As manufacturing becomes increasingly digitised, the boundary between Information Technology (IT) and Operational Technology (OT) is rapidly disappearing. What was once a controlled and largely isolated environment is now connected, data-driven, and exposed to a growing range of cyber threats. From automated guided vehicles (AGVs) to robotic assembly lines, industrial assets are no longer just physical machines—they are networked systems that rely on real-time data exchange to function efficiently.

However, this transformation comes with risk. Cyber incidents affecting industrial systems can disrupt production, compromise safety, and propagate across supply chains. For organisationsoperating under strict uptime requirements, even minor disruptions can translate into significant operational and financial consequences.

The manufacturing sector—particularly in automotive and advanced production—relies heavily on interconnected digital systems such as Manufacturing Execution Systems (MES), warehouse management platforms, and robotics orchestration tools. These systems must communicate seamlessly to support real-time decision-making and flexible production.

At the same time, many industrial environments still depend on legacy equipment designed without cybersecurity in mind. These systems often use proprietary protocols and lack built-in security mechanisms, making them difficult to protect once connected to modern networks. The convergence of legacy OT systems with modern IT infrastructure introduces new vulnerabilities that traditional security tools are often not designed to address.

The rapid adoption of AGVs and Autonomous Mobile Robots (AMRs) further increases this complexity. These mobile systems rely on wireless communication, cloud integration, and sensor-driven decision-making. While they bring efficiency gains in logistics and production, they also expand the attack surface. Reported incidents in recent years highlight how disruptions to robotic fleets or industrial networks can halt operations across entire facilities, underlining the need for stronger cyber resilience in this sector.

The AutoDome use case addresses a central challenge in modern manufacturing: how to protect interconnected IT and OT environments without disrupting operations or exposing sensitive production systems to unnecessary risk during testing.

Manufacturers face several overlapping concerns:

• Detecting abnormal or malicious activity across heterogeneous systems
• Integrating cybersecurity tools with legacy and modern devices
• Maintaining operational continuity during monitoring and validation activities
• Ensuring that testing environments do not introduce security or confidentiality risks

In practice, validating new cybersecurity solutions directly in production environments is often not feasible. Operational downtime, safety restrictions, and confidentiality concerns limit the ability to simulate realistic attack scenarios. As a result, organisations struggle to verify whether new tools can effectively detect and respond to threats in complex, real-world industrial contexts.

To address these challenges, the AutoDome use case validates cybersecurity capabilities in a controlled yet realistic environment within the CyberSecDome validation framework. The validation is conducted in a dedicated manufacturing laboratory that replicates industrial processes, enabling safe experimentation without impacting live production systems.

The approach focuses on simulating IT-OT integration scenarios involving robotic systems, industrial communication protocols, and data-driven workflows. Within this environment, CyberSecDome is used to support monitoring, analysis and response assessment, helping to determine how anomalous behaviours can be effectively detected and how response decisions can be supported.

Rather than focusing on specific attack techniques, the validation emphasises operationally relevant scenarios such as abnormal traffic patterns, unexpected device behaviour, and potential unauthorised interactions between systems. These scenarios are representative of risks faced in real manufacturing contexts while remaining suitable for safe testing conditions.

The validation also evaluates key aspects such as interoperability between systems, usability for security professionals, and the ability to process large volumes of industrial data. A collaborative approach between technical partners ensures that the integration aligns with industrial constraints and existing workflows.

Importantly, the laboratory setting allows repeated testing cycles, enabling refinement of detection patterns and validation methods. This iterative approach helps generate structured feedback on how cybersecurity tools perform in complex industrial ecosystems, contributing to their improvement and scalability.

Several practical lessons from the AutoDome validation can inform cybersecurity practices in manufacturing and similar sectors:

1. Controlled environments enable realistic validation without operational risk. Testing cybersecurity solutions directly in production is often impractical. Dedicated environments that replicate industrial systems provide a safe way to evaluate detection and response capabilities under realistic conditions.
2. IT-OT visibility is essential but remains challenging. Gaining a unified view of both IT and OT activities is critical for detecting threats. However, differences in protocols, data formats, and system behaviour require tailored monitoring approaches that go beyond standard IT security tools.
3. Interoperability is as important as detection accuracy. Even effective detection tools can fall short if they do not integrate smoothly with existing systems. Ensuring compatibility across heterogeneous industrial environments is a key requirement for practical deployment.
4. Human factors influence cybersecurity effectiveness. Usability plays a significant role in how security solutions are adopted. Interfaces, workflows, and cognitive load affect how quickly and accurately security professionals can interpret alerts and respond to incidents.
5. Scalability requires modular and technology-agnostic approaches. Industrial environments vary widely across sites and sectors. Solutions that rely on modular architectures and standard protocols are more likely to scale across different use cases while maintaining consistent performance.

The validation of cybersecurity solutions in realistic industrial environments provides several tangible benefits. It improves understanding of how threats manifest in IT-OT systems and highlights practical challenges in monitoring and response.

For manufacturers, this translates into better preparedness, improved detection capabilities, and enhanced resilience against disruptions. The approach also supports compliance with evolving European cybersecurity requirements and contributes to safer, more reliable production environments.

At a broader level, the insights generated through the AutoDome use case help inform best practices and guidelines for deploying AI-driven monitoring tools in industrial contexts. This contributes to the adoption of trustworthy technologies that balance performance, safety, and ethical considerations.

As manufacturing systems become more interconnected and autonomous, cybersecurity can no longer be addressed solely at the IT level. Real resilience depends on understanding how threats affect integrated IT-OT environments and validating solutions under realistic conditions.

For security leaders and industrial operators, investing in practical validation—not just theoretical protection—will be key to ensuring that digital transformation does not come at the expense of operational stability.

This article is supported by the European Union funded project CyberSecDome under Grant Agreement No. 101120779. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union or European Commission. Neither the European Union nor the European Commission can be held responsible for them.