MES security means protecting the system that sits between your machines and your business network: who can log in, what it can change, how it connects to equipment, and how fast you can recover if something goes wrong. It is not the same as worker or machine safety, although a security failure can end up harming both. Below you will find the main risks, the controls that matter most, the Slovenian and EU rules to check, and a checklist for assessing any MES before you buy.
Two meanings of “security” get mixed up in factories. Occupational and machine safety protects people from machines: guards, emergency stops, risk assessments. Cybersecurity protects the machines and the software from people, or from malware. The EU Machinery Regulation now addresses both sides: it adds protection of machines from people to the older focus on protecting people from machinery.
The two meet in practice. NIST notes that operational technology cybersecurity is essential to safe and reliable operations, because incidents can endanger human life, damage the environment or harm equipment. So a security question about your MES is also a safety and quality question.
In practice, MES security has five parts:
An ERP system holds business data. An MES holds business data and also talks to the machines. Researchers describing attacks on smart factories call the MES the most sensitive endpoint, because it bridges the production floor and the corporate network. The same paper points out that even a slight alteration of the MES database could damage manufactured goods.
That last point is worth dwelling on. A stolen file is a data problem. A quietly changed tolerance, recipe parameter or batch record is a quality problem you may find only when a customer complains. This is why integrity deserves as much attention as confidentiality.
The same research describes denial-of-service attacks from malicious industrial IoT devices that can stop production. Ransomware is the more familiar route: Dragos reports that ransomware can affect the MES and plant operations through IT and OT dependencies. How badly depends partly on whether you can isolate the network and run operations independently of IT.
Connecting machines to a live MES is the point of digital manufacturing, but it removes the old separation between office and plant. The research notes that remote entry opportunities grow as IT and OT isolation decreases, and that lateral movement from IT to OT can worsen the consequences of an attack.
Vulnerabilities in industrial products are regularly published, including in Slovenia. In 2026 SI-CERT reported that a hard-coded secret in an industrial database component could let an attacker with local high privileges recover administrative credentials and potentially manipulate industrial processes or disrupt operations. The lesson is general: ask every supplier how it handles credentials and how quickly it publishes fixes. For a wider catalogue of threats, see our overview of the types of industrial data security risks every plant must track.
NIST’s guide to OT security recommends defence in depth. For an MES, that translates into the following.
| Area | What to do | Why it helps |
|---|---|---|
| Network | Segment IT and OT, with a DMZ between them | Limits how far an intruder can move |
| Access | Multi-factor authentication and least privilege | A stolen password alone is not enough, and users can change only what their job needs |
| Ports and services | Disable what is unused | Fewer entry points |
| Patching | Risk-based, tested, planned in maintenance windows | Fixes arrive without surprise downtime |
| Backups | Secure, out-of-band, with offline copies of critical systems | Recovery does not depend on the compromised network |
| Supply chain | Manage supplier risk and restrict physical and logical access | Third parties are a common route in |
These controls come from NIST’s Guide to Operational Technology Security, which covers segmentation with DMZs, MFA, least privilege, disabling unused ports, out-of-band backups and a tested patch strategy.
On the shop floor you cannot restart a system whenever a patch appears. Dragos notes that OT patching can require downtime, so risk-based alternative mitigations may be needed until a maintenance window. In practice: keep an inventory of versions, rank vulnerabilities by their effect on your process, test patches on a copy, and schedule them with production planning. Where a patch must wait, tighten network rules around the affected system in the meantime.
Every machine linked to the MES should have a defined, documented communication path: which device talks to which, on which port, in which direction. Anything outside that map should be blocked. If you are still planning the integration, our guide to integrating a digital MES with equipment explains the connection step, and the role of IoT in manufacturing shows where connected devices add value and where they add exposure.
Which rules apply depends on your company and your products. Here is the landscape as it stands.
