Perspective
Be Able to Show Within Hours That the Plant Is Safe to Keep Running
Joining plant and office networks is now routine. We rank what matters most, record every connection and rehearse the morning of an incident, so the decision to keep running rests on evidence.
4-minute read5 November 2026
In Brief
- If the plant must stop whenever the office network is compromised, an attacker has reached the plant in every way that affects revenue. A boundary that cannot show nothing crossed may hold and still fail to keep you running.
- We see four actions: keep a register of every connection with an owner, know what the plant does if each stops, collect logs the office side cannot alter, and rehearse the decision.
- Thinqmesh ranks your risks by business impact, tightens access, and rehearses a realistic incident with your team. The assessment and costed plan take four weeks.
Plant and office networks could once be kept apart with little effort: different people, different equipment and small reason to exchange data. Production reporting, energy monitoring, ERP integration and supplier support have since given everyone a reason to connect them. The usual response is a stronger line between the two. Our view is that this answers the easier question. The harder one arrives on the morning of an incident: can the people responsible show, quickly and with evidence, that the plant is safe to keep running?
A Boundary Has to Be Provable as Well as Strong
A compromise in business IT can stop operations without any harmful code reaching the control side, simply because the people in charge cannot rule it out. The decision to stop is then a sound one, made under uncertainty, and the plant pays for the doubt in lost production.
Boundaries are weakened by well-meant project work. Each connection is approved on its own merits, and no single person holds the combined picture. The cost shows up in hours, when managers need to know which links carry what, which can be closed and what the plant does without them. A register of flows, tested dependencies and a rehearsed decision turn that doubt into an answer.
Four Actions That Make the Boundary Something You Can Prove
Each action works with the connections you have today, and none needs a change on the plant floor to begin.
Register Every Connection Across the Boundary
Each flow is named, with its source, destination, data, direction and a business owner.
A historian feed for a dashboard, an ERP link for production confirmations, a vendor remote session and a spreadsheet that pulls from a plant server are usually approved one at a time. We gather them into a single register, so the combined picture exists before an incident asks for it.
Get started
- List every system that exchanges data between plant and office.
- Add the business owner for each one.
Record What the Plant Does If Each Flow Stops
This is the column that decides an incident, and it is the one most often missing.
If production can continue for three days without the ERP feed by working from a printed schedule, the business can close that link at once. If dispatch documents cannot be produced without an office system, the plant depends on that system, and the dependency should be engineered or rehearsed in advance.
Get started
- For each flow, write how long the plant can run without it.
- Mark every dependency that has never been tested.
Tighten Access and Remote Support First
Most incidents begin with stolen passwords, unpatched systems or excess access.
We review identity and access first, including remote access by suppliers, which should be authenticated strongly, switched on for a stated job and then switched off. Forgotten accounts are found and removed, and a new product is recommended only after that work.
Get started
- List every remote access account and who uses it.
- Close any that has no current job behind it.
Rehearse the Morning of an Incident
Plant manager, head of IT, shift supervisor and the person who signs off production, in one room.
We give the group one scenario, such as ransomware found on the office network at six in the morning, and ask who decides whether the plant keeps running and on what evidence. The systems and connections they had to guess about become the first items of the plan.
Get started
- Book two hours with the four roles in one room.
- Write down every point at which the group had to guess.
How Thinqmesh Solves This
We begin with which data, systems and processes would cause most harm if lost, leaked or stopped. That ranking governs the rest of the four weeks.
- Week 1
What Matters Most, Ranked
We identify the data, systems and processes that matter most, including the plant connections, and rank them by business impact.
- Week 2
Access and Existing Tools Tightened
We review who can reach what, strengthen sign-in, and look at how existing tools are used. A new product is recommended only when a specific risk justifies it.
- Week 3
Alerts That Get Read
Monitoring concentrates on the signals that matter, and roles are agreed in advance for when an incident occurs.
- Week 4
A Rehearsal, and a Costed Plan
Your team walks through a realistic scenario, and the findings become a prioritised, costed plan to close the gaps.
You finish with a risk assessment ranked by business impact, a costed plan, and a team that has practised the decision. The documents are yours.
