AI security review for manufacturing & industrial

Manufacturing AI is not enterprise SaaS with a factory label. It operates in environments where failures have physical consequences — production halts costing six figures per hour, safety incidents affecting human workers, and IP leakage exposing decades of process engineering to competitors.

Three characteristics set manufacturing AI apart from typical enterprise deployments:

• OT/IT convergence. AI systems bridge the gap between enterprise IT (cloud, SaaS, managed infrastructure) and operational technology (PLCs, SCADA, MES, DCS). The trust boundary between these worlds is the most consequential in your architecture — an AI agent that crosses it without proper controls can propagate IT-origin attacks into physical processes.
• Air-gapped and hybrid environments. Many production networks are deliberately isolated. AI systems that require cloud connectivity for inference, model updates, or telemetry create new network paths that undermine existing segmentation strategies.
• IP as the primary asset. Manufacturing process knowledge — recipes, tooling parameters, quality thresholds, yield optimisation data — is the competitive moat. Any AI system with access to this data (RAG over engineering documents, predictive maintenance models trained on process data) carries IP exfiltration risk that general-purpose AI reviews miss entirely.
• Safety-critical production systems. Unlike a misclassified email or a wrong product recommendation, a manufacturing AI that sends an incorrect setpoint to a furnace, misclassifies a defect as acceptable, or overrides a safety interlock can cause physical harm. The blast radius is not data — it is equipment and people.

Manufacturing AI faces attack surfaces that IT-centric threat models are not designed to find:

• Prompt injection through engineering documents. AI systems that process CAD files, work instructions, maintenance logs, or supplier specifications are vulnerable to injection attacks embedded in document metadata, revision notes, or structured fields that bypass content filters designed for natural language.
• Agentic AI with PLC/MES/SCADA tool access. An AI agent authorised to read sensor data, adjust process parameters, or trigger maintenance workflows through OPC-UA, MES APIs, or direct PLC communication has a blast radius that extends into the physical world. Standard agentic AI controls (human-in-the-loop, tool approval boundaries) must account for real-time process constraints where a 30-second approval delay is itself a safety risk.
• RAG over proprietary designs with IP leakage risk. A knowledge retrieval system indexed over engineering drawings, process recipes, or quality control parameters can leak IP through overly broad retrieval, embedding inversion, or simply by answering questions from users whose clearance level doesn't match the source document classification.
• Supply chain AI with multi-vendor trust boundaries. Manufacturing supply chains involve dozens of partners, each with their own AI systems for demand forecasting, quality prediction, and logistics optimisation. Data shared with a supplier's AI system crosses an organisational trust boundary — and that supplier's AI may be backed by a third-party model provider you have no contractual relationship with.

Drel maps every assessment to the frameworks most relevant to manufacturing and industrial AI:

• EU AI Act Article 6 & Annex I — high-risk classification for AI in safety components of machinery and products covered by Union harmonisation legislation
• EU Machinery Regulation 2023/1230 — safety requirements for AI-enabled machinery, including autonomous operation and human-machine interaction
• IEC 62443 — industrial automation and control systems security, covering zones, conduits, and security levels for OT environments
• ISO/IEC 42001 — AI management system requirements, applicable to the organisational governance of manufacturing AI
• NIST AI RMF — govern, map, measure and manage AI risk across the manufacturing AI lifecycle
• OWASP Agentic Top 10 — controls for AI agents with tool access, directly applicable to agents with OT system connectivity

Drel's assessment process accounts for the deployment realities of manufacturing AI that cloud-native security tools ignore:

The system model explicitly captures network segmentation — which components run in the cloud, which in the DMZ, which on the production network, and which on isolated OT segments. Trust boundaries between these zones are first-class objects in the threat model, not annotations.

For air-gapped deployments, the assessment identifies the specific points where data crosses the air gap (USB transfer, data diodes, one-way replication) and evaluates whether the AI system's operational requirements (model updates, telemetry, feedback loops) create pressure to weaken isolation. The disposition can specify controls that must be in place before any network path is introduced.

Re-assessment triggers include OT-specific events: firmware updates to connected PLCs, addition of new communication protocols, changes to zone/conduit architecture, and expansion of the AI system's access to additional process data sources.