Slovenia’s new Information Security Act, ZInfV-1, transposes NIS 2 and requires in-scope entities to implement risk-management measures and report significant incidents. The national authority is URSIV, which provides guidance and support, while its inspectorate supervises the act. The same page notes that the act makes management responsible for supporting cybersecurity, integrating it into business planning and putting security documentation and risk measures in place. The full text is in the state legal register. Whether your plant is in scope is a question for your legal or compliance adviser and for URSIV’s guidance for obliged entities.
For in-scope manufacturers, one practitioner roadmap summarises NIS 2 as ten Article 21 risk-management measures, with IEC 62443-2-1 offering a method for OT security programmes. The same source observes that NIS 2 does not address factory-floor specifics such as legacy PLCs and production continuity, so translating it to the plant is real compliance work. Treat that as a reason to involve your automation engineers early.
For in-scope entities, significant incidents must be reported to the national CSIRT within 24 hours of initial assessment, followed by a formal report within 72 hours. The national CSIRT is SI-CERT, which handles incidents for in-scope entities as well as voluntary reports; government networks report to SIGOV-CERT. Agree internally who makes that call at 3 a.m., and write their phone number into the plan.
If you build machines or digital products, further rules apply. The Machinery Regulation (EU 2023/1230) makes appropriate cybersecurity measures mandatory for those placing machines on the market. The same whitepaper states that under the Cyber Resilience Act, manufacturers of digital products such as PLCs and industrial switches must confirm cybersecurity in their CE declaration, with compliance mandatory for products sold from December 2027.
The cheapest time to fix a security gap is before go-live. Google’s OT guidance for manufacturers advises to include security requirements in design and in site or factory acceptance tests, map assets and communications, assess risks, govern approved vendors and secure remote access with MFA. Turn that into questions for any MES supplier:
Ask for answers in writing and keep them with your project documentation. They also help the compliance work described above.
Security does not end at go-live. Three habits make the biggest difference.
Security is easier to build into an MES than to add afterwards. That is why we think the first question to ask is not “which features does it have?” but “how does it connect, and who can change what?”
Mestric™ is designed to connect directly with manufacturing equipment and collect data automatically. That reduces manual errors, and it gives you one place where production data, KPIs, downtime and quality parameters are visible. For security, a single, consistent view is an advantage: it is easier to define who sees and changes what in one system than across spreadsheets, paper records and unmanaged exports.
We would encourage every plant to treat the MES rollout as the moment to map machines, data flows and responsibilities. You need that map for good optimisation anyway, and it is the same map you need for network segmentation, access control and incident response. Real-time visibility also helps you spot abnormal behaviour, such as unexpected downtime or quality drift, sooner.
Our advice is to see the system working in a real production environment, bring your automation engineer and your IT lead to the same demonstration, and put your security questions on the table from the first meeting.
Andraž
If you are comparing MES platforms, we can show you how Mestric™ connects to machines and presents live KPIs, downtime, quality parameters and cost analysis, in a demonstration at our demo centre. Bring your security questions from the checklist above. You can read more on the Mestric™ MES solution page or start from mestric.com.
For background on how an MES differs from older ways of working, read MES vs traditional manufacturing.
No. Machine safety protects people from hazards such as moving parts, while MES security protects systems and data from unauthorised access or tampering. They overlap because, as NIST notes, OT incidents can endanger people, the environment and equipment. Treat them as two linked programmes with shared owners.
It depends on whether your company is an in-scope entity under the act, which transposes NIS 2 in Slovenia. URSIV publishes guidance for obliged entities, and your legal or compliance adviser can confirm your status. If you are in scope, you must apply risk-management measures and report significant incidents.
Start with what you can see and control: an inventory of machines and connections, then multi-factor authentication and least-privilege accounts on the MES. Network segmentation between IT and OT follows, ideally with a DMZ. NIST lists these among its core recommendations.
For in-scope entities in Slovenia, the national CSIRT (SI-CERT, or SIGOV-CERT for government networks) must be told within 24 hours of initial assessment, followed by a formal report within 72 hours. Check URSIV’s guidance for the current procedure and forms.
069 763 552