What a ransomware morning actually looks like in a food plant

The call comes before the alert

In every one of the three incidents we worked on last year, somebody on the floor
knew something was wrong before the security tooling said so. A line stopped. A
label printer produced nothing. A shift supervisor rang IT.

What the first ninety minutes decide

• Whether you can still ship. Production and IT rarely share a view of which

systems the line genuinely depends on.

• Whether you still have records. Temperature logs and batch records are a

food-safety control, not just data.

• Who is allowed to say "stop". This is a question to settle in advance.

The three things worth rehearsing

1. Isolating a plant network without stopping refrigeration.
2. Producing a batch record by hand for one shift.
3. Reaching your two most important suppliers when email is down.

None of these is a technology problem, which is why none of them gets solved by
buying anything.