Ransomware planning across the car industry rests on narrow margins, according to GitProtect Lab research that maps how quickly vehicle plants and their suppliers run out of road when critical systems fail.
The shortest fuse belongs to the 19.5% who said an outage turns into an immediate crisis within two hours. A two to 12 hour window is all that 39.5% can manage before downstream distribution breaks down, and reaching a full day takes 28% leaning on physical stock buffers. Just 8.5% said they could absorb one to three days of minor delays. Across the whole sample, 87% could not sustain more than 24 hours offline.
Recovery is where the sector is thinnest. Manual workflows, not automation, set the pace for nearly half of respondents – 46.5% cannot finish a full restore inside a day. Rebuild speed then varies sharply: automated pipelines put a hacked plant’s golden images and configuration data back inside four hours for 23% of teams, while two to five days or longer is the reality for 18%. And 8% have never rehearsed a complete restore across a whole plant’s OT estate.
Network architecture leaves room for an incident to spread. Some 78.5% of the organisations surveyed run flat, dual-homed or poorly segregated IT and OT networks, so an intrusion that lands on corporate systems can travel into production. Only a minority judge plant managers ready to keep assembly lines running if ransomware freezes a manufacturing execution system; 55.5% called them moderately prepared at best.
Isolated backup cover is in place for 70.5% of respondents, so the picture is uneven rather than uniform. A gulf remains for 17.5%, whose protection is only partial. The 12% tail either leaves copies attached to the primary network or has no single backup system at all.
