Newsletters
Risk Central
Digital EditionFortifying the Food Supply Chain: Cyber Risk Management in a Digitally Connected Era
From a technical IT concern to a top strategic risk for organizations across sectors, cybersecurity continues to evolve to meet the changing risk.
At RISKWORLD 2025, engaging session “Fortifying Food Manufacturing Cybersecurity With Technical Risk Assessments” helped participants understand why the food manufacturing sector has been increasingly targeted by bad actors and discussed ways the insurance industry can respond to improve cyber outcomes.
Historically, food manufacturers have focused on physical exposures given the risk of spoilage, but they now also face digital vulnerabilities that can slow or stop production, destroy inventory, and cause indirect losses throughout the complex supply chain. The session was presented by industry experts Sudhir Ethiraj, Global Head of Cybersecurity Office and CEO Business Unit of Cybersecurity Services at TÜV SÜD, and Chris Mandel, RIMS-CRMP, Assistant Professor, ERAU & President & Managing Consultant at ERM, LLC.
The Expanding Cyber Threat Impacting the Food Manufacturing Sector
In recent years, high-profile cyberattacks have disrupted the food manufacturing sector, leading to large losses as production lines were halted and inventory spoiled. Many industrial legacy systems were not designed with cybersecurity in mind, but now these systems are connected to bigger enterprise networks. This creates a vulnerability to ransomware and malware attacks. Some of these industrial systems are decades old and they lack basic encryption and access controls.
Cyber risk in the food manufacturing industry is no longer hypothetical. It is a real risk with widespread impacts and must be managed accordingly. Food manufacturers have become prime targets of cyberthreats in recent years for several reasons:
- Complex supply chains caused by the reliance of the industry on global suppliers mean a single weak link at one supplier can affect the entire value chain.
- Food production is a vital service, and disruptions can quickly cause panic and far-reaching consequences, which makes it a desirable target.
- When compared with sectors like finance or healthcare, food manufacturers are often in the early stages of cybersecurity maturation, making them more vulnerable to large-scale cyberattacks.
Insurers, brokers, and risk managers can utilize technical risk assessments as a foundational step in the cyber risk management process for food manufacturers. These risk assessments help manufacturers identify the most critical digital assets and their vulnerabilities and develop remediation plans based on this personalized assessment of the threat landscape. The components of a robust technical risk assessment include asset inventory, threat modeling, supply chain evaluation, and incident response planning.
Evolving from Cybersecurity to Cyber Resilience
While eliminating cyberthreats completely is an unrealistic goal, food manufacturers can achieve cyber resilience, which gives them the ability to anticipate, withstand, and recover from a cyberattack with minimal disruption. The panelists discussed three ways to mitigate cyber risks and their potential consequences. The first is ensuring strict compliance with sector-specific regulations. Next, food manufacturers should enhance their cyber resilience through third-party risk assessments. Finally, embed trust in digital technologies with core principles like “security by default”.
The cyber regulatory landscape continues to evolve alongside the risks and coverages. In Europe, the NIS-2 requires critical infrastructure sectors like food manufacturing to have robust cybersecurity practices. In the U.S., frameworks like that of the NIST provide best practices for insurers across sectors.
To better prepare and keep up with changing cyber risks, the panelists recommended that attendees prepare for a cyberattack by forming a team to respond immediately to issues; identify top risks and plan for extensive mitigation measures; and educate and involve the entire organization to attend trainings and participate in cross-company initiatives to improve cybersecurity.
Key Insights and Takeaways
Ending the session with insights and takeaways, the panelists recommended the following action items:
- Conduct comprehensive, end-to-end cyber risk assessments
- Tailor security assessments to the manufacturer’s unique cyber risk environment
- Prioritize remediation efforts based on a clear remediation plan
- Foster communication between operational and IT security teams
- Adopt and extend food safety and food defense culture and protocols
- Increase security vigilance and raise awareness of cyberattacks
Cyber insurance for food manufacturers has become a critical part of business continuity plans, helping organizations to manage this dynamic risk and ensure consumers remain safe. The cybersecurity challenges facing the industry, however, are complex and urgent. The interconnected operations, legacy systems, and essential role in our global society make food manufacturers vital and vulnerable at the same time. The best practices discussed in the session, like technical risk assessments and resilience planning, are critical steps as digital threats expand.
Leveraging insurance as a strategic partner and safety net, food manufacturers can fortify their cyber defenses while integrating better cyber risk management into their enterprise functions, keeping critical food supply operations running. &
