Top 8 IT Mistakes That Stop Production for Small Manufacturers (2026)

By Adam Crossley, CEO and co-owner, Fairoaks IT

Introduction

One bad Monday, the line stops or the trucks wait at the dock. IBM's X-Force Threat Intelligence Index 2026 found manufacturing was the most attacked industry for the fifth year in a row, at 27.7% of incidents. This list covers eight mistakes that can stop your production or your shipping, and what to do about each one. One disclosure before we start: Fairoaks IT resells Microsoft licensing, and some items below mention Microsoft products.

The short version

The eight mistakes come down to three gaps: things connected that shouldn't be, things nobody has tested, and things only one person knows. Every one of them is a yes-or-no question you can answer this week. Fix the ones that can stop shipping first, then schedule the bigger projects around your slow season.

How we chose

A mistake made this list only if it passed four tests:

• It can stop the line or the trucks. Not just "it's risky." If it fails, production, picking or shipping stops.
• It's an owner-level decision. Fixing it takes a decision and a modest project, not an enterprise budget or a security team.
• You can check it this week. The owner or operations manager can answer yes or no without hiring a consultant.
• It fits a small manufacturer. It applies to a shop with one IT person or an outside IT company, not just a large plant with its own security staff.

We left out mistakes that cost money without stopping work, like paying a fake supplier invoice. Those deserve their own article.

The 8 mistakes

1. Production machines on the same network as office computers

• The tip: Keep CNC machines, PLCs and other production equipment on their own network, separate from office PCs and email.
• Who it helps: Any shop with networked equipment, especially machines running older software that can't be updated.
• What to do: Ask whoever runs your network to put production equipment on its own separate network segment behind a firewall. Allow only the connections each machine actually needs, like getting programs from engineering. Turn vendor remote access on when they need it and off when they don't.
• A typical situation: Someone in the office opens a bad attachment, and on a flat network whatever it unleashes can reach the machines too. Or a change made for the office knocks the CNCs offline on Monday morning.
• When it doesn't apply: Your machines aren't networked at all, and programs are loaded by hand at the control.

2. Backups nobody has test-restored

• The tip: A backup you've never restored is a hope, not a backup. Keep at least one copy where ransomware can't reach it.
• Who it helps: Any company whose ERP or file server holds the orders, schedules and drawings the plant runs on.
• What to do: Ask for a full test restore of your ERP and time how long it takes. Keep one copy separate from the server, offline or in a form that can't be changed or deleted. Back up machine programs and controller settings too, not just office files.
• A typical situation: The server fails. The backup report has said "success" every night for a year. Then the restore fails, or takes far longer than anyone planned for.
• When it doesn't apply: Your ERP is fully hosted by the software vendor. The server side is then theirs, so ask what their backup and restore terms are. Your file shares and machine programs are still yours to protect.

3. Running the ERP on a server that's out of support

• The tip: Know the support end date for the operating system under your ERP, and replace it before that date passes. In IBM's report, exploiting public-facing applications was the most common way attackers got into manufacturers, at 32% of incidents. Software that no longer gets security fixes is easier to exploit.
• Who it helps: Shops running Epicor, JobBOSS, Global Shop Solutions or a similar ERP on a server in their own building.
• What to do: Find out which version of Windows Server your ERP runs on and when its support ends. Microsoft has announced that extended support for Windows Server 2016 ends on January 12, 2027. Confirm your backups can restore the ERP first, then plan the move around your slow season instead of waiting for the server to fail.
• A typical situation: The ERP runs on a Windows Server 2016 machine in a closet. Everything works, so nobody wants to touch it.
• When it doesn't apply: Your ERP runs in the cloud or is hosted by the vendor, or your server already runs a current, supported version.

4. No multi-factor authentication on email and remote access

• The tip: Turn on multi-factor authentication (MFA), a second check like an approval on your phone, for every mailbox and every way into your network from outside. Start with the owner's account.
• Who it helps: Owners, office staff, anyone who works remotely, and equipment vendors who connect in.
• What to do: Turn on MFA in Microsoft 365 or Google Workspace for every account, with no exception for the boss. Require it on your VPN or remote desktop, and on vendor accounts. Where you can, use an authenticator app or a security key instead of text messages. If you want help, our managed security services cover this.
• A typical situation: The owner reused a password on a website that got breached. Someone uses it to log in to the company's remote access from another country, and by morning nobody can open the ERP.
• When it doesn't apply: Shop floor stations and machines that can't support MFA. Protect those another way, by keeping them off the internet and on their own network (mistake 1).

