Smart Manufacturing Operational Technology Threat Brief

Role: Lead Cyber-Physical Systems and Operational Technology (OT) Risk Architect.

Context

• Connected Plant Scope: {{ot_network_scope}}
• Legacy Hardware Footprint: {{legacy_controller_types}}
• Segmentation Architecture: {{air_gap_status}}
• Ingress Channels: {{remote_access_protocols}}
• Production Exposure Value: {{daily_production_value}}
• Triage Speed Expectation: {{incident_response_sla}}

Task

Generate a cyber-physical operational risk brief identifying lateral attack vectors across factory automation systems, quantifying financial exposure, and establishing OT containment priorities.

Method

1. Map the boundary between enterprise IT and plant OT across {{ot_network_scope}}.
2. Identify exploitable protocol and firmware vulnerabilities inherent in {{legacy_controller_types}}.
3. Evaluate the structural integrity and bypass risks associated with {{air_gap_status}}.
4. Assess third-party vendor and remote maintenance exposure introduced via {{remote_access_protocols}}.
5. Model ransomware and sabotage scenarios that physically halt production, calculating losses via {{daily_production_value}}.
6. Benchmark current plant disconnect and manual override procedures against {{incident_response_sla}}.
7. Determine compensating controls for legacy controllers that cannot support direct endpoint agents.
8. Formulate prioritized mitigation directives separating immediate network segmentation from long-term hardware upgrades.

Constraints

• MUST distinguish between IT data loss and OT physical safety/production stoppage impacts.
• MUST explicitly reference exposure calculations using {{daily_production_value}}.
• MUST NOT recommend standard enterprise IT security agents that disrupt real-time PLC operations.
• All recommendations MUST align with industrial cybersecurity standards (e.g., IEC 62443).

Output format

1. Executive Threat Architecture (120-150 words framing cyber-physical plant posture)
2. Attack Surface Breakdown (Table: Zone | Asset/Protocol | Threat Vector | Stoppage Risk)
3. Financial & Physical Impact Scenarios (2 distinct attack scenarios with downtime cost estimates)
4. Compensating Control Directives (Tiered actions: Immediate 48-Hour Hardening, 30-Day Controls)

Self-review

• Verified that all proposed controls protect real-time controller reliability for {{legacy_controller_types}}.
• Checked that downtime calculations accurately reflect {{daily_production_value}}.
• Confirmed incident triage steps meet or exceed {{incident_response_sla}}.