The adoption of Internet of Things (IoT) devices in manufacturing has accelerated rapidly. Smart sensors, connected machinery, industrial controllers, cameras, and environmental monitors now sit at the heart of modern production environments. These devices promise efficiency, predictive maintenance, reduced downtime, and better decision-making.
However, organisations often underestimate the cyber security risk of IoT devices.
Manufacturing environments are particularly attractive to attackers. They combine valuable intellectual property, operational technology that cannot easily be taken offline, and legacy systems that were never designed to be internet-connected. IoT devices sit at the intersection of these pressures, extending the attack surface far beyond traditional IT systems.
One of the most persistent and dangerous weaknesses in manufacturing IoT deployments is the continued use of default passwords. This is understood to impact around 90% of devices in manufacturing. Here’s why the issues persist.
Increased Cyber Security Risks Of IoT Devices In Manufacturing
IoT devices differ fundamentally from traditional IT assets. Many are deployed for a single operational purpose, managed by engineering or facilities teams rather than IT, and expected to run continuously for years. Security is often secondary to uptime.
Common characteristics that increase risk include limited processing power, which restricts the use of advanced security controls, infrequent firmware updates, inconsistent asset inventories, and poor visibility for security teams. When these devices are connected to production networks, they can become stepping stones for attackers to reach critical systems.
In manufacturing, this risk is amplified by the convergence of IT and operational technology. A compromised IoT device is not just an IT problem; it can lead to production disruption, safety incidents, or equipment damage.
Default Passwords Remain A Critical Vulnerability
Despite widespread awareness, default passwords continue to be one of the most exploited weaknesses in IoT devices. Many devices are shipped with well-known usernames and passwords such as admin/admin or admin/password. In some cases, these credentials are hard-coded and cannot be changed without additional controls.
In a manufacturing setting, default passwords are often left in place for pragmatic reasons. Devices may be installed quickly during line upgrades, commissioned by third-party contractors, or deployed at scale with limited time for secure configuration. Once operational, there is little incentive to revisit them unless something breaks.
Attackers actively scan the internet and corporate networks for exposed IoT devices using known default credentials. Once accessed, these devices can be commandeered with minimal effort. The barrier to entry is low, and the payoff can be high.
The Impact Of Compromised IoT Devices
A single compromised IoT device can have disproportionate consequences in a manufacturing environment. Attackers may use it as a foothold to move laterally across the network, harvesting credentials or accessing production systems. In other cases, the device itself becomes the weapon.
Manufacturers have seen incidents where attackers disable sensors, manipulate environmental controls, or interfere with production line monitoring. Even if the device does not directly control machinery, the loss of trust in its data can force a shutdown while integrity is verified.
There is also a growing risk of IoT devices being enrolled into botnets. Compromised devices can be used to launch distributed denial-of-service attacks, consume bandwidth, or provide anonymised access for further attacks.
In regulated manufacturing environments, this can lead to compliance breaches and reputational damage, even if production is not directly affected.
Why Default Passwords Persist In Manufacturing
In the UK, IoT devices with default passwords have been banned since 2024. So the continued presence of default passwords is rarely due to negligence alone. It is often a symptom of broader operational challenges.
Manufacturing environments frequently involve long equipment lifecycles. Devices installed five or ten years ago may pre-date current security policies. Responsibility for these assets can be unclear, sitting between IT, engineering, and external suppliers. In some cases, vendors discourage password changes due to support or warranty concerns.
There is also a cultural element. Production uptime is king. If changing a password introduces even a small risk of disruption, it is often deprioritised. Unfortunately, attackers rely on this mindset.
Default Passwords As A Gateway To Larger Attacks
What makes default passwords particularly dangerous is not just the immediate access they provide, but what comes next. Once inside, attackers can escalate privileges, capture network traffic, or deploy malware designed for industrial environments.
Ransomware groups have increasingly targeted manufacturing organisations, and insecure IoT devices are an attractive entry point. They are rarely monitored with the same rigour as servers or endpoints, and alerts may go unnoticed until damage is done.
In this context, a default password is not a minor configuration oversight. It is an open door into the production environment.
Reducing Cyber Security Risks Of Devices In Manufacturing
Addressing the risks of IoT devices requires a practical, operations-aware approach. Eliminating default passwords should be a non-negotiable baseline control. Every device should have unique, strong credentials, stored and managed centrally where possible.
This must be supported by accurate asset inventories, clear ownership between IT and operational teams, and network segmentation that limits what an IoT device can access if it is compromised. Monitoring should extend beyond traditional IT assets to include anomalous behaviour from connected devices.
Crucially, cyber security needs to be treated as a production resilience issue, not just an IT concern. When leadership understands that a weakly secured sensor can halt a production line, the business case for change becomes clear.
Manufacturers that address default passwords and wider IoT security risks early place themselves in a stronger position to adopt advanced automation safely. Those that do not are increasingly exposed in a threat landscape that is actively targeting industrial environments.
Looking for an IT provider that understands manufacturing, protecting connected production environments while keeping operations moving? Reach out today:
Contact Us
