Amid a wave of high-profile cyberattacks this year, manufacturing businesses have been named among the worst performers for cyber policy, according to new research.

The Cyber Culture Clash study, by compliance training provider Skillcast, analysed the gap between written cybersecurity policies and real-world practice in the largest businesses in the UK, across multiple sectors.

The manufacturing sector recorded the second-lowest policy score of all industries analysed, highlighting a significant gap in comprehensive frameworks designed to prevent attacks.

Policy maintenance is one major concern: manufacturers update privacy policies every 32 months on average – almost three years – leaving governance and risk management struggling to keep pace with evolving threats. By contrast, sectors such as retail and public services refresh policies roughly every six months.

Only 33% of manufacturers maintain a formal cybersecurity policy, and just 20% hold Cyber Essentials Plus certifications, potentially leaving organisations exposed.

On a positive note, 60% reference ISO 27001, a critical framework for industries reliant on complex supply chains – though adoption is far from universal.

These weaknesses are further reflected in operational practice: the sector experienced a 51% increase in businesses reporting cyberattacks to the ICO over the past two years, while only 1.9% of staff hold dedicated cybersecurity roles, compared with over 8% in the technology sector.

Each industry in the study was assessed with two scores out of 260, one for policy and one for practice.

Policy covered essentials such as cybersecurity frameworks, regulatory references, and Cyber Essentials Plus accreditation, while practice assessed operational factors including staff headcount, attack rates, and phishing resilience.

Vivek Dodd, CEO at Skillcast said:

“The manufacturing sector faces significant challenges in aligning policy with practice, making it one of the most at-risk industries in our Cyber Culture Clash Report.

“Many manufacturers remain understaffed, underprepared, and overexposed relative to the cyber threats they face. Strengthening governance, increasing dedicated cybersecurity staff, and formalising security controls are critical steps if the sector is to reduce vulnerabilities and build true resilience.”

Readers can find the full Skillcast Cyber Culture Clash report here: https://www.skillcast.com/cyber-culture-clash-index-report

Read other recent news: https://industrial-compliance.co.uk/category/news/