Your machine vendor has a door into your plant. Who else has the key?

Walk the floor of almost any mid-sized plant and count the ways a machine builder can reach in from outside. A cellular gateway zip-tied inside the press cabinet, installed during commissioning. A consumer remote-desktop tool on the CNC’s Windows box, left over from a warranty call in 2021. A vendor VPN account created for a controls upgrade that ended 2 owners ago. Each one made sense on the day it went in. Nobody has looked at any of them since.

This is not an argument against vendor access. When a line is down and the OEM’s engineer in Germany can see the drive fault in 10 minutes instead of flying in on Thursday, that connection is worth real money. Machine builders often require remote access as a condition of the service contract, and plants that fight it usually lose. The problem is not that the doors exist. The problem is that nobody holds the keyring.

The quiet inventory problem

Ask who can remotely reach production equipment right now and most plants cannot answer. The access accumulated machine by machine, project by project, each arrangement negotiated between a controls engineer and a vendor tech who both had a line to get running. The result is a set of connections with 3 uncomfortable properties:

• They bypass your perimeter. A cellular modem inside a cabinet does not care about your firewall. It is a second internet connection, terminating directly on equipment, that your monitoring has never seen
• They authenticate as the vendor, not a person. A shared “SupportUser” login used by whoever is on shift at the OEM’s help desk means you will never know which human was on your machine, or whether that credential is on a list somewhere after the vendor’s own breach
• They outlive the reason they were created. Commissioning ends, warranty periods lapse, integrators finish projects. The access almost never gets closed, because closing it is nobody’s job

Attackers understand this pattern. Compromising one machine builder yields working credentials into dozens of plants, which is exactly the supply-chain shape behind several of the manufacturing incidents that make the news. Your plant’s exposure is not just your own security posture. It is the posture of every vendor holding a key.

What good vendor access looks like

The fix is not ripping out the modems. It is putting every remote path through the same front door, with rules a plant can actually operate. The pattern we build for manufacturers:

1. One inventory, on paper before anything else. Every machine, every access method, every vendor, the contract that requires it and the person on your side who owns the relationship. Walking the floor and opening cabinets is genuinely part of this step. Expect surprises
2. One gateway, not 12. Vendor sessions come through a single controlled path, a VPN or a purpose-built remote access broker, that lands in the plant network. Standalone cellular modems either come out or move behind that path. One door can be watched. A dozen cannot
3. Named accounts, per vendor, disabled by default. The OEM gets an account that exists but does not work until someone at the plant turns it on for a session. Enable on request, disable at the end of the shift. This single habit removes the standing-access problem that makes vendor credentials so valuable to steal
4. Sessions land on a jump host, not on the machine. The vendor reaches a hardened middle computer with the engineering software installed, and from there reaches only the equipment they support. Screen recording on that host settles every “what did they change?” question a warranty dispute will ever raise
5. Time and boundary rules in the service contract. Access windows, notification, MFA on the vendor’s side and a commitment to name the individuals connecting. Machine builders sign these terms routinely now. You just have to ask at renewal

None of this requires enterprise budgets. A plant with 8 machine vendors can stand up the whole pattern in a quarter, and the jump host is often a repurposed workstation.

Where this sits in the bigger OT picture

Vendor access is one wall of a room, not the room. It works alongside the segmentation that keeps the office network away from the controls network, which we covered in OT cybersecurity for manufacturers, and it matters more when the equipment runs software old enough to vote, the situation we described in legacy Windows on the plant floor. Our role stops where controls engineering begins: we design and operate the boundary and govern who gets through it, and deep PLC-level work stays with your OT integrator or the OEM.

The same discipline also pays off outside the plant. Cyber insurance applications now ask directly about third-party remote access, and enterprise customers put the question in their security questionnaires. “Every vendor session goes through one monitored gateway, on named accounts, enabled per session” is an answer that closes the topic. “Various vendors have various tools” invites a follow-up meeting nobody enjoys. The broader version of this discipline is in vendor risk management for small business.

A 30-day starting point

If the inventory does not exist, everything else is guesswork. A realistic first month:

• Week 1. Walk the floor with maintenance. List every machine with any outside connectivity, photograph the cabinets, note the modems and the software on the HMIs
• Week 2. Match the list to contracts. Which access is required by an active service agreement and which is a leftover?
• Week 3. Close the leftovers. Disable the orphaned VPN accounts, uninstall the remote tools nobody claims, pull the modems with no owner
• Week 4. For the access that stays, put enable-on-request in place. It is a phone habit and a checkbox, not a project

That sequence removes the worst exposure before any hardware is purchased, and it produces the one-page answer your next insurance renewal will ask for. The wider set of plant priorities is in our manufacturing cybersecurity guide.

Atticus Rowan builds and operates exactly this boundary for manufacturers across Ohio, working alongside the machine vendors rather than against them. If you are not sure how many doors your plant has, start a conversation and we will help you count them.