A manufacturer treated ransomware as an IT risk until a peer lost eleven production days — and reviewed its own position. OT and IT backups shared the same infrastructure, so a corporate compromise reached plant-floor systems. A full line restart had never been attempted from backup. Legacy control systems sat outside backup scope entirely. And ransomware detection was perimeter-based, offering nothing once an attacker was already inside. The turning point was expressing recovery time as lost production rather than service availability — at which point the decision moved from an IT budget item to a business one. UPC Cyber vault placed line-critical systems in an air-gapped immutable vault, separated from the corporate estate, with AI detection spotting encryption patterns in real time and multi-VM orchestrated recovery rehearsed against the actual sequence a plant restart requires — legacy platforms included.
