Cybersecurity for machinery and off-highway
Telematics gateways, remote diagnostics, over-the-air updates, connected controllers and increasingly autonomous functions in construction, agricultural and industrial machines.
Connected machines, long service lives, many hands in the field.
Construction, agricultural and industrial machines now carry telematics gateways, remote diagnostics and software updates over the air. Dealers, service partners and fleet platforms connect to them, often for twenty years or more after delivery.
Each of these connections is useful for the customer and a possible way in for an attacker. The factories that build the machines are a target in their own right: an outage stops production and deliveries. With the EU Cyber Resilience Act and the new Machinery Regulation, security is now part of the product requirements.
Who it is for
- Manufacturers of construction, agricultural and mining machines
- Makers of industrial machines and production equipment
- Suppliers of controllers, telematics units, displays and machine electronics
- Dealers and service networks with remote access to machines
Where machines are exposed today
The attack paths we see most often in machinery and off-highway, from the field to the factory.
Connectivity
Telematics gateways
Cellular modules link the machine to fleet portals. Weak authentication or open services let attackers reach the machine network from the internet.
Cloud
Fleet and dealer platforms
One portal manages thousands of machines. A flaw in the platform or a stolen account affects every connected customer at once.
Service
Remote diagnostics and service tools
Laptops and apps of service partners have deep access to controllers. Lost devices and shared passwords are common entry points.
Updates
Software updates
Unsigned or poorly protected updates can put modified software on controllers, over the air or in the workshop.
Machine network
CAN and ISOBUS
Controllers trust each other on the internal bus. Once an attacker reaches it, machine functions and attached implements can be influenced.
Production
Factory IT and OT
Ransomware in the office network spreads to production planning and machine control. Assembly lines stop and deliveries slip.
Supply chain
Third-party software and suppliers
Controllers, displays and gateways come with operating systems and libraries from many vendors. One known vulnerability can sit in thousands of machines.
Automation
Positioning and sensors
Automated steering and autonomous functions rely on satellite positioning and sensors. Jamming or spoofed signals can mislead the machine.
When it went wrong
Three documented cases from machinery manufacturers. They show that an attack rarely stays in IT: it stops production, reaches customers, or exposes the platforms that manage machines in the field.
May 2022, ransomware
AGCO: tractor production stops in planting season
The agricultural machinery group behind brands such as Fendt and Massey Ferguson was hit by ransomware on 5 May 2022. Several production sites were affected during the busiest season for farm equipment.
Impact
At the tractor plant in Beauvais, France, production stood still for three days and about 1,000 employees were sent home. Some dealers could not order spare parts online, and the company later reported data loss.
Sources: AGCO statements, May 2022; Reuters; Réussir Machinisme
November 2018, ransomware
KraussMaffei: production throttled for two weeks
The Munich maker of plastics and rubber machinery was hit by ransomware in the night of 21 November 2018. Many computers were encrypted, servers were taken offline as a precaution, and the attackers demanded a ransom.
Impact
Several sites, including Munich, produced at reduced capacity for around two weeks. Email and landline phones were down, so customers had to reach staff on their mobile phones.
Sources: dpa, December 2018; Plasteurope; European Rubber Journal
August 2021, platform vulnerabilities
John Deere: researchers expose flaws in the connected platform
At DEF CON 2021, security researchers presented vulnerabilities in John Deere's web and cloud systems, including a flaw in third-party CRM software (CVE-2021-27653). They said the issues gave them far-reaching access to the Operations Center, the platform used to monitor and manage farm equipment.
Outcome
John Deere fixed the reported issues and stated that no customer accounts or data had been accessed and that machines in use were not affected. The case shows how much depends on the platforms that connect machines in the field.
Sources: DEF CON 2021 talk; The Security Ledger; ISMG
What a working machinery security approach looks like
Six building blocks that let you meet the Machinery Regulation and the CRA without slowing down development.
1
Risk assessment per machine family
A threat analysis for each machine family that covers connectivity, safety functions and the service process.
