On the factory floor, IT is production
In manufacturing, IT is not a support function: it is the line that orders, tracks, ships and invoices. Ransomware or a network failure stops production — and every hour halted is margin lost. Xion IT Group works with manufacturing companies on continuity, security and integration between office and plant.
What we do for manufacturers
- Industrial networks and segmentation — offices and production separated and protected (network management);
- Ransomware protection — endpoints, supplier remote access brought under control, isolated backups (IT security);
- Operational continuity — recovery plans and tested encrypted off-site backup;
- NIS2 and supply-chain requirements — compliance work and the documentation that goes with it;
- ERP and production integration — automation and custom software for orders, stock and traceability;
- Ongoing support — round-the-clock monitoring and fast response (support contracts).
Where to start
A focused assessment: network, remote access, backups and potential points of stoppage. Within a few weeks the company knows where it is exposed and which sequence of work protects production at the lowest cost.
OT and IT: two worlds that have to talk safely
Two technologies with opposite logics live side by side in a factory. There is the office IT that is updated frequently, and there is the OT of production — PLCs, CNC machines, lines, supervisory systems — which often runs on dated software and cannot simply be updated without stopping production. The problem arises when these two worlds are connected without protection: an attack arriving through an office mailbox can reach the machines. The answer is not to isolate everything, since production data has to reach the ERP, but to segment properly, control the remote access used by external maintenance engineers, and monitor the points where the two meet. It is specialist work, and we do it while keeping production running.
From the ERP to the machine, without double entry
In manufacturing companies, time is most often lost at the points where systems do not talk to each other: the order entered in the ERP and then retyped for production, progress noted on paper and later transcribed, stock figures that no longer match reality. Every double entry is time lost and one more opportunity for error. By integrating ERP, production and warehouse — with custom integrations and, where it helps, automation — data flows once and stays consistent, from order intake through to dispatch.
Two kinds of IT that do not speak the same language
Two worlds that grew up separately coexist in a manufacturing company. On one side there is office IT: ERP, mail, accounts, design. On the other there is plant IT: numerical controls, supervisory systems, scales, labelling machines, automated warehouses.
They have different suppliers, different life cycles and opposite logics. In the offices things are updated often and replaced every four years; on the shop floor a machine stays in service for fifteen years and the manufacturer certifies only the configuration it was delivered with.
The weak point is not inside either world: it is the boundary between them. The ERP has to read progress data from the machines, the warehouse has to write to the ERP, quality control has to file where somebody will later go looking. When something in between stops working, every supplier has a plausible explanation pointing at the other one, and meanwhile the paperwork is done by hand.
The machines that cannot be updated
This is the normal situation rather than the exception, and the wrong reaction is to try to update them anyway — which loses the manufacturer’s certification and sometimes stops the line.
The correct answer is to separate the network. The machine stays where it is and carries on producing, but it lives in an isolated section with written rules about what it can reach. An attachment opened in the accounts office no longer reaches the line controls. It can be done with the plant running, it requires nothing to be changed on the machines, and it has the best ratio of cost to risk avoided of anything in manufacturing.
Maintenance engineers’ access
Every machine manufacturer asks for remote access for support, and almost always gets it quickly because it is needed immediately. Then it stays open for years.
The problem is not whether you trust the manufacturer: it is that the access has no expiry, is not logged, and nobody knows when it is used. If the supplier’s own network is compromised, that route in becomes yours. It can be put right without taking anything away from anyone: named accounts, enabled on request rather than permanently, and a record of when they were used.
What we find in plants
- Production and offices on the same network, with nothing in between.
- Backups on the same network they are supposed to save, and therefore reachable by an attack along with everything else.
- The departmental NAS turned into an archive of drawings, machine programs and test records, without anyone ever having added it to the backups.
- Machine-side computers missing from the inventory, sitting in dusty, hot environments, with disks that fail sooner.
- No written plan for what to do if the ERP stops on a Monday morning, which is when it happens.
Where we work
Xion IT Group operates across Lombardy, with offices in Milan, Lecco and Bergamo, and follows manufacturing companies throughout the surrounding provinces. For an Italian site of an international group, that means an engineer who can be on the factory floor rather than only on the phone.