Somewhere in your factory there is a connection that made perfect sense on the day somebody made it.
It happened the way these things always happen. When the business was smaller, the office computers and the machines went onto one network, because that was the quickest way to get operations what they needed. And operations knew what they needed. They even secured it — carefully, within their own world, without troubling anyone else. What's made makes money; everything else waits its turn.
Then the business grew. A new line. A system for the warehouse. Remote access for the engineer who looks after the packaging machines, set up one Sunday because Monday had orders on it. Each step was decided by someone with a good reason. Each step made sense up close. Nobody had the view from above — what each new connection meant for everything already there.
Here is the everyday version of where that ends up. An operator opens a machine's control panel from an office laptop — a local IP address, bookmarked years ago. It feels safe: it's all behind the company firewall. But behind that firewall there may be nothing between the office and the machines. A problem on one side — a bad attachment, a compromised laptop, a piece of software behaving badly — has a path to the other. In both directions. Nobody decided that. It accreted. Convenience became routine, routine became process, and process became culture.
Culture is the part that resists. A network built this way doesn't just carry technical debt — it weaves the debt into how the business operates, until it stops being visible at all. In its own eyes, the business is secure. That belief is part of the debt.
And the world outside is moving. IT and OT are converging, and a weakness in one gets found and used through the other faster every year. Your biggest customers know it — that is why their security questionnaires now ask what is connected to what on your site, and who governs it. Insurers are beginning to ask the same. And new UK cyber legislation will push the same questions further still. The question nobody inside could answer is now arriving from outside, in writing.
So what does fixing it look like? Not a big bang, and not a shutdown. The honest sequence starts with seeing, not changing: identify the systems, walk the site, write down what is actually connected to what — before a single change is made. Most businesses have never had that picture; making it is a project in its own right, and it can be done without touching production at all. Then the separation happens the way it should have been built the first time: staged, deliberate, each change planned and reversible, the line running the whole time. I trained in automation and robotics — I read a production floor the way the people who run it do, and the first rule on any floor is that the work happens around the line, never through it.
Two things fall out of doing it properly. The first is immediate: the next questionnaire has answers — written, current, yours. Compliance stops being a scramble, because the site can finally be read.
The second is the longer game. Everyone will be asked to put AI to work in their operations over the next few years. The businesses that manage it safely will be the ones whose networks were designed and governed before anything intelligent was let loose on them — and then designed into, deliberately, by people who understand both the machines and the automation. That is the work: the foundation first, then the build. We have already done it to ourselves.
If your network grew with your business, and you have never been quite sure what is joined to what — that is worth a conversation.