The food manufacturing industry isn’t typically the first sector that comes to mind when discussing cybersecurity—but that’s changing fast.
At RISKWORLD 2025, risk professionals gathered to hear an urgent message from two industry experts: Sudhir Ethiraj, Global Head of TÜV SÜD’s Cybersecurity Office and CEO of its Cybersecurity Services Business Unit, and Chris Mandel, President of Excellence in Risk Management LLC.
In the picture: Sudhir Ethiraj (right), Global Head of TÜV SÜD’s Cybersecurity Office and CEO of its Cybersecurity Services Business Unit, and Chris Mandel (left), President of Excellence in Risk Management LLC
Their session—“Fortifying Food Manufacturing Cybersecurity with Technical Risk Assessments”—unpacked the risks threatening the global food supply and offered concrete steps for improving resilience through better assessments, OT/IT convergence strategies, and stronger organizational awareness.
The food and beverage industry is increasingly in the crosshairs of cybercriminals—and not without reason. Aging infrastructure, weak cyber maturity, and critical supply chains make the sector a high-value target.
The session referenced a real-world case: the NotPetya malware attack on a multinational food company that shut down operations and racked up $100 million in damages. It's a wake-up call for organizations to reassess their exposure—especially across interconnected devices and supply chains.
“The food and beverage industry is now a hotbed for threat actors, with the convergence of legacy systems with modern automation, and a number of high-profile cyberattacks,” said Ethiraj.
In manufacturing, operational technology (OT) controls physical systems like production lines, while information technology (IT) manages data and networks. As companies digitize, these systems are merging—and with that convergence comes risk. Risk managers must collaborate across departments to address any gaps between them. It’s no longer enough to have siloed IT security practices. OT and IT teams must work together to develop shared protocols, threat models, and incident response plans.
“We’ve seen a rapid blending of OT and IT and that’s created new cyber risk blind spots,” said Mandel. “The devices that run your plant floor are now connected to the same network that handles your email and attackers only need to find one way in.”
To identify vulnerabilities across OT and IT environments, technical risk assessments are essential—and regulators increasingly expect them. Ethiraj emphasized the need for depth and frequency:
“A one-time risk assessment is not sufficient. These assessments need to be continuous, robust, and tailored to each site’s specific threat landscape.”
The speakers urged companies to adopt global frameworks like NIST 2.0 and IEC 62443 while also factoring in sector-specific compliance, such as food safety and GDPR. Independent third-party assessments offer greater objectivity and credibility—especially when preparing insurance submissions or audit reports.
Even the best security tools can’t protect an organization if its people aren’t on board. From HR to logistics, employees need training that’s relevant to their role. This includes recognizing phishing attempts, securely handling data, and participating in coordinated response exercises. Building a culture of vigilance starts at the top—and must be reinforced continually.
“Your cybersecurity posture is only as strong as your least trained employee,” said Mandel. “Emphasize education and drills—not just for the cyber team, but across every business unit.”
Beyond compliance or insurance benefits, cybersecurity maturity is fast becoming a strategic differentiator. Companies with a strong security posture can recover faster, serve customers more reliably, and earn the trust of partners and regulators.
As Ethiraj put it:
“Cyber resilience is not just about protection—it’s about continuity. If you want to stay in business after an attack, you need a plan that includes recovery, communication, and trust rebuilding.”
In a world where attacks are inevitable, resilience is the new gold standard. Risk managers who embed resilience into their operations will be better positioned to support business continuity and long-term growth.
Cybersecurity in food manufacturing isn’t just about data breaches—it’s about physical safety, regulatory risk, and operational uptime. As this RISKWORLD session made clear, technical risk assessments aren’t just advisable—they’re essential.
Want to dive deeper? Read this article in Risk & Insurance for additional context on the RISKWORLD session.
Ready to assess your own risk posture? Book a consultation with TÜV SÜD and take a proactive step toward stronger cyber resilience.
Site Selector
Global
Americas
Asia
Europe
Middle East and Africa
