Manufacturers have spent years improving their ability to detect cyber threats in operational technology. That investment matters, but it can create a dangerous illusion: that the decisive moment in an industrial cyber incident is the moment the threat is found. In a factory, detection is only the beginning. The harder question is whether production can be restored safely when the systems, people and vendors needed for recovery are themselves under pressure.

The distinction matters because operational technology is not ordinary IT. Restoring a business application may be primarily a data and service-availability problem. Restoring a production environment can involve programmable logic controllers, supervisory control systems, safety interlocks, recipes, machine states, quality controls, industrial networks and equipment that cannot simply be restarted in an arbitrary order. A technically successful restoration can still become an operational failure if it brings a process back in the wrong sequence, with the wrong configuration or before the physical environment is ready.

That is why manufacturers should begin measuring what I call recovery readiness: the organisation’s ability to restore dependable production, not merely recover digital assets. A backup proves that information exists somewhere. Recovery readiness proves that the plant knows what to restore first, who is authorised to make that decision, what dependencies must be available, how the restored system will be validated and when production is safe to resume.

This is becoming more important as factories connect more equipment, analytics platforms, cloud services and AI-enabled systems. Connectivity can improve visibility and productivity, but it also creates a more complicated recovery map. A production line may depend on systems owned by IT, OT, engineering, a machine vendor and an external integrator. Each team may understand its own component while no one owns the complete restoration sequence.

The first practical step is therefore to map production dependencies from the process outward rather than from the network inward. Instead of asking only which servers and devices are critical, manufacturers should ask which physical processes must return first to deliver the minimum safe level of production. They can then identify the controllers, networks, data, utilities, vendors, credentials and human approvals required to support those processes. This turns recovery planning into an operational model rather than an inventory exercise.

The second step is to assign recovery authority before an incident. Cybersecurity teams may identify the threat, but they should not be expected to decide alone when a production process is safe to restart. Operations may understand production priorities but may not know whether a restored system is trustworthy. Engineering may understand machine state while senior management is balancing safety, customer commitments and financial impact. The organisation needs predefined decision rights that bring these perspectives together without creating a committee that becomes a bottleneck during an emergency.

Control rooms and operations centres are especially important here. During a major disruption, their job is not simply to collect alerts. They must create a usable operational picture from incomplete and sometimes contradictory information. One system may report that communications are restored while another indicates that a production cell remains isolated. A vendor may recommend reconnecting equipment while the security team is still investigating persistence. Operators need a disciplined way to distinguish what is known, what is assumed and what still requires verification.

The third step is to exercise degraded recovery, not perfect recovery. Many exercises begin with assumptions that make restoration easier than a real incident: key specialists are available, documentation is current, remote vendor access works, replacement hardware arrives, backups are clean and communications remain reliable. A stronger exercise deliberately removes some of those assumptions. What happens if the automation engineer cannot reach the plant? If the cloud dashboard is unavailable? If the most recent backup is questionable? If the machine builder is in another time zone? If one production line must remain offline so another can restart safely?

These scenarios reveal a different category of single point of failure: the decision dependency. A manufacturer may have redundant servers and network paths but still depend on one person who knows the correct restoration sequence, one vendor account that can access a controller, or one executive who can authorise an emergency operating mode. Resilience improves when these decision dependencies are identified with the same seriousness as technical dependencies.

AI will add another layer. Manufacturers are increasingly exploring AI for monitoring, predictive maintenance, quality control and operational decision support. During recovery, such tools may help teams correlate large volumes of information and identify anomalies faster. But speed should not be confused with certainty. If the data feeding an AI system is incomplete after an incident, its recommendation may be precise in presentation while weak in foundation. Recovery procedures therefore need explicit human verification points for decisions that affect safety, equipment integrity or the restart of critical production.

The final challenge is knowing when recovery is actually complete. Cyber teams may define completion as eradication of the threat. IT may define it as restoration of services. Operations may define it as machines running again. Management may focus on output. A resilient manufacturer needs a shared definition that includes cybersecurity, process safety, product quality, equipment condition and the stability of production over time. Restarting is an event; recovery is a period of controlled return to dependable operation.

Manufacturing resilience is often discussed in terms of redundancy, backups and rapid response. Those remain essential, but they are not enough. The factory that performs best after a serious cyber disruption will not necessarily be the one with the most technology. It will be the one that has already answered the operational questions that technology cannot answer by itself: what must return first, who decides, what evidence is sufficient, what can operate in degraded mode and what conditions must be met before the next system is reconnected.

The goal is not simply to make a factory difficult to attack. It is to make the organisation difficult to paralyse. That requires treating recovery as a production capability—designed, staffed, exercised and measured before the incident begins.

Abdulla Saeed Alhebsi (A.S. Alhebsi) is an author and researcher specializing in security, heritage, risk management, and control room operations. His work examines operational resilience, security governance, leadership, crisis management, and the human decision layer in complex systems.