From IT restoration to production restart: Why manufacturers continue to struggle with operational side of cyber recovery - Industrial Cyber

Manufacturers often treat cyber recovery as an IT problem, but the article argues that the real bottleneck is operational restart—why production doesn’t resume when systems come back online. It cites the cost gap: while IT recovery can happen within hours during ransomware attacks, operational readiness can take days. The piece estimates the recovery-operation mismatch can cost US$1.9 million per day, with baseline manufacturing ransomware downtime of 11.6 days, and some cases reaching 129 days. Two examples illustrate the “recovery gap.” Jaguar Land Rover’s U.K. plants in Halewood and Solihull were shut down after a cyberattack, leaving lines offline for about five weeks; UK car production fell 27% in September 2025. Clorox, after a similar situation in August 2023, faced a month of offline production, losing $356 million and seeing a 20% revenue decline forecast for Q1 2024.