Manufacturing & Construction

The line does not care that it is a Tuesday.

In an office, an outage costs a morning. On a production floor it costs a shift, and the cost is countable: units not made, a crew stood around, a delivery date that moves. Iconium keeps the systems behind the floor running, and keeps the office network away from the machines that should never have been on it.

Under 2 hrs
First response, business hours
24/7
Threat monitoring
$179
Per additional site, per month
$0
Trip charges

What actually goes wrong on a plant or a job site

Operational technology

  • A machine controller or HMI on the same flat network as the front office, reachable by anything that gets into email
  • Equipment running an operating system the vendor stopped patching years ago, which cannot simply be upgraded because the machine is the point
  • A vendor remote-support connection left permanently open because it was easier than arranging it each time

The rest of the business

  • The ERP or MRP system down, so nothing can be scheduled, shipped or invoiced
  • Wi-Fi that does not reach the far end of the shop, or drops between racking
  • A second location or a job-site trailer added with no real network behind it
  • Payment or supplier-change fraud, where the target is the accounts payable inbox rather than the machinery

Keeping the floor and the office apart

This is the single most valuable thing an IT provider does in a manufacturing environment, and it is the one most often skipped because the network already works.

Segmentation

Production equipment belongs on its own segment with controlled routes in and out. When ransomware arrives through an office mailbox, the question that decides your week is whether it could reach the controllers. On a flat network the answer is yes.

Equipment you cannot patch

Some machines run software that is frozen by the vendor, by validation, or by the simple fact that the machine costs more than the building. You do not fix that by patching it. You fix it by controlling what can talk to it, monitoring what does, and keeping a restore path for the systems around it.

Vendor access

Machine builders and integrators often need remote access, and an always-on tunnel is a standing risk. Access that is granted when needed, logged, and closed again is not harder to work with once it is set up.

Coverage where the work is

Wireless that works across a shop floor is an engineering problem, not a consumer access point. Onsite visits are included in the monthly rate, and additional locations are $179 per month per site rather than per device in them.

Where the pressure actually comes from

Manufacturing is not a regulated industry the way healthcare or financial services are, which leads people to assume nobody is checking. Two groups are, and both of them can cost you money.

Your cyber insurer

Applications and renewals now ask specific questions: is multi-factor authentication enforced, is there endpoint detection and response, are backups tested, are the production and business networks separated. Weak answers show up as a higher premium, a lower limit, or a declined renewal — and an answer that turns out to be wrong shows up at claim time, which is worse.

Your customers

Large customers increasingly push security terms down through supplier agreements, and send questionnaires to go with them. For a supplier, that is not a compliance exercise; it is a condition of staying on the approved list. These arrive with a deadline and are far easier to answer when the controls already exist.

Both lists are largely the same set of controls, and mostly the ones below. The work is usually less about buying tools than about being able to show what is already running.

The controls we run

Network

  • Segmentation between production and business networks
  • Firewall management, wireless design and coverage across the floor
  • Controlled, logged vendor and remote access
  • Network documentation an auditor or an insurer will accept

Security

  • Managed detection and response, 24/7, independent of our support hours
  • Multi-factor authentication and identity hardening
  • Email security and quarantine, DNS and web content filtering, application allow-listing
  • Patch and vulnerability management, and dark web credential monitoring

Continuity

  • Backup verification and recovery testing for ERP, file and engineering data
  • Unlimited help desk with onsite included, because some of this needs hands on it

Planning

  • Quarterly technology planning, so disruptive work lands in a shutdown rather than mid-run
  • Vendor management across machine builders, ERP and connectivity
  • Audit evidence collection for insurer and customer questionnaires

Where our responsibility stops

  • We do not program, validate or maintain your production machinery. We manage the network and systems around it and work with the machine builder or integrator who does.
  • Insurer and customer questionnaires go in over your signature. We tell you exactly what is deployed and show the evidence behind each answer, which is the hard part.
  • Your ERP vendor keeps its own support obligations. We manage the environment it runs in.
  • We do not sell attestations, certifications or seals.

What it costs

The same published rates: $163 per user, $19 per computer, $100 per server, $17 per mailbox and $179 per additional location, per month. A fully equipped seat is $199 all in. The per-site rate is worth noting in manufacturing: a second plant or a site trailer is charged per location, not per device inside it. See the pricing page.

We cover plants and sites across Northeast Ohio and the Greater Houston area.

Questions manufacturers ask us

More than you would think, and none of it involves touching the machine. The risk from an unpatchable system is a function of what can reach it and what it can reach. Put it on its own network segment, control the routes in and out, log what talks to it, and keep a tested restore path for the systems around it. That turns a machine that cannot be patched into a machine that is difficult to get to, which is the realistic goal.

We can tell you exactly how your network is currently arranged, show you the documentation behind the answer, and where the answer is no, tell you what separating it would involve. That last part matters because insurers increasingly price on these answers rather than just collecting them. The form goes in over your signature, since the insurer is contracting with you — and an answer that turns out to be wrong is a problem at claim time, which is the worst moment to discover it.

Yes, and this is one of the more useful things we do for manufacturers. Send it over before the deadline rather than the week of it. These questionnaires usually surface one or two genuine gaps, and a fixed answer is worth more than an explained one — particularly when staying on an approved supplier list depends on it.

Your first location is included in the monthly rate and each additional site is $179 per month. That is charged per location rather than per device inside it, which is usually favourable for manufacturing, where a second plant might have a lot of connected equipment and very few users. It covers firewall management, network segmentation, wireless and the network documentation an auditor or insurer will ask for.

Both, and it is solvable. Shop-floor wireless is an engineering exercise rather than a matter of adding another consumer access point: racking, machinery and the building itself all absorb and reflect signal, and scanners and tablets are less forgiving than laptops. It needs a survey and a design, which is project work, and then it stays covered under the monthly rate.

The honest answer depends on whether your backups restore, which is a different question from whether they run. We verify and test restores rather than trusting a completed-job notification. Where the ERP is hosted by a vendor, we manage your connection to it and hold them to their obligations; where it is on your own server, it is ours to recover, and we will tell you in advance roughly how long that takes.

That is the normal arrangement. They know the equipment and we are not going to pretend otherwise. What we do is manage the network and systems around it, and give them access that is granted when needed, logged, and closed again afterwards rather than left open indefinitely. Most integrators are glad of a counterpart who answers the phone.

We plan for a clean handover, never withhold data or client intellectual property, and work with your incoming provider. In a manufacturing environment that also means handing over the network documentation and the vendor access arrangements, which is the part that usually goes missing. Onboarding takes about a week, with terms of twelve, twenty-four or thirty-six months and no setup fee.

Is your shop floor on the same network as your email?

Call (440) 991-9980 or book a thirty minute call. It is a quick thing to check and a bad thing to find out during an incident.

See also: every industry we serve and our written answers.