For manufacturers, cybersecurity management has long extended beyond the office and onto the production floor. As IT and OT environments become increasingly interconnected, organizations must manage not only conventional computers and servers, but also production and control systems such as programmable logic controllers (PLCs), human-machine interfaces (HMIs), supervisory control and data acquisition (SCADA) systems, industrial robots, automated guided vehicles (AGVs), and automated optical inspection (AOI) equipment. High-tech manufacturing environments, in particular, often operate devices from different generations and for different purposes side by side. As the number of devices grows, the scope of management becomes increasingly complex.

The real challenge is that these devices are often directly tied to production. Office computers can be scheduled for updates, restarts, or maintenance, but production equipment may need to run continuously for extended periods. Even a single outage can affect manufacturing processes, production capacity, and delivery schedules. Manufacturers must therefore ensure that any cybersecurity measure they introduce does not compromise production stability or increase the risk of downtime.

The manufacturing cybersecurity dilemma: security management requirements × uninterrupted production. (AI-generated conceptual illustration; not an actual product interface or customer data.)

The real question for manufacturers is therefore not whether to implement cybersecurity, but how to gain clear visibility into devices, bring them under management, and continuously monitor risk without disrupting existing production processes. This is where OT security begins to differ significantly from conventional endpoint management.

2. The Biggest Management Constraint for OT Devices: Agents Cannot Be Freely Installed on Many Machines

One reason OT environments are difficult to manage is that endpoint management practices familiar to most organizations cannot always be applied directly on the production floor. Agents are valuable for conventional computers because they can collect information such as the operating system, patch status, software versions, and security posture. In manufacturing environments, however, many devices may run legacy versions of Windows, specialized Linux distributions, embedded systems, or proprietary platforms maintained exclusively by the equipment vendor. Whether third-party software can be installed—and whether it could affect the equipment’s intended operation—must be carefully evaluated.

Some devices are also subject to vendor maintenance terms, compatibility validation requirements, or hardware performance constraints. Even when an organization needs stronger management capabilities, deploying new software directly on the equipment may not be feasible. For production lines that depend heavily on stable operation, these constraints do not make the devices any less important. In fact, the more critical a device is, the less practical it may be to alter its existing environment. With diverse OT devices and long equipment lifecycles, maintaining an up-to-date view of device information and communication relationships becomes more difficult, further complicating asset inventory and management.

IT and OT operate under different requirements. (AI-generated conceptual illustration; not an actual product interface or customer data.)

This challenge will become even more pronounced as organizations adopt more AI and automation applications and prepare for future post-quantum cryptography (PQC) migration. Whether the objective is AI governance, certificate management, or quantum risk assessment, the prerequisite remains the same: organizations must first know which devices exist, what systems they run, and their current status. When management tools cannot be deployed directly on a device, an alternative approach that does not depend on endpoint installation is needed to bring the asset into view.

3. The First Step in OT Security Is to Gain Complete Device Visibility Without Disrupting Production

When agents cannot be freely installed on many OT devices, the management strategy cannot focus solely on placing more tools on the equipment. It must begin with a more fundamental question: Does the organization truly know which devices are operating on the production floor, where they are located, and what they are connected to? For manufacturers, this level of visibility often takes priority over collecting in-depth data from an individual device. Without a complete device inventory, subsequent risk assessments, access controls, and incident investigations cannot be built on a consistent foundation.

OT environments therefore require an approach suited to operational conditions: agentless, non-intrusive, and low-impact. The goal is to discover and identify devices and map their connections without changing the equipment’s existing environment or requiring additional software on every device. This information also provides an essential basis for identifying anomalies and assessing risk.

The first step in OT security: establish complete device visibility. (AI-generated conceptual illustration; not an actual product interface or customer data.)

In OT environments, discovering devices first is often more important than installing more tools on them. By bringing previously unseen and difficult-to-manage devices into view, organizations can progressively extend management to device identification, access control, and continuous risk management without adding overhead to production equipment. This is precisely where agentless NAC delivers value.

4. UPAS Agentless NAC: Visibility and Control for Devices That Cannot Run Agents

When agents cannot be freely installed in an OT environment, device governance must be approached from a different layer. UPAS Agentless NAC obtains device IP addresses, MAC addresses, switch ports, user identities, and connection status from the network. It first identifies devices connecting to or already present on the internal network, then applies authorization and access control according to defined policies and network access rules.

This approach is particularly well suited to manufacturing environments. PLCs, HMIs, industrial computers, and other devices that are not suitable for additional software deployment can first be brought into view through an agentless approach. Conventional IT endpoints and industrial computers that are suitable for deeper management can then use ITAM to provide hardware and software inventory, vulnerability information, patch status, configurations, and operations and maintenance data.

UPAS Agentless NAC + ITAM: from network visibility to endpoint governance. (AI-generated conceptual illustration; not an actual product interface or customer data.)

NAC addresses “who is on the network and whether they are allowed to connect,” while ITAM adds visibility into “whether the connected device currently meets security requirements.” Together, they create an end-to-end device governance process.

For manufacturers, the value of this approach is that it establishes a consistent view of devices without requiring every machine to use the same management method. Devices that cannot run agents are made visible first, while endpoints suitable for deeper management can be brought under more comprehensive control. This allows cybersecurity management to extend onto the production floor while minimizing disruption to existing equipment.

5. Manufacturing Cybersecurity Means Keeping OT Devices Continuously Visible and Controllable Through Dynamic Governance

For manufacturers, cybersecurity governance must ultimately work in the operational environment. Production equipment must remain in continuous operation while also staying visible, identifiable, and manageable. Only when organizations can continuously track device assets, connection status, and changes in risk can cybersecurity measures become truly integrated into production processes rather than remaining limited to the office IT environment.

This also means that manufacturing cybersecurity will increasingly emphasize continuous governance. From device visibility and access control to vulnerability management, configuration management, anomalous behavior, and the dynamic governance of OT devices, these capabilities must operate continuously without interrupting production. UPAS follows this same path, progressively extending its governance architecture from network access control and IT asset governance to the broader trust governance requirements of the AI era and post-quantum cryptography.

In manufacturing, mature cybersecurity is not defined by the number of tools deployed, but by whether equipment can remain in production while staying visible and properly managed.