Most manufacturers still build the IT budget the way they build a maintenance budget: take last year’s number, add a few percent, and negotiate the exceptions. That approach made sense when IT meant an ERP system, email, and a file server. It breaks down when one compromised server can stop a production line, a supplier-portal outage can idle your shipping dock, and the CNC equipment on your floor runs an operating system older than some of your employees.

Instead of asking “what did we spend last year?” a customized IT strategy should start with answering “what does an hour of downtime cost us, and what protects us from it?” Here is how to build a strategy and budget that’s right for your company around those questions.

Why the Stakes Have Changed for Manufacturers

The threat data is hard to ignore. Arctic Wolf’s 2026 Threat Report found that manufacturing suffered 70% more successful ransomware attacks than the next-closest sector, construction, with the United States the most targeted country. Dragos recorded 1,140 ransomware incidents against industrial organizations worldwide in Q2 2026, up 12% from Q1, and North America was again the most targeted region. Dragos, an OT cybersecurity firm, also noted that many disruptions now come from limited encryption or precautionary shutdowns. In other words, you may halt your own production just to contain an attack.

The financial exposure is just as stark. IBM’s 2025 Cost of a Data Breach Report put the average U.S. breach cost at a record $10.22 million, and the 2025 Jaguar Land Rover attack shows how quickly a manufacturing incident spreads: production stopped for about five weeks, and the Cyber Monitoring Centre estimated a total cost of £1.9 billion, with around 5,000 businesses in the supply chain affected. JLR is a UK automaker, but the lesson applies to any U.S. manufacturer with tier-one customers or tier-two suppliers. Your IT problem becomes their production problem, and theirs becomes yours.

Start With Operations, Not Technology

Before you open a spreadsheet, build a criticality map with operations, finance, and plant leadership in the room. List every system and ask what stops and what it costs, if it is down for four hours, 24 hours, or five days. Assign each one a recovery time objective (how fast it must come back) and a recovery point objective (how much data you can afford to lose). Those two numbers should drive your backup, disaster recovery, and redundancy spend more than any vendor pitch.

Several impacts rarely come up in IT conversations but land hard on operations:

• Electronic Data Interchange (EDI) and customer penalties. If your EDI connection to a major customer goes dark, missed advance ship notices, and late deliveries can trigger chargebacks long before anyone labels it a cyber incident.
• Traceability and recalls. If you lose lot, serial, and batch records, you may be unable to scope a recall or satisfy an auditor, whatever your quality certifications say.
• OT and IT convergence. When plant-floor networks connect to the office network, a phishing email in accounting becomes a threat to PLCs and your MES. Segmentation is a budget line, not a nice-to-have.
• Legacy equipment. Machines running unsupported operating systems cannot be patched, so they need compensating controls. Windows 10 reached end of support in October 2025, so the refresh clock is already running on many shop-floor PCs.
• Key-person risk. If only one IT employee understands your network and ERP integrations, an employee resignation is also a risk event.
• Customer and insurer requirements. Cyber insurers and OEM customers increasingly ask for proof of controls, and defense suppliers face Cybersecurity Maturity Model Certification (CMMC) requirements that are phasing into contracts.

Build the Budget in Eight Categories

Organize spending so every line ties to a risk or a business outcome.

1. Hardware and infrastructure. Stagger lifecycle refreshes (servers and network gear commonly run three to five years) so you never face a single-year cliff. Budget for spares of plant-floor PCs and switches you cannot wait a week to source.
2. Software and licensing. Audit for shelfware, consolidate overlapping tools, and calendar every renewal. ERP, MES, and PLM upgrades deserve multi-year placeholders.
3. People. Compare the fully loaded cost of in-house security staff against the coverage you actually need. Most mid-size manufacturers cannot staff round-the-clock monitoring alone.
4. External expertise. Co-managed IT, a virtual CIO, and managed detection and response (MDR) fill gaps without full-time headcount. Define clearly who owns what.
5. Cybersecurity and resilience. Fund the core controls: multifactor authentication, endpoint detection, email security, patch and vulnerability management, and network segmentation. For resilience, add Backup as a Service (BaaS) with immutable copies and tested restores, and Disaster Recovery as a Service (DRaaS) sized to the recovery objectives you set earlier. If you build or run applications on Platform as a Service (PaaS), include its security configuration and monitoring. Ransomware bad actors go after backups first, so a backup you have never restored is an assumption, not a plan.
6. Processes. Fund an asset inventory, an incident response plan, change management, and vendor risk reviews. Run a tabletop exercise with your plant manager and supply chain lead, not just IT.
7. Training. Arctic Wolf’s report recommends recurring phishing and social-engineering training. Include shift supervisors and plant staff who share terminals, not only office employees.
8. Contingency. Hold a reserve for incidents, vendor end-of-life surprises, and emergency hardware. Many organizations use 10-15%; size yours to your downtime exposure.

The Budget Misstep to Avoid: AI Before Infrastructure

Budget pressure is pulling many organizations toward the shiny object. In a Morgan Stanley CIO survey, AI/ML was the top priority for 17.7% of respondents, well ahead of security at 10.7%, while hardware budgets were expected to grow just 1.5% compared with 4.1% for software. Prioritizing AI is reasonable. The problem is that AI tools sit on top of the same networks, identities, and data you may be under-funding.

IBM’s 2025 findings show the cost of getting the order wrong. Among organizations that reported breaches of AI models or applications, 97% lacked proper AI access controls. One in five organizations reported a breach tied to shadow AI, meaning employees using unsanctioned AI tools, which added about $670,000 to average breach costs. Only 37% had policies to manage or detect it. Picture an engineer pasting proprietary drawings, bills of materials, or customer pricing into a public chatbot, or a predictive-maintenance pilot connected to an unpatched historian on a flat network.

IBM also found that only 49% of breached organizations planned to increase security investment afterward. None of this is an argument against AI. In the same research, organizations that used AI and automation extensively in security operations saved an average of $1.9 million per breach. The point is sequence: foundation first, then AI with governance, access controls, and an approved-tools policy.

Five Best Practices for Your Annual Plan

1. Speak in downtime dollars. Calculate your own cost-per-hour of unplanned downtime, then show the CFO how each investment reduces that exposure.
2. Gate new initiatives behind a security baseline. No new AI pilot, IoT sensor rollout, or cloud migration goes live until identity, segmentation, and backup requirements are met.
3. Test, don’t assume. Restore from backup and run a tabletop exercise at least annually and include operations leaders.
4. Review quarterly. Threats, vendor end-of-life dates, and production plans change faster than an annual cycle. Keep the reserve flexible.
5. Get an independent assessment. An outside view finds the gaps internal teams are too close to see, and it gives the board and your insurer documented evidence.