Thales Report: AI and Cloud Risks for Manufacturing Sector
AI and Cloud Complexity Create New Risks for Manufacturers: Thales
Related Entities
Organizations
Products & Tech
Full Report
Executive Summary
The 2026 Thales Data Threat Report - Manufacturing Edition, paints a concerning picture of the security posture in the manufacturing sector. Based on a survey of 417 executives, the report finds that manufacturers are grappling with new threats from Artificial Intelligence (AI), with 61% already experiencing deepfake attacks. Simultaneously, the sector is struggling with fundamental cloud security practices. A significant majority of organizations lack complete visibility into where their data is stored, and the encryption of sensitive data in the cloud is dangerously low, creating a fertile ground for attackers targeting cloud infrastructure.
Threat Overview
The report highlights a dual threat facing manufacturers: emerging AI-driven attacks and persistent weaknesses in cloud security.
AI-Related Threats
- Top Concern: 67% of respondents identified the rapid pace of change in AI ecosystems as their primary AI-related security concern.
- Deepfake Attacks: 61% of manufacturers reported having already been targeted by deepfake attacks, which can be used for social engineering, fraud, or disinformation, often leading to reputational damage.
- Investment Driver: 83% of organizations have invested in new security tools specifically because of AI-related threats.
Cloud Security Gaps
- Primary Targets: Cloud storage (36%), SaaS applications (29%), and cloud management infrastructure (26%) are the top three targets for attackers.
- Credential Theft: 57% of manufacturers reported an increase in credential theft attacks against their cloud environments.
- Lack of Visibility: Only 31% of respondents claim to have complete knowledge of where all their data is stored.
- Poor Encryption: Of the sensitive data stored in the cloud, only 8% of organizations encrypt 75-100% of it, a rate nearly half the average of other industries.
Technical Analysis
The threats described in the report map to several common attack techniques.
MITRE ATT&CK Techniques
- T1078.004 - Valid Accounts: Cloud Accounts: The reported increase in credential theft directly relates to attackers compromising and using legitimate cloud account credentials to access resources.
- T1566 - Phishing: Deepfake attacks, especially voice-cloning for vishing, are a sophisticated form of social engineering often initiated via phishing to establish contact.
- T1530 - Data from Cloud Storage Object: With cloud storage being the top target and encryption rates being low, attackers can directly access and steal sensitive data from poorly secured cloud buckets or storage accounts.
Impact Assessment
The convergence of these threats creates significant risk for manufacturers:
- Intellectual Property Theft: Unencrypted sensitive data in the cloud, such as product designs, manufacturing processes, and R&D data, is a prime target for corporate espionage.
- Financial Fraud: AI-driven deepfakes can be used to impersonate executives and authorize fraudulent wire transfers.
- Reputational Damage: Successful deepfake campaigns or data breaches resulting from poor cloud security can severely damage a company's reputation with customers and partners.
- Supply Chain Disruption: A compromise of cloud-based management infrastructure could disrupt production schedules and supply chain logistics.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) were provided in the source articles.
Cyber Observables — Hunting Hints
To counter these threats, security teams in manufacturing should hunt for the following:
sts:AssumeRoleDetection & Response
- Detection: Implement a Cloud Security Posture Management (CSPM) tool to continuously scan cloud environments for misconfigurations, lack of encryption, and public exposure. Use a Cloud-Native Application Protection Platform (CNAPP) for a more integrated approach to cloud security. This aligns with D3FEND's
D3-SCA - System Configuration Analysis. - Response: Have a specific playbook for cloud incidents. This should include steps to quickly revoke compromised credentials, isolate affected cloud resources using security groups, and analyze cloud audit logs to determine the scope of the breach.
Mitigation
- Data Discovery and Classification: You cannot protect what you don't know you have. Deploy data discovery tools to find and classify sensitive data across all cloud environments. This is the first step toward applying proper security controls. This is a form of D3FEND's
D3-SFA - System File Analysis. - Encrypt Everything Sensitive: Adopt a policy of encrypting all sensitive data, both at rest and in transit. Use customer-managed encryption keys (CMEK) for the most sensitive data to retain full control.
- Strengthen Identity and Access Management (IAM): Enforce MFA on all cloud accounts. Apply the principle of least privilege to all IAM roles, granting only the minimum permissions necessary.
- AI-Specific Defenses: Train employees to be skeptical of unexpected requests, even if they appear to come from a trusted source. Implement multi-person approval processes for financial transactions to counter deepfake-driven fraud.
Timeline of Events
MITRE ATT&CK Mitigations
Encrypt Sensitive Information
Directly addresses the report's finding of low encryption rates for sensitive data in the cloud.
Multi-factor Authentication
Mitigates the risk of credential theft attacks against cloud environments, which 57% of manufacturers reported.
User Training
Essential for building resilience against AI-driven social engineering attacks like deepfakes.
D3FEND Defensive Countermeasures
The Thales report's finding that only 8% of manufacturers extensively encrypt their sensitive cloud data is a critical failure. Implementing File Encryption (or more broadly, data-at-rest encryption) is a fundamental control. For manufacturers, this means enabling default encryption on all cloud storage services (e.g., AWS S3, Azure Blob Storage). For highly sensitive intellectual property, such as CAD designs or chemical formulas, organizations should use client-side encryption or a Customer-Managed Encryption Key (CMEK) service from their cloud provider. This ensures that even if an attacker compromises the cloud platform or steals access credentials, the underlying data remains unreadable without the separate encryption key. This D3FEND technique changes a potential catastrophic data breach into a non-event, as the exfiltrated data is useless.
With 57% of manufacturers reporting an increase in cloud credential theft, enforcing Multi-factor Authentication is no longer optional. MFA should be mandated for all users accessing cloud resources, especially administrators and developers with privileged access to cloud management infrastructure and SaaS applications. In the manufacturing context, this applies to engineers accessing cloud-based SCADA management portals or supply chain managers using SaaS logistics platforms. Organizations should prioritize phishing-resistant MFA methods like FIDO2 security keys over less secure methods like SMS. This D3FEND technique provides a critical layer of defense that can stop an attacker even after they have successfully stolen a user's password, directly mitigating the most common vector for cloud account takeover.
To combat both sophisticated AI-driven social engineering and cloud account takeovers, User Behavior Analytics (UBA) is an essential detection capability. UBA platforms ingest logs from various sources (cloud, identity providers, endpoints) to build a baseline of normal behavior for each user. For a manufacturing firm, this could mean flagging when an engineer's account, which normally only accesses design files from the corporate network during business hours, suddenly starts downloading large quantities of data from a different country at 3 AM. This anomalous activity would trigger an alert. In the context of deepfake attacks, UBA can help by flagging the unusual follow-on actions after a social engineering attempt, such as a finance employee attempting to bypass a payment verification control they have never touched before. This provides a chance to detect and intervene in a complex attack chain.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.