This piece is written for OT security firms, not for manufacturers running modernization projects. It looks at how projects such as connected equipment, remote access and cloud integration create demand for security expertise, and how firms can be present at the stage of the project where that demand appears.
Modernization is a project, and projects have phases
Unlike an incident, modernization is planned. A manufacturer decides to connect production equipment, add remote monitoring, integrate plant data with cloud analytics or replace control systems. Budgets are set, integrators are chosen and timelines agreed.
Security questions surface at different points in that project, and each point has a different buyer and a different kind of search. Understanding the phases is what lets a security firm create content that meets the project, not just the category.
Phase 1: planning, when security is cheapest to design in
Early in a project, the questions are architectural: how new connections should be designed, what should be segmented, how remote access will work, and what security requirements to include in specifications for integrators and equipment vendors.
Security expertise has the most influence here and costs the least, but many manufacturers do not yet realize they need it. The people involved are often project managers, engineers and operations leaders.
Phase 2: vendor and integrator selection
When a manufacturer evaluates system integrators and equipment suppliers, security becomes a procurement question: what the vendor's remote access looks like, how updates are handled, and what security responsibilities sit with whom.
Some manufacturers seek independent advice at this stage to evaluate proposals they are not equipped to judge.
Phase 3: before go-live
As systems approach commissioning, questions shift to verification: has the new environment been implemented as designed, are remote access paths controlled, and are there unexpected connections?
This is often where an assessment is commissioned, sometimes because a customer, insurer or internal audit requires evidence before production depends on the new systems.
Phase 4: after go-live, when the attack surface has already changed
Many modernization projects are completed without security involvement. The need surfaces later: a remote access tool is discovered, a monitoring platform connects in ways nobody documented, or an incident elsewhere prompts a review.
The attack surface concern is well founded, though the specific evidence for it is general rather than manufacturing-specific: IBM's 2026 threat intelligence data found that exploitation of public-facing applications rose 44% year over year across all industries it tracked in 2025, not specifically in manufacturing or OT environments. Modernization typically adds connectivity to environments that were designed around isolation, so the general pattern is a reasonable caution, not a measured finding about factories.
Translating project phases into search and content decisions
This table maps each project phase to the kind of search it produces and the page that should answer it. The query types below are hypotheses to validate with real search results and your data.
| Project phase | Search to test | Page that serves it |
|---|---|---|
| Planning | Design-led: security requirements for industrial automation projects, secure architecture for connected factories | Guide for project and engineering teams, linked to advisory services |
| Vendor selection | Procurement-led: evaluating integrator security, OT vendor remote access risks | Independent proposal and vendor review service page |
| Before go-live | Verification: OT security assessment before commissioning, safe testing of industrial systems | Pre-commissioning assessment page with safety and timing explained |
A modernization project involves many people who never think of themselves as security buyers. The firms most likely to be found are those whose content meets each phase in the vocabulary of the people running it.
Limits of this analysis
The phase model is an analytical framework drawn from how industrial projects are typically run, not a measured study of when manufacturers engage security firms.
The attack statistic cited is general rather than specific to modernization projects.
Validate the phases that matter most by reviewing where recent industrial engagements started: during planning, at go-live, or after something had already changed.
Common questions
When during a modernization project do security questions come up?
At four distinct phases: planning, vendor selection, before go-live and after go-live.
Does the same person search for security help at every phase?
No, each phase involves a different buyer, from project engineers early on to procurement and operations leaders later.
How should content be organized around this?
Around each project phase and its vocabulary, so content meets the project team where they actually are rather than only at the generic category search.
Is one general OT security for manufacturers page enough to cover a modernization project?
Not really, since each phase produces a genuinely different kind of question, and a single generic page will not match all of them.
Building content that meets buyers at each stage of their project is core to SEO for IT and developer firms.
Kryston publications
Analysis for cybersecurity service firms on search, AI visibility and buyer trust.
