For decades, discussions around growth, productivity and security largely took place in separate conversations. Manufacturers focused on efficiency and output, while cybersecurity was often viewed as an IT concern. Today, those worlds are converging.

Manufacturers are now beginning to find out why that approach doesn’t work. A factory’s ability to recover from a cyberattack is now absolutely central to its plans for automation and expansion, because if a production line can’t recover, it can’t deliver. 

Across the Middle East, manufacturers are investing in automation and leveraging AI to increase output and strengthen their competitiveness. The UAE’s new industrial strategy, Operation 300bn, for instance, aims to increase the industrial sector’s annual contribution to GDP to AED 300 billion by 2031, around $82 billion. Achieving those ambitions depends on factories being able to turn additional capacity into resilient, dependable production. For a manufacturer targeting 10 per cent annual output growth, five weeks of downtime could erase the entire planned increase, assuming production is spread evenly across the year and lost output can’t be recovered. Industrial growth depends on increasing production capacity, yes, but also on ensuring that capacity can be restored when disruption occurs – and it will. 

Craig Mackay

The Cost of Downtime

Last year’s Jaguar Land Rover cyber incident showed just how damaging that disruption can be. The automaker announced the incident in early September 2025 and began a phased restart to its manufacturing processes on October 8, more than five weeks later. Restarting was, in itself, a process, with different facilities and production activities returning in stages. It demonstrated how, as factories become more connected, a disruption to one system can leave equipment elsewhere waiting, even when that equipment is working perfectly. IBM’s 2026 research puts the average cost of a breach in the Middle East’s industrial sector at $9.6 million, compared with $8 million across the region’s industries. That is a breach-cost measure rather than a downtime estimate, but it reinforces the financial stakes. Globally, manufacturing was the most attacked industry for the fifth consecutive year in 2026, accounting for 28 per cent of all cyber incidents. 

Compliance is making recovery testing more important than ever

Regional cybersecurity requirements, which are constantly being revised, give manufacturers another reason to examine whether recovery will work. Saudi Arabia’s National Cybersecurity Authority requires periodic testing of backup recovery effectiveness under Essential Cybersecurity Control 2-9-3-3. Its Operational Technology Cybersecurity Control 3-1-1-6 requires periodic tests and simulation exercises to assess OT disaster recovery and business continuity plans, alongside incident root cause analysis. Manufacturers therefore need to establish which obligations apply to their operations and build the relevant exercises into their recovery planning.

Those requirements put the effectiveness of recovery under the spotlight. Having a backup doesn’t necessarily establish how quickly a critical system can be restored, whether replacement hardware will support it, or whether the rest of the production line will be ready to work alongside it. Those obstacles need to be exposed early, and in manufacturing, they often begin with the oldest equipment in the room. 

The oldest machine can decide when production restarts

A manufacturer can invest in sophisticated automation and still depend on an aging workstation running Windows XP to keep a critical process running. Perhaps the legacy software of choice simply won’t run on anything newer, or replacing it would mean replacing equipment that is still performing perfectly well. These dependencies – and there a lot of them – is why backup and recovery operations in manufacturing environments are so complex. The decision to keep older equipment is understandable, especially when an upgrade could interrupt production, but keeping a machine running and being able to recover it are different challenges. If its hardware fails or ransomware makes it unusable, the backup everyone reaches for may cause more problems than it solves. 

Manufacturing resilience has become a growth imperative

If a packaging line needs to rebuild its workstation, the team might naturally reach for a backup only to discover that the replacement computer needs different drivers and the application requires its supplier to reactivate the license. What happens then? Production is left waiting while teams scramble to troubleshoot issues that could have been resolved during a recovery exercise.

Manufacturers should establish what each critical system needs to run, including compatible hardware, software versions, configurations, and supplier support, then test restoration in a controlled environment. Rather than slowing things down, this kind of preparation can actually make modernisation easier, because it gives plant teams a stronger basis for approving changes they’ve been putting off for years. Older equipment gets a workable recovery plan, while confidence builds in its eventual replacement. 

One restored machine doesn’t mean a working factory

Recovery is complicated when several systems have to work together before production can resume. A food manufacturer might successfully restore a line’s control workstation, only to find that the recipe-management system it relies on is still unavailable. Even when the equipment is ready, the quality team may need access to batch records before it can authorise production. Restoring those systems in the wrong order can leave engineers waiting or repeating work, only prolonging the disruption. Recovery priorities therefore need to follow the production process, with IT and plant teams agreeing which systems must return first and what has to happen before the line can safely restart.

The security controls protecting those systems also need to be part of the exercise. Manufacturers can restrict communication between different parts of an OT network to help contain an attack, allowing only the connections each process needs. A restored system has to function within those boundaries. Teams should test whether it can communicate with its dependencies, whether the required access credentials are available, and how suppliers will provide support if their usual remote connection has been disabled during containment. These details belong in the recovery procedure, alongside clear responsibility for checking the process before production resumes. Finding a blocked connection during a planned exercise gives the team time to resolve it, but discovering it while a factory is stopped puts everyone under pressure to improvise.

Prove the factory can restart

Recovery exercises should leave a record of what the team restored, how long it took, and which dependencies caused problems. Teams should compare the results with the recovery times the business needs and document who confirmed that production could safely resume. Any gaps need an owner and a follow-up test to establish whether the fix works. That gives management a basis for judging how much output remains exposed, while providing evidence to support applicable compliance obligations.

As Middle Eastern manufacturers expand and modernise, they need confidence that the systems supporting that growth can be recovered, and that confidence will only come from rehearsing the restart and resolving the problems that rehearsal exposes.