The audit stops at the dock. The tunnel doesn't.

Here is an uncomfortable observation. This week CISA and the FBI told critical-infrastructure operators that third-party remote access into industrial control systems has become the attack path of choice, and asked for least privilege and session controls. The same week, Black Kite put the count of manufacturer ransomware victims at 1,183 through July, with campaigns spreading well beyond the US. I have sat through enough VDA 6.3 supplier audits – WITTE Automotive, FOREAST, client plants – to know the checklist by heart: PPAP status, process capability, escalation paths, what is in the crate. It has a line item for everything the supplier ships and nothing for the session they keep open into your line.

Where the audit scope ends

The scope ends at two predictable points: the dock, and the machine acceptance sign-off. Upstream of those gates, everything gets interrogated – capability studies, reaction plans, escalation trees, delivery performance. After the SAT certificate is signed, everything is assumed. The integrator who wrote your PLC logic keeps credentials for the life of the equipment. That is the only lifetime guarantee in this industry that is actually honoured.

I hit this at full speed at SNOP, commissioning the greenfield plant – nine hundred plus people, every machine new. Every builder listed permanent remote diagnostics as a warranty condition. Several arrived with one shared VPN credential for the