- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s manufacturing sector is surging. From auto-component plants in Pune to pharmaceutical facilities in Hyderabad, factories are adopting connected systems—programmable logic controllers (PLCs), SCADA dashboards, industrial IoT sensors—at a pace that would have seemed implausible five years ago. The productivity gains are real. So is the attack surface that comes with them.
Operational Technology (OT) and Industrial Control System (ICS) environments were never designed for network security. Protocols like Modbus, DNP3, and Profinet lack authentication by design. Many PLCs run firmware that hasn’t been patched in years—sometimes because the vendor no longer supports it, sometimes because the downtime required to patch is measured in crore-rupee production losses. This combination of legacy architecture and hyperconnectivity is exactly what threat actors look for.
In 2026, OT is no longer a niche concern. CERT-In has flagged critical infrastructure as a priority sector. The DPDP Act is drawing attention to data flows that pass through manufacturing execution systems. And ransomware groups have demonstrated, repeatedly, that shutting down a plant floor is a faster path to payment than targeting corporate IT alone. If you are a CISO or IT head at an Indian manufacturer, this playbook is for you.
The instinct to “just add it to the IT security programme” is understandable but dangerous. OT environments differ from IT in ways that change every security assumption:
Understanding who is targeting your plant floor shapes your defence priorities. Three categories dominate:
Groups like LockBit (before its disruption), Black Basta, and their successors have developed dedicated OT reconnaissance capabilities. They identify Historian servers and engineering workstations as high-value targets precisely because these machines sit at the IT/OT boundary. Once inside, they delay detonation until they have mapped backup locations and identified the systems where downtime will cause maximum leverage. Several Indian industrial facilities have been targeted; few make headlines because the settlements are kept quiet.
State-sponsored actors targeting defence manufacturing, semiconductors, and pharmaceutical R&D have found OT networks to be a lateral movement opportunity. An engineering workstation with design files for a precision component is more valuable to an adversary than corporate HR data. India’s defence and aerospace manufacturing ecosystem is a priority target in this category.
Shodan and similar tools index thousands of Indian industrial systems exposed to the internet—exposed RDP on an HMI, unpatched Citrix gateways, Modbus/TCP on public IP addresses. Automated exploit kits don’t discriminate by country; they hit anything reachable. Opportunistic actors monetise access through ransomware-as-a-service or sell footholds on dark web markets.
CERT-In’s 2022 directions (amended and clarified since) require critical infrastructure operators—which increasingly includes large manufacturers in energy, chemicals, and defence—to report incidents within six hours. For OT incidents, this is particularly challenging because:
Meeting CERT-In obligations for OT incidents requires the same foundational work as improving OT security posture: asset inventory, centralised logging, and automated alerting. These are not separate compliance tasks—they are the same programme.
The following steps are sequenced by impact and feasibility. Start where you are, not where a textbook says you should be.
You cannot protect what you cannot see. Begin with passive network discovery—tools that listen to traffic rather than actively probing, because active scanning can crash legacy PLCs. Capture IP addresses, MAC addresses, protocols in use, and vendor/model information where possible. Map the result against your process documentation. Gaps in the map are likely your highest-risk assets.
A FortiGate NGFW at the IT/OT demilitarised zone (DMZ) is the single highest-ROI control you can implement. It provides:
FortiGate’s industrial protocol inspection capability means you can enforce “read-only” policies on a Modbus link without breaking normal operations—a control that would have required specialised ICS security hardware a decade ago.
Vendor remote access is one of the most exploited vectors in OT breaches. Rather than VPN credentials shared across a support team (that never rotate), implement session-based access with MFA, time-bound authorisation, and full session recording. Every remote session should be traceable to an individual, with command logging that satisfies your audit requirements.
Most OT devices can emit syslog or SNMP traps even if they cannot run agents. Collect these into your SIEM alongside IT logs. The goal is not perfection—it is visibility. Even coarse telemetry (device reboots, authentication failures, protocol anomalies) dramatically reduces mean-time-to-detect. CERT-In’s direction on 180-day log retention applies to critical sectors; centralised logging is the only practical way to meet this obligation across an OT estate.
Your IT incident response plan likely says “isolate the affected system.” In OT, isolation can trigger safety system failures or production losses that dwarf the cost of the incident itself. Your OT IR plan needs:
Tabletop exercises for OT incidents should involve operations leadership, not just the security team. The hardest conversations—”do we isolate the line or let it run while we investigate?”—need to be had before an incident, not during one.
One of the persistent challenges for Indian manufacturers is that OT and IT security have historically lived in separate silos—different tools, different teams, different reporting lines. The result is blind spots at the boundary where most attacks succeed. PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks deploys and operates it for manufacturing and multi-site clients as a managed service, bringing IT and OT visibility under a single operations pane.