5. Pushing updates or network changes to production equipment without testing

• The tip: Treat any change that touches production equipment like a change to the process. Approve it, test it, schedule it.
• Who it helps: Plants with CNC machines, PLCs or operator screens that run Windows or connect to the network.
• What to do: Agree on who can approve a change. Test an update on one machine before the rest. Schedule changes outside production hours, with a way to undo them. Bring in the equipment vendor when the change touches their system.
• A typical situation: An automatic Windows update or a firewall rule change goes out on Friday. On Monday morning, the CNC can't reach the network and programs won't load.
• When it doesn't apply: Equipment that isn't networked. This also doesn't mean "never update." It means update on purpose, with a plan. Where a machine truly can't be updated, its separate network (mistake 1) does the protecting.

6. No written plan for running when the ERP, server or internet is down

• The tip: Decide now how you'll keep picking, labeling and shipping when your systems aren't available.
• Who it helps: Operations managers, shipping leads and owners.
• What to do: Write one page that answers four questions. Who decides whether to hold or send the trucks? How do orders get picked and labeled by hand? How long can each critical system be down before it really hurts? Who calls customers? Consider a backup internet connection if an outage stops shipping. Walk through the plan once a year.
• A typical situation: The internet drops at 2 p.m. with trucks at the dock. Nobody knows whether to hold them, and the pick lists are on a screen that won't load.
• When it doesn't apply: Your shipping process already runs on paper and doesn't depend on any system.

7. Admin passwords and network details that live in one person's head

• The tip: Write down how your network is built, and keep admin passwords where more than one trusted person can reach them.
• Who it helps: Owners with one IT person, a part-time helper, or an outside provider who has never handed over documentation.
• What to do: Get a current map of your network and a list of devices and their settings. Store admin passwords in a business password manager, with access for at least two people. Get it in writing that the passwords, documentation and data belong to your company.
• A typical situation: Your IT person quits or is out sick, and the firewall fails. Nobody else can log in to fix it.
• When it doesn't apply: Everything is already documented, reviewed in the past year, and at least two people can get to it.

8. Warehouse Wi-Fi and label printing with no backup

• The tip: Design your Wi-Fi around where scanners are actually used, and keep spare devices ready to swap in.
• Who it helps: Shipping, receiving and warehouse teams.
• What to do: Walk the building with a scanner and note where it drops. In a larger building, have a wireless survey done. Put access points where people scan, not where it was easiest to run a cable. Keep one spare scanner and one spare label printer on a shelf, already set up and tested.
• A typical situation: Scanners drop out at the back racks, so pickers walk to the front to sync. Then the label printer dies at 3:30, right before the last truck.
• When it doesn't apply: Your warehouse doesn't use wireless scanners, or picking and labeling run on paper.

What to do next

1. Score yourself. Go through all eight and answer yes or no. "I think so" counts as no. Our manufacturing IT checklist can help.
2. Sort your no's with two questions. If this failed today, would it stop production or shipping? Can we fix it within a month without a big project?
3. Do the quick fixes this month. Start with MFA on every account (mistake 4), a test restore (mistake 2), spare scanners and printers (mistake 8), a password manager with two people on it (mistake 7), and a one-page outage plan (mistake 6).
4. Schedule the projects. Separating the machine network (mistake 1), replacing an out-of-support server (mistake 3) and setting up change control (mistake 5) take planning. Put them on the calendar around your slow season, with a named owner and a date.
5. Check again every year. People leave, equipment changes and software reaches end of support. Run the same eight questions annually.

If you'd like a second set of eyes on your eight answers, you can book a short call with us.

FAQ

Can we fix these ourselves, or do we need an IT company?

Some of each. Turning on MFA, writing the outage plan, buying spares and getting your passwords into a shared vault are owner decisions your team can drive. Separating the machine network and replacing a server need someone who knows networks and servers well. Whoever does the work, you should be able to check the result with the same yes-or-no questions.

How do we figure out what an hour of downtime costs us?

Add up four things for one hour of stopped production: the output you lose, the wages you pay while people wait, the overtime or expedited freight it takes to catch up, and any late penalties in your customer contracts. Use your own numbers. That figure tells you how much a fix is worth.

Our equipment vendor needs remote access to a machine. Is that safe?

It can be, with rules. Give the vendor its own account with MFA, never a shared login. Turn access on only when they need it, and keep that connection limited to the machine network. Keep a record of when they connected and what they did.

Won't MFA slow people down?

Not much. With an authenticator app, approving a sign-in takes a few seconds, and Microsoft 365 and Google Workspace can remember trusted devices so people aren't asked every time. Shared shop floor stations that can't use MFA are protected differently: keep them off email and the internet, and on their own network.

Last reviewed: October 2026

About the author: I'm Adam Crossley, CEO and co-owner of Fairoaks IT. Before IT, I worked at Sikorsky on the Navy Seahawk program, and I'm the author of The Compliance Formula, Cyberattack, and Cybersecurity: The Silent Battlefield.