Picture this: a production line in Nagpur. Machines humming, shifts running on time, orders going out. Somewhere in that network, quietly, for the past 42 days, a ransomware group has been watching — mapping your systems, waiting for the right moment. Then one morning, the machines stop. This isn't fiction.
Picture this: a production line in Nagpur. Machines humming. Shifts are running on time. Orders going out. Somewhere in that network, quietly, for the past 42 days, a ransomware group has been watching. Mapping your systems. Waiting for the right moment. Then one morning, the machines stop.
This isn't fiction. This is the average dwell time for ransomware inside Operational Technology (OT) environments in 2025 — 42 days before detection, according to Dragos' 2025 OT Cybersecurity Report. Forty-two days of invisible access. And most manufacturers never knew anyone was there.
India Is Now APAC's Ransomware Epicentre
India has become the Asia-Pacific region's ransomware epicentre in 2025, with 65% of hit companies paying the ransom, making Indian manufacturers among the most lucrative targets on the planet. The incidents aren't hypothetical: Raymond Limited faced an IT disruption caused by ransomware in early 2025; Deck India Engineering Pvt. Ltd. was targeted by Tengu ransomware, exposing sensitive operational data; and in 2020, a malware attack affecting Mumbai's power grid caused widespread outages. These aren't isolated incidents. They're a pattern — and the pattern is accelerating.
The Numbers Behind the Crisis
Ransomware groups targeting industrial organisations increased 64% year-on-year in 2025. Dragos tracked 119 active groups targeting OT, up from 80 in 2024, collectively hitting 3,300 industrial organisations. ICS vulnerability disclosures reached 2,451 in 2025, almost double the 1,690 seen in 2024, spanning 152 vendors. Manufacturing accounted for more than two-thirds of all OT ransomware victims in 2025. The industrial sector saw the sharpest increase in data breach costs of any sector in 2024, rising by $830,000 per incident. And yet only 19% of organisations felt completely prepared to handle OT security issues during the same period.
Why OT Security Is Fundamentally Different — And Why IT Solutions Alone Won't Save You
Many businesses assume their existing IT security stack — their firewall, their endpoint protection, their SIEM — covers their shop floor too. It doesn't. OT environments have unique characteristics.
Legacy systems that were never built for connectivity. PLCs, SCADA systems, and industrial controllers were often designed decades ago, before anyone imagined they'd be connected to the internet. They can't run antivirus. They can't be patched without halting production. They are, by design, sitting ducks.
The IT-OT convergence gap. India's rapid push toward Industry 4.0 and Make in India has connected factory floors to enterprise networks faster than security frameworks can adapt. The result: flat, unsegmented networks where a breach in IT becomes a breach in OT.
Physical consequences. Unlike a data breach that compromises files, an OT attack can physically stop machinery, damage equipment, disrupt supply chains, and — in critical infrastructure — risk human safety. The AIIMS Delhi ransomware incident didn't just lock down computers; it disrupted health services and affected medical supply chains for months.
Compliance is now mandatory, not optional. CERT-In's 2025 guidelines mandate that OT/ICS environments are explicitly covered in audits. Cyber incidents affecting OT must be reported within 6 hours. Annual audits are required. The regulatory clock is ticking — and most manufacturers aren't ready.
The Gap Is Glaring
60% of Indian manufacturers use IIoT devices, but only 25% have robust OT security controls. 70% of Indian industrial firms lack adequate OT security altogether. The India OT security market is growing rapidly — yet investment continues to trail the threat curve. This is a gap that attackers are actively and ruthlessly exploiting.
What Proper IT-OT Security Looks Like in Practice
At CoreGenix, we work across both the IT and OT security landscape because threats don't respect the boundary between your server room and your shop floor. A comprehensive approach covers network segmentation and micro-segmentation, so your OT network never shares a flat network with corporate IT; asset visibility, a complete inventory of every OT device from sensors to controllers; OT-specific threat monitoring that understands Modbus, OPC, DNP3, and IEC 104; incident response planning for OT that accounts for the operational cost of taking systems offline; VAPT for industrial environments; and CERT-In compliance and audit readiness.
The Make in India Opportunity, Secured or Squandered?
India's manufacturing economy is targeting $1 trillion by 2030. Smart factories, 5G-connected production, IIoT sensors, and Industry 4.0 automation are the engines of that ambition. But every new connection is a new attack surface. The businesses that will lead India's manufacturing renaissance won't just be the ones with the most advanced machines. They'll be the ones who protected those machines while everyone else assumed it couldn't happen to them.
The question isn't whether your OT environment is a target. It already is. The question is whether you're protected when the attack arrives.
With 22+ years of experience in IT infrastructure and cybersecurity across Indian enterprises, CoreGenix offers end-to-end IT and OT security solutions — from initial assessments and network segmentation to continuous managed monitoring and CERT-In compliance support. Because the factory floor and the server room share the same threat landscape. It's time your security strategy did too.