Here is how each capability pillar addresses OT-specific challenges:
SIEM — Evidence for CERT-In and Detection Across the Kill Chain. Ora’s SIEM ingests logs from OT data sources—FortiGate firewall logs at the IT/OT boundary, Historian syslogs, engineering workstation events—alongside IT sources like Active Directory and cloud workloads. Correlation rules are mapped to MITRE ATT&CK for ICS (the OT-specific extension of the framework), so alerts surface in the language of the threat model, not raw log noise. Graph-based attack storyline reconstruction connects a reconnaissance event in IT to a lateral movement attempt in OT days later—a pattern that alert-by-alert review misses. Hot/cold/archive retention supports CERT-In’s 180-day log retention direction without requiring you to run an on-premises SIEM cluster sized for peak ingestion.
NMS — Unified Observability Across IT and OT Infrastructure. In a manufacturing estate, the NOC needs visibility into OT switches, industrial firewalls, WAN/SD-WAN links, and enterprise access points in the same dashboard. Ora’s NMS uses LLDP/CDP topology discovery to automatically map the network, including assets that don’t respond to standard IT discovery. ML-based anomaly detection flags deviations from baseline traffic patterns—a PLC that suddenly starts communicating with a new IP, or a sudden spike in protocol traffic that could indicate a scanning tool. For multi-vendor estates (a common reality in Indian manufacturing, where OT vendors span Siemens, Rockwell, Schneider, and others), the NMS provides a single observability layer rather than requiring a NOC engineer to monitor five vendor-specific consoles.
Video Surveillance (VMS) — Physical and Cyber Under One Roof. For manufacturing, retail, and multi-site estates, physical security events and cyber events often correlate. An after-hours network login combined with a camera showing an unfamiliar visitor in the server room is a much higher-confidence alert than either event alone. Ora’s video surveillance (VMS) module manages ONVIF, Hikvision, and Dahua cameras with on-platform video analytics, bringing physical security telemetry into the same operations view as network and log data. For a factory CISO, this means a single escalation path for both categories of incident rather than two parallel response teams working in isolation.
SOAR — Making the Six-Hour Window Realistic. CERT-In’s six-hour incident reporting requirement is not achievable through manual investigation alone when you are dealing with a fast-moving OT incident. Ora’s SOAR playbooks automate the initial response actions: the moment an IOC is confirmed on the IT network, a playbook can push blocklist updates to FortiGate, isolate a compromised endpoint at the switch port, generate a draft CERT-In notification from a template, and page the on-call engineer—all before a human has finished reading the first alert. Pre-built connectors to FortiGate mean that the gap between detection and containment shrinks from hours to minutes. The six-hour clock starts the moment an incident is detected; automation is what makes the timeline realistic rather than aspirational.
For organisations evaluating Ora, the starting point is the SIEM and NMS—unified visibility is the foundation on which detection and response are built. PJ Networks can assess your current OT visibility posture and propose a phased deployment roadmap.
OT security tools must be evaluated alongside plant engineering, not just IT. A SIEM rule that generates 200 false-positive alerts per shift is worse than no SIEM at all—operators will disable notifications or ignore them. Calibrate detection thresholds against production baselines, which requires involving the OT team in tuning.
Aggressive network segmentation without understanding OT traffic flows can break process automation. Map every communication path—including undocumented ones—before implementing firewall rules. Permit by exception; deny everything else. But “everything else” has to be understood before you deny it.
Phishing targeting plant engineers is a well-documented initial access vector. Engineers who use the same workstation to check email and program PLCs are a high-value target. Security awareness training for OT personnel should cover the specific scenarios they face: USB-based malware delivery, social engineering by fake vendor representatives, and credential phishing for remote access portals.
PJ Networks delivers managed security, NOC/SOC services, FortiGate deployment, and SD-WAN for Indian enterprises. Our OT security practice combines FortiGate’s industrial protocol inspection capabilities with 24/7 monitoring through PrahiX Ora, giving manufacturing clients the visibility and response capacity that the threat landscape demands without requiring them to build a specialised OT security team in-house.
If your organisation is beginning an OT security assessment, or has an existing programme you want to mature, our team can conduct a structured OT risk assessment aligned with IEC 62443 and CERT-In requirements. We can scope an engagement, propose a phased roadmap, and operate the resulting programme as a managed service—so your security team stays focused on strategy while we manage the day-to-day detection and response.
Contact PJ Networks to discuss your OT security posture. Whether you are securing a single plant or a distributed manufacturing estate across multiple states, the right architecture makes the difference between a contained incident and a production shutdown.