The silent risks of cybersecurity in the company

The attack that will shut down your factory has already got in. It just hasn't been activated yet.

This isn't pessimism — it's the pattern documented in the Verizon DBIR 2025: ransomware was present in 88% of SME data breaches, against 39% in large organisations. SMEs are the disproportionate target precisely because they hold valuable data — orders, production formulas, margins negotiated with German customers — and weak defences. CERT.PT recorded 2,758 cybersecurity incidents in Portugal in 2024, an increase of 36% on 2023, with around 78% occurring in private entities (CNCS, 2024). A garment factory in the Vale do Ave, a tool distributor in Lousada, a plastics injection moulder in Marinha Grande — all are targets. The attacker doesn't read the organisation chart; they read the list of ports open to the internet.

The real problem isn't the obvious phishing email. It's the production terminal still running Windows 7, the remote access the maintenance technician left active after their last visit, the work order file shared on a personal OneDrive because the ERP had no mobile app. These vectors exist in almost every Portuguese industrial company with 20 to 200 employees — and none of them appear in the monthly IT report.

At the end of this guide you'll find a 16-point checklist to audit your company's real exposure in under two hours, plus a priority matrix to bring to tomorrow's meeting.

What you need before you start

An audit without preparation produces a list of findings with no context. Before starting, gather five elements: the map of active systems (ERP, MES, production terminals, POS, WMS — with version and operating system); the list of active remote accesses (VPN, RDP, TeamViewer, AnyDesk — who has them, since when, with which credentials); the inventory of users and accounts, including former employees, suppliers and external technicians; the documented backup policy (where they are held, how often, who validates the restore); and the contact for the IT lead or external provider, with an SLA defined in writing.

Two additional points most people forget: confirm whether the company falls within the scope of the NIS2 Directive, transposed by Decree-Law No. 65/2025, which extends cybersecurity obligations to medium and large companies in 18 critical sectors, including industry. And make sure the CEO or the CFO is in the room. Without senior management present, the audit is nothing more than an academic exercise — the findings sit in a folder and no one signs off on the priority for remediation.

Dimension 1 — People

The human vector is responsible for the majority of incidents. Not through malice — through industrial routine. In a typical garment factory with 60 employees, it's common to find three risk profiles that no IT report captures: the user with administrator access who should never have had that level (granted "temporarily" three years ago and never removed); the former employee whose account is still active in the ERP (they left in March, the account was disabled in Active Directory but not in the production system); and the machine maintenance supplier with permanent access to the internal network via TeamViewer, with no record of when they access it or what they do.

The simulated phishing exercise is the most revealing control before any training. At a tool distributor with 45 employees we worked with, the click rate on a simulated phishing email was 34% in the first campaign — including two members of the management team. That figure, not an estimate, is the argument for the CEO to approve the training budget.

• Audit user accounts in the ERP and critical systems: disable anything with no activity in the last 60 days.
• Implement multi-factor authentication (MFA) on all remote accesses, without exception.
• Define access profiles by role: the production operator doesn't need access to invoicing.
• Run a simulated phishing exercise before any training — it measures real exposure.

Dimension 2 — Processes

The absence of a documented process is, in itself, an operational risk. When the IT technician is on holiday and the backup server fails, who acts? Using what procedure? Within what timeframe? The honest answer in most Portuguese industrial SMEs is: "we call the provider and wait".

An incident response plan that has never been tested is not a plan — it's an illusion of security written in a document nobody has read.

In INFOS projects we see a recurring pattern: the company has a contract with an external IT provider, but the contract doesn't define response times for security incidents. The provider responds when they can. The company is left at a standstill when it can't afford to wait. The detail the manuals don't mention: the general support SLA (normally 4 business hours) is completely different from the security incident SLA, which should be 1 hour, 24 hours a day. These are two distinct contracts — or two distinct clauses in the same contract. Most SMEs only have the first.

Define a realistic RTO (Recovery Time Objective) before negotiating any SLA. How long can the company be at a standstill without irreversible consequences? For a distributor with next-day delivery, it's 4 hours. For a garment maker halfway through an urgent order for Inditex, it's 2 hours. That figure determines the investment in redundancy — not the other way round.

• Document the incident response process: who notifies, who decides, who communicates externally.
• Test the backup restore at least once a quarter: making a backup isn't enough, you need to know it works.
• Review contracts with external providers: require a security incident response SLA in writing, separate from the general support SLA.

