Manufacturing is 2026's top target. You don't need a SOC to start.

F6's telemetry makes manufacturing the number one target for cyberattacks in 2026, and the staffing picture explains why defenders keep losing. Roughly 80% of industrial organizations report a shortage of qualified security personnel. Filling a single vacancy can take months. Building a 24/7 security team from scratch takes 12 to 18 months.

That timeline matters because the adversary's timeline is now: a quarter, at most, between a disclosed flaw and it being weaponized. A plant cannot staff its way to safety within an attacker's planning cycle, so the security model has to be built to survive with the team it has.

F6's assessment framework betrays what actually matters: not more analysts, but fewer interfaces. Raw events from endpoints, networks, email gateways, and clouds should land in a single place, and a specialist should be able to reconstruct an intrusion chain in five minutes without switching consoles.

The report also flags the contractor problem — the main route into industrial networks is a compromised service engineer with legitimate remote access whose sessions are trusted by default. Track contractor access as its own activity class, the report says, with independent detection at each step of the chain. Relying on the partner to notice the compromise first is a losing strategy.

The same three fundamentals keep surfacing: know what is on the OT network, control who can reach it remotely, and make sure a change can be rolled back. On top of that, decide how the events that do exist are triaged — the metric is not alert volume but the percentage of confirmed cases needing a human.

Begin where the exposure is highest: the IT/OT boundary, the vendor access paths, and the discovery pass that surfaces everything nobody documented in the last five years. Those projects do not need a department. They need a calendar window the plant actually respects.