Manufacturing remains one of the sectors most heavily targeted by ransomware operators, with new research from Rapid7 revealing that manufacturers accounted for 16.1% of tracked ransomware activity in Q3 2026, second only to business services.

Rapid7’s latest Quarterly Threat Landscape Report highlights the growing cybersecurity risks facing manufacturers, as cybercriminals increasingly exploit software vulnerabilities that can expose critical production systems, operational networks and interconnected supply chains to disruption.

A shrinking window to respond

The report found that attackers are exploiting high-severity vulnerabilities within an average of just three days of disclosure, leaving organisations with significantly less time to identify and address security weaknesses.

Other key findings from the report include:

  • 133% increase in high-severity vulnerabilities year-on-year.
  • 86% increase in vulnerabilities with publicly available proof-of-concept exploits.
  • 71% of tracked vulnerability exploitation occurred within seven days of disclosure, rising to 90% within 30 days.
  • 79% of exploited high-severity vulnerabilities required no authentication or user interaction, making them particularly attractive targets for cybercriminals.
  • Authentication bypass vulnerabilities recorded the highest exploitation rate at 1.57%, compared with 0.62% for remote code execution vulnerabilities.

The findings highlight how quickly known vulnerabilities can become active threats, placing additional pressure on manufacturers to identify and address security risks before they can be exploited.

What this means for manufacturers

For manufacturing businesses, a successful cyberattack can put production operations, connected systems and supply chain continuity at risk.

Rapid7’s research suggests organisations need to move beyond reactive patching and prioritise vulnerabilities according to their real-world exploitability, exposure and potential business impact, rather than relying solely on traditional patching schedules.

The report also found that human operators remain the primary drivers of modern cyber threats, with artificial intelligence cited as an operational component in just 8% of tracked incidents. However, the rapid exploitation of vulnerabilities reinforces the need for manufacturers to maintain strong cybersecurity practices and respond quickly to emerging risks.

As manufacturing operations become increasingly connected, identifying exposed assets, assessing vulnerabilities and prioritising remediation will be important steps in protecting business continuity and operational resilience.

Read more: Rapid7’s Q3 2026 Quarterly Threat Landscape Report is available here.

Source: Rapid7, Q3 2026 Quarterly Threat Landscape Report.