Dimension 3 — Systems

The shop floor is the blind spot of Portuguese industrial cybersecurity. The production terminals, the CNC machine controllers, the barcode scanners in the warehouse — all communicate over the network. Many run unsupported operating systems. None have antivirus. And they're on the same network as the ERP server.

OT/IT network segmentation is the technical control with the best cost-impact ratio available to an industrial SME. Ransomware that gets in via the sales rep's laptop should not be able to reach the production server — but in most Portuguese factories, it can, because they share the same switch with no VLAN configured. Separating the two networks with an industrial firewall costs less than a single day of production downtime.

Dimension 4 — Data

Classify data before protecting it. Not all of it has the same value or the same regulatory risk. The dyeing formula for a textile article, the price list negotiated with a German retailer, employees' personal data for payroll processing — each requires a different level of protection and a different legal regime.

The GDPR and Law 58/2019 impose concrete obligations regarding personal data. A breach exposing employee or customer data can result in a fine from the CNPD. But the operational risk of losing production data — work orders, batch traceability, quality history — is often more immediate than any fine. A footwear company in Felgueiras that loses the traceability history for an entire collection has no immediate legal problem; it has a problem with the international buyer who demands documented compliance at the next visit in February.

To go deeper on protecting backups against ransomware, see the guide Cybersecurity, NIS2 and immutable backup: a practical guide for industrial SMEs.

• Map where the critical data is: local server, cloud, laptops, USB drives, email.
• Implement backup with the 3-2-1 rule: 3 copies, 2 different media, 1 offsite or immutable copy.
• Encrypt data at rest on critical servers and on the sales force's laptops.
• Review sharing permissions on OneDrive/SharePoint: production files shared publicly are more common than you'd think.

Dimension 5 — Compliance

Regulatory compliance isn't the goal — it's the minimum floor. But it's a floor that many Portuguese industrial SMEs have yet to reach, and the penalties have stopped being theoretical.

NIS2, transposed by Decree-Law No. 65/2025, extends cybersecurity obligations to medium and large companies in 18 critical sectors. If your company has more than 50 employees or turns over more than 10 million euros and operates in manufacturing, distribution or food retail, check whether it falls within scope. Penalties reach 10 million euros or 2% of global turnover — and the responsibility falls on the management board, not on the IT department. Read the detail in NIS2 in industrial SMEs: what changes in practical operational terms.

Two compliance points most people forget until the audit: the invoicing software must be certified by the AT (DL 28/2019) and the SAF-T reported monthly (Ordinance 195/2020) — any new ERP integration can break the certification without warning. And if you have 50 or more employees, the whistleblowing channel has been mandatory since 2021 (Law 93/2021) — it's not a best-practice recommendation.

• Check whether your company falls within the scope of NIS2: sector, size, role in the value chain.
• Confirm that the invoicing software is certified by the AT and that the SAF-T is reported monthly.
• If you have 50 or more employees, implement a whistleblowing channel (Law 93/2021).
• Document the record of personal data processing activities (GDPR, Article 30).

Quick audit checklist — 16 points in 2 hours

Split this checklist in two: an IT lead handles the technical points (1–10), the operations manager validates the process and compliance points (11–16). In two hours you'll have a real exposure map — not an estimate, but an inventory with gaps identified and prioritised.

1. Complete inventory of active systems with version and operating system.
2. List of all active remote accesses (VPN, RDP, TeamViewer, AnyDesk).
3. User accounts audited: disable accounts with no activity in the last 60 days.
4. MFA active on all remote accesses and administrator accounts.
5. OT/IT network segmentation verified: production isolated from the office.
6. Security patch applied in the last 30 days on critical servers.
7. Antivirus/EDR active and up to date on all managed endpoints.
8. Firewall with documented rules reviewed in the last 6 months.
9. Backup tested (real restore) in the last 90 days.
10. Access logs for the ERP and critical systems active and retained for at least 90 days.
11. Incident response plan documented and communicated to the team.
12. Contract with the IT provider with a security incident response SLA defined in writing.
13. Phishing awareness training carried out in the last 12 months.
14. Record of personal data processing activities up to date (GDPR).
15. NIS2 scope check carried out and documented.
16. Whistleblowing channel implemented (if ≥ 50 employees, Law 93/2021).

Common mistakes and how to avoid them

Mistake 1 — Confusing antivirus with cybersecurity. Antivirus detects known malware. It doesn't detect an attacker who got in with stolen legitimate credentials — which is the dominant vector in the incidents CERT.PT records. Implement behaviour monitoring (EDR) and access logs alongside traditional antivirus. The practical difference: antivirus sees the malicious file; EDR sees the legitimate user accessing 3,000 files in 4 minutes at 2 a.m.

