification — all within minutes of detection.
PJ Networks configures, deploys, and operates PrahiX Ora as part of its managed security service — meaning clients get a fully staffed 24/7 NOC/SOC team behind the platform, not just a tool licence to run themselves. To understand how the platform maps to your specific OT environment and compliance posture, reach out to our team.
For Indian manufacturers at the beginning of their OT security journey, a phased approach prevents security investment from outpacing operational readiness:
India’s Digital Personal Data Protection Act (DPDP Act, 2023) is most often discussed in the context of customer data. But manufacturers collect personal data too: employee biometrics at shopfloor access points, vehicle entry logs, CCTV footage, and HR data on contractor workers. A security incident that exposes this data carries DPDP Act obligations alongside CERT-In reporting requirements.
Aligning OT security controls with DPDP Act principles — purpose limitation, data minimisation, retention limits — requires mapping which OT systems touch personal data and ensuring that their logs and camera feeds are retained, protected, and deleted according to documented policy. PrahiX Ora’s tiered retention architecture and role-based access controls support this compliance posture and help evidence alignment with the DPDP Act for manufacturing clients.
The Indian manufacturing sector’s OT security posture today mirrors where enterprise IT security was in 2010: awareness is growing, but most organisations are still reacting to incidents rather than preventing them. The difference is that an OT incident can halt a ₹500 crore production line, damage physical assets, and trigger regulatory reporting obligations — all simultaneously.
The good news is that the security building blocks exist: OT-aware firewalls, passive discovery tools, ZTNA for vendor access, and integrated IT/OT SOC monitoring. The challenge is assembling and operating them in a way that fits the constraints of a manufacturing environment without disrupting the processes the security is meant to protect.
PJ Networks specialises in exactly this: deploying Fortinet’s OT security stack, operating 24/7 NOC/SOC coverage with OT visibility, and managing the PrahiX Ora platform for clients across manufacturing, logistics, and critical infrastructure. If your organisation is beginning an OT security assessment or looking to close specific gaps before your next CERT-In audit cycle, our team is ready to help.