2
Security requirements in the specification
Clear requirements for controllers, telematics and suppliers, traceable from the risk analysis to the test.
3
Secure updates and configuration
Signed software, protected update paths and a defined process for the workshop and over the air.
4
Protected service access
Individual accounts, strong authentication and logging for dealers and service partners.
5
Vulnerability handling for the whole service life
Monitoring of components, a reporting process and updates for as long as machines are in the field.
6
Resilient production
Separated factory networks and a tested recovery plan, so one infected computer cannot stop the line.
How we help
From the first applicability check to tested machines and a running vulnerability process.
Regulatory readiness
Clarity on which rules apply to your machines and what to do first.
What we do
- Applicability check for the CRA, the Machinery Regulation and the Radio Equipment Directive
- Gap analysis against the essential requirements
- Prioritised roadmap with effort estimates
You receive
Applicability report, gap list, roadmap
Product security engineering
Security designed into your machines and controllers.
What we do
- Threat analysis and risk assessment per machine family
- Security concept and requirements for in-house and supplier components
- Review of telematics, update and service architecture
You receive
Threat analysis, security concept, requirement set
Testing and vulnerability handling
Proof that the protection works, and a process for what comes after release.
What we do
- Penetration tests of telematics units, controllers and portals
- Vulnerability monitoring and a product security incident response process
- Preparation for the CRA reporting obligations
You receive
Test report, response process, reporting playbook
OT and plant security
Production that keeps running when IT is attacked.
What we do
- Assessment of factory networks against IEC 62443
- Zoning, remote access and backup concept
- Incident and recovery exercises
You receive
Zone model, measure plan, recovery plan
How we work
Step 1
Scope
We agree on the machine families, sites and rules in scope.
Step 2
Assess
Workshops and a document review show where you stand today.
Step 3
Build
We create the work products with your engineers, or generate them with AITIGRITY.
Step 4
Prove
Tests, reviews and audit preparation close the gaps that matter.
Standards and regulations
Machinery Regulation (EU) 2023/1230
Replaces the Machinery Directive from 20 January 2027. Machines must be protected against corruption, including through connected devices and remote access, and safety-related control systems must keep working as intended.
Cyber Resilience Act (EU) 2024/2847
Covers products with digital elements such as controllers, telematics units and machine software. Reporting obligations apply since 11 September 2026, the full requirements from 11 December 2027.
Radio Equipment Directive, delegated act (EU) 2022/30
Since 1 August 2025, radio equipment such as telematics units with cellular or Wi-Fi connections has to meet cybersecurity requirements, supported by the EN 18031 standards.
IEC 62443
The reference for industrial automation: secure development (62443-4-1), component requirements (62443-4-2) and system security (62443-3-3).
ISO 25119 and ISO 13849
Functional safety for agricultural machinery and for safety-related control systems. Security measures are aligned with them so that protection never weakens safety.
ISO/SAE 21434
Used by many off-highway manufacturers and suppliers as the method for threat analysis of vehicle-like machines.
Related services and modules
The consulting services and AITIGRITY modules machinery manufacturers use most often.
Not sure where to start?
A short scoping call shows which rules apply to your machines and which steps come first.
Talk to an expertFrequently asked questions
Does the CRA apply to our machines?
If a machine contains software or connects to other devices or networks, it is usually a product with digital elements under the CRA. Many machines also fall under the Machinery Regulation, and both apply side by side. We check this per product family.
What does the Machinery Regulation require on cybersecurity?
Connecting a device or a remote service to the machine must not lead to a hazardous situation. Software and data that are critical for safety must be protected against corruption, and interventions in that software must be traceable.
We already work with ISO/SAE 21434. Is that enough?
It is a strong basis for the product side. For the CRA you also need vulnerability handling over the support period, reporting processes and specific technical documentation. We map what you have to what is still missing.
Can you support our suppliers as well?
Yes. We define security requirements for supplier components and review the evidence they deliver, so the complete machine meets the requirements.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.