Mistake 2 — Backup without a restore test. We regularly see companies that have run daily backups for years and discover, at the moment of the incident, that the restore has been failing for months — full disk, silently interrupted job, corrupted configuration file. Schedule a quarterly test restore in the calendar as an event with a named owner and a documented result. Not as a task on the IT list — as a meeting with minutes.

Mistake 3 — Remote access without VPN. RDP exposed directly to the internet is the most exploited entry vector in Portuguese industrial SMEs. The fix costs less than half a day's work: put RDP behind a VPN with MFA. Any competent IT provider does this in an afternoon. If yours doesn't, or doesn't know why it's necessary, that's relevant information for the next contract renewal.

Mistake 4 — Treating cybersecurity as an IT project. The most expensive mistake. When the security investment decision rests exclusively with the IT lead — often a competent professional but without budget authority — the result is a list of unimplemented recommendations. Cybersecurity is a management decision with operational and legal consequences. The CEO and the CFO have to be in the process, not merely informed at the end.

Mistake 5 — Ignoring the supply chain. The machine maintenance supplier who accesses the internal network via TeamViewer is a risk vector the company doesn't control directly. In a garment sector with extensive subcontracting, the order portal shared with 12 subcontractors is an attack surface with 12 entry points that the parent company doesn't audit. Map third-party accesses with the same rigour as internal accesses — and revoke them when the relationship ends.

Priority matrix for tomorrow's meeting

Not all controls carry the same weight. After the 16-point audit, use this matrix to prioritise remediation by impact and implementation effort.

Portuguese industrial cybersecurity has a perception problem, not a resource problem. The companies we visit are not careless — they are companies that grew fast, digitalised in layers, and accumulated silent risk that no monthly IT report captures. The 16-point audit doesn't solve that risk. It identifies it. And identifying it is the only honest starting point.

Frequently asked questions

What is the NIS2 Directive and how does it affect my company?

NIS2, transposed by Decree-Law No. 65/2025, extends cybersecurity obligations to medium and large companies in 18 critical sectors, including industry. If your company operates in sectors such as energy, transport, water or critical manufacturing, it falls within scope. It requires audits, incident response plans and SLAs defined with IT providers.

What is the real risk of a production terminal running Windows 7?

A terminal running Windows 7 hasn't received security updates for years. It's an open door for malware and ransomware that paralyses the factory. The attacker doesn't need direct access — they get in through the internal network via vulnerable machines. Most Portuguese industrial SMEs have this problem and don't know it.

How long can my factory be at a standstill without irreversible damage?

That time is your RTO (Recovery Time Objective) and it determines all the investment in security. A distributor with next-day delivery can withstand 4 hours. A garment maker halfway through an urgent order can withstand 2 hours. Define this figure before negotiating any SLA with providers — not the other way round.

What is simulated phishing and why does it matter?

It's a fake email sent internally to test whether employees click on malicious links. At a distributor with 45 employees, 34% clicked in the first campaign. This real figure, not an estimate, convinces the CEO to approve a security training budget.

Do I need MFA on all remote accesses?

Yes, without exception. Multi-factor authentication (MFA) prevents a stolen password from being enough to get in. Apply it to VPN, RDP, TeamViewer and any remote access. It's the most effective control against attacks on SMEs, with low cost and rapid implementation.

How do I know if a former employee still has access to the systems?

Audit accounts in the ERP and critical systems: disable anything with no activity in the last 60 days. An account disabled in Active Directory may still be active in the ERP or the production system. This is common in SMEs — the employee left, the account was partially "disabled", and no one checked.

What's the difference between a general support SLA and a security incident SLA?

The general SLA is normally 4 business hours. A security incident requires a response within 1 hour, 24 hours a day. These are two distinct contracts. Most SMEs only have the first and are left at a standstill when they need a rapid response. Negotiate both in writing with the provider.

Sources

• CERT.PT and CNCS (National Cybersecurity Centre) — Report on Cybersecurity Incidents in Portugal 2024
• Decree-Law No. 65/2025 — Transposition of Directive (EU) 2022/2555 (NIS2) into Portuguese legislation
• Directive (EU) 2022/2555 (NIS2) — Directive on measures for a high common level of cybersecurity across the Union
• ENISA (European Union Agency for Cybersecurity) — Guidelines on Incident Handling and Response
• ISO/IEC 27001:2022 — International standard for information security management systems