MFA Misconfiguration Is the Costliest Point of Failure in Manufacturing Cyber Claims
The manufacturing sector now holds the title of the world’s most targeted industry for cyberattacks for the fifth consecutive year, yet its cybersecurity posture remains dangerously mismatched with its exposure, according to a new report from cyber insurer Resilience.
Drawing on nearly five years of proprietary claims data spanning March 2021 through February 2026, the report found that ransomware accounts for 90% of total incurred losses in the manufacturing portfolio despite representing only about 12% of claim volume. The single most expensive ransomware event in the dataset — attributed to the BlackCat ransomware group — was directly enabled by misconfigured MFA, the report said.
Ransomware Dominates Loss Severity
The financial picture for manufacturers is defined by a sharp divide between the incidents that occur most often and those that cost the most. Transfer fraud and email compromise — both driven by phishing — together account for roughly 30% of all claims by volume, making them the most frequent incident types. But ransomware, though far less common, drives the overwhelming majority of financial loss, according to the report.
Financial volatility across the manufacturing portfolio is driven “almost entirely by the presence or absence of a material ransomware event in any given quarter,” the report said.
Between January and September 2025, global ransomware incidents rose by roughly 46% over the same period in 2024, with manufacturing experiencing a 61% year-over-year surge — the sharpest growth of any sector, according to KELA research cited in the report. The IBM X-Force Threat Intelligence Index found that the sector accounted for more than one in four of all cyberattacks in 2025.
Identifiable Control Failures Drive Losses
The claims data reveals that the most expensive losses stem from specific, identifiable control failures rather than novel or sophisticated attack techniques. MFA misconfiguration is the single most expensive point of failure, accounting for approximately 26% of all losses — significantly more than the 8% attributable to the complete absence of MFA, the report found. The finding underscores that “implementation quality matters as much as implementation itself,” the report said.
Software vulnerability exploits account for approximately 13% of total portfolio losses, concentrated in a small number of high-severity ransomware events attributed to Black Basta group and Cactus malware, according to the report. The connection between unpatched software and ransomware outcomes is particularly relevant for manufacturers operating legacy operational technology (OT) systems that often cannot be patched without production downtime.
The report recommends that organizations treat MFA validation as a continuous process, auditing existing deployments to ensure enforcement across all accounts, elimination of bypass conditions and proper configuration of conditional access policies. It also recommends implementing compensating controls such as network isolation and virtual patching where OT constraints prevent timely software updates.
Structural Vulnerabilities Compound the Risk
Several converging forces have made manufacturing an attractive target. The rapid adoption of Industry 4.0 technologies has dissolved the boundaries between IT and OT environments, creating vast new attack surfaces, the report said. A Fortinet report cited in the analysis revealed that nearly three in four organizations experienced an OT-impacting breach in 2024, up from roughly half the year before. The number of internet-exposed industrial control systems devices rose 40% between 2024 and 2025.
The COVID-19 pandemic accelerated this exposure, forcing manufacturers to deploy remote access to OT systems under emergency timelines with minimal security review. Manufacturing jumped from the eighth most targeted industry to second in a single year during that period, representing a 300% increase in attack volume, according to a 2021 Global Threat Intelligence Report cited in the analysis.
Despite being the most targeted sector, manufacturing and retail allocate the lowest percentage of IT budgets to security, the report said. The Resilience report noted that its claims data provides a direct feedback loop for underwriting, shifting the conversation from whether a manufacturer has MFA to whether that MFA is properly configured and enforced across all access points.
Obtain the full report here. &

