UK manufacturers face mounting cyber risks

Photo by FlyD on Unsplash

Amid a surge of high-profile cyberattacks this year, manufacturing businesses have emerged as some of the weakest performers when it comes to cybersecurity policy, according to new research. The Cyber Culture Clash study, conducted by compliance training provider Skillcast, examined the gap between written cybersecurity policies and real-world practices across the UK’s largest businesses in multiple sectors.

The findings reveal that manufacturing recorded the second-lowest policy score of all industries analysed, underscoring a significant shortfall in frameworks designed to prevent attacks. One major issue is policy maintenance — manufacturers update privacy policies every 32 months on average — almost three years — leaving governance and risk management struggling to keep pace with evolving threats. By comparison, sectors such as retail and public services refresh policies roughly every six months.

Only a third of manufacturers maintain a formal cybersecurity policy, and just 20% hold Cyber Essentials Plus certifications, leaving many organisations exposed. There is some progress, however, with 60% referencing ISO 27001, a critical framework for industries reliant on complex supply chains, though adoption remains far from universal.

These weaknesses are mirrored in operational practice. The sector has seen a 51% increase in businesses reporting cyberattacks to the ICO over the past two years, while only 1.9% of staff hold dedicated cybersecurity roles — compared with more than 8% in the technology sector. Each industry in the study was assessed with two scores out of 260 — one for policy and one for practice. Policy covered essentials such as cybersecurity frameworks, regulatory references, and Cyber Essentials Plus accreditation, while practice assessed operational factors including staff headcount, attack rates, and phishing resilience.

Skillcast CEO Vivek Dodd, concluded: “The manufacturing sector faces significant challenges in aligning policy with practice, making it one of the most at-risk industries in our Cyber Culture Clash Report. Many manufacturers remain understaffed, underprepared, and overexposed relative to the cyber threats they face. Strengthening governance, increasing dedicated cybersecurity staff, and formalising security controls are critical steps if the sector is to reduce vulnerabilities and build true resilience.”

The full Cyber Culture Clash report can be accessed here.