Manufacturing IT Growth and Cybersecurity Risk in the Inland Empire

Manufacturing IT cybersecurity in the Inland Empire is a growing problem because plants now run fewer workers and more connected machines. More paths in, fewer people watching. Manufacturing is the most attacked industry, and mid-size plants are the typical victim.

Inland Empire factories have fewer people on the payroll than they did three years ago. According to the Bureau of Labor Statistics, manufacturing jobs in the Riverside, San Bernardino, and Ontario metro area fell from about 100,000 in March 2023 to about 93,000 in August 2026. That's roughly 7,000 jobs gone.

The machines didn't leave. If anything, they got chattier. And that gap between what's connected and who's watching it is where the real risk sits, which is also why managed IT services in the Inland Empire look different for a plant in Ontario than for an office down the street.

So when people talk about manufacturing IT growth here, I'd push back a little on the word. Headcount isn't growing. Connections are.

What's actually growing in Inland Empire manufacturing?

The number of things on the network. A plant that cut a shift still runs the same CNC machines, but now the ERP (the system that handles orders, inventory, and billing) talks to the floor, the machine builder can log in remotely, and the quality data lives in a cloud app.

The Federal Reserve Bank of San Francisco describes the region as making everything from automotive to consumer products. That range matters. A food plant in Riverside, a metal fabricator in Fontana, and an aerospace subcontractor near March Air Reserve Base all have the same basic shape now. Office computers on one side, production equipment on the other, and more wires running between them every year.

Look at what a typical expansion adds. A second building in Rancho Cucamonga. A new packaging line that ships with its own industrial PC and a remote-support tool already installed by the vendor. A shop-floor tablet for every cell so operators can pull work instructions. Each one is reasonable. Together they double the number of doors into the business, and nobody wrote down where all of them are.

The ERP link is the one that changes the most. When the ERP pushes a work order straight to a machine, or the MES (manufacturing execution system, the software that tracks each job as it moves across the floor) pulls cycle counts back into the office, the old idea that the shop floor is its own island quietly stops being true, even though plenty of plant managers still describe it that way.

Fewer people, too. The maintenance lead who used to know every box on the floor may be one of the 7,000, and when that person leaves, the knowledge of which PC runs which press and which vendor has a password to what usually walks out the door too.

Why are mid-size Inland Empire plants the target?

Because that's where the money and the gaps overlap, and it's why cyber risk for manufacturing in the Inland Empire keeps climbing. Black Kite's 2026 manufacturing ransomware report puts the median victim at $42.9 million in annual revenue, and 70.2% of manufacturing victims earned between $10 million and $100 million.

Read that range again. It describes a lot of the plants between Corona and Redlands.

Big enough to pay. Small enough that security is one person's side job. Ransomware crews do the math the same way you would. They aren't hunting for your company by name. They're scanning for an unpatched VPN or a reused password, and whichever plant answers first gets the attention, whether it makes brake parts in Corona or tortillas in Riverside.

The volume isn't slowing down either. Black Kite counted 1,183 manufacturing ransomware victims in the first seven months of 2026, up 39.7% over the same stretch of 2025. Nearly half of those attacks, 49.7%, came from ransomware groups that didn't exist in 2023 or 2024. So the threat you read about last year may not be the one that shows up next quarter.

IBM sees the same picture from a different angle. Its X-Force Threat Intelligence Index 2026 named manufacturing the most attacked industry for the fifth year running, at 27.7% of incidents. North America accounted for 23% of those manufacturing incidents.

"We're too small to be a target" is the belief I'd retire first. The data says the opposite. You're the right size.

Where do attackers actually get into a plant network?

Through the doors you added for convenience. IBM found that exploiting public-facing applications started 32% of manufacturing breaches, valid stolen accounts 16%, and external remote services 11%. Those are the login pages, VPNs, and remote tools a growing plant keeps adding.

Sophos found something close. In its State of Ransomware in Manufacturing and Production 2025, a survey of 332 manufacturers hit by ransomware, exploited vulnerabilities were the top root cause at 32%. Malicious email came second at 23%.

On a real floor, those entry points tend to look like this, along with who owns them.

An HMI, by the way, is the touchscreen operators use to run a machine. CISA and its partner agencies have warned about exactly this setup. Their guidance on primary mitigations for operational technology tells owners to remove production systems from the public internet first and change default passwords. Operational technology, or OT, is the equipment that runs physical processes. Presses, ovens, conveyors, and the PLCs (small industrial computers) that control them.

None of that list needs a new product. It needs someone to look.

Who's watching when the night shift is two people?

Often no one. And attackers are patient. The Dragos 2026 OT Cybersecurity Year in Review found ransomware sat inside OT environments for an average of 42 days. Companies with full visibility into their OT networks found and contained it in about 5.

That's 42 days versus 5. Same attackers, same malware. The only difference is whether someone was looking.

Picture it on a real calendar. A phishing email lands on a buyer's laptop Friday afternoon. With a flat network and nobody watching, the attacker has the whole weekend to find the file server, the ERP database, and the engineering share holding every CNC program the shop has written in 10 years, and the first sign anyone sees is a ransom note on the HMI screens when first shift clocks in Monday.

Dragos tracked 119 ransomware groups hitting industrial organizations in 2025, up from 80 the year before, and manufacturing made up more than two-thirds of their victims. That's not a forecast. It already happened.

Think about who covers IT at a 120-person plant in Ontario on a Saturday night. Maybe the plant manager, who also handles safety, purchasing, and the forklift lease. Maybe an outside tech who answers email on Monday. Sophos found 42.5% of manufacturing ransomware victims named a lack of expertise as a factor, and 41.6% pointed to security gaps they didn't know they had.

That second number bothers me more. You can hire expertise. You can't fix a gap nobody has found.

Monitoring has a limit. It doesn't stop the first click. It shortens the time between that click and someone pulling the plug, which on a production floor is usually the difference between a bad Tuesday and a lost month.

What do defense suppliers near March ARB need to know right now?

That the rules still apply even though the headlines said "paused." The Department of War suspended CMMC Phase II on July 13, 2026, but NIST SP 800-171 (the federal security standard for that data), DFARS 7012 (the contract clause that requires reporting cyber incidents within 72 hours), and SPRS self-assessments all remain in force.

CMMC is the Cybersecurity Maturity Model Certification, the Defense Department's program for proving contractors protect sensitive government data. A lot of Inland Empire job shops machine, coat, or assemble parts for primes, and some of them handle CUI (controlled unclassified information, such as technical drawings with export or handling markings) without fully realizing it.

The drawings arrive by email, get saved to a shared folder, get printed for the floor, and sometimes get loaded onto a machine controller, and every one of those copies counts as a place the controlled data lives.

CSIS's analysis of the pause is plain about it. Contractors still have to protect controlled data and keep filing self-assessments. As of this writing, the CMMC Reform Task Force report hasn't been made public, so no new Phase II date exists.

What that means in practice for a shop in Riverside or Perris is unglamorous. Know where the controlled drawings live. Know who can open them. Make sure your SPRS score (the self-assessed number you report to the Defense Department) matches what's actually on your network.

Compliance work like this is its own engagement at Consilien, separate from managed IT. If you're in that spot, our breakdown of ITAR, CMMC, and NIST for manufacturers walks through which rule applies to what.

Being compliant still doesn't make you secure. Plenty of shops with a decent SPRS score run every CNC machine on the same network as the front office.

A fix order for a plant with no security team

Start with what you can see, then close the doors attackers use most. In order, that's an inventory, MFA and locked-down remote access, a separate network for production equipment, round-the-clock monitoring, and backups you've actually restored from.

1. Write down every connected thing. Every PC, PLC, HMI, camera, badge reader, and vendor tool on the floor. You'll find surprises. Everyone does. Expect at least one camera system nobody remembers buying, a line PC still running the installer's remote tool, and a Wi-Fi access point someone in maintenance plugged in so the tablets would work in the back corner.
2. Lock the front doors. MFA on email, VPN, ERP, and every remote login. Kill vendor remote tools that run 24/7 and replace them with one access path you control and can log.
3. Separate the floor from the office. This is network segmentation, and NIST wrote a practical guide to segmentation for small manufacturers that a plant can follow without an OT security team. A phishing email on a sales laptop shouldn't be able to reach a PLC.
4. Get someone watching around the clock. Endpoint detection (software that spots and stops attacks on each computer) on every PC that can run it, plus a person who actually responds at 2 a.m. Dragos' 42-versus-5 gap lives in this step. For a plant without its own security staff, that usually means a managed provider whose analysts see the alert, can isolate the infected laptop remotely, and know which machines on the floor must not be shut down without calling the plant manager first.
5. Prove the backups work. Keep one copy offline, and run a restore test on the ERP and the machine programs before you need them. Our page on manufacturing disaster recovery and business continuity covers how long a plant can realistically afford to be down.

The order matters more than the tools. A firewall upgrade bought before anyone counted the devices behind it protects an unknown number of things. Backwards.

Skip most of this if you already have an in-house security team with OT experience and someone on call every night. You'd get more from an outside assessment of what they've built than from adding another provider.

Where Consilien fits

Consilien runs managed cybersecurity services and cybersecurity for manufacturers, for manufacturers across the region, from Ontario to Fontana and Rancho Cucamonga. The work is the fix order above. Inventory, access lockdown, segmentation, 24/7 monitoring, and tested recovery, run by people who understand that the line can't go down for a patch at 10 a.m.

If you're pricing it, the Inland Empire managed IT cost breakdown shows how plant devices change the math. For background on how these attacks unfold, see why manufacturing companies get hit with ransomware. And our broader IT for manufacturing page covers the rest of the plant.

Not sure where your floor stands? Speak to a cybersecurity expert and walk through the five steps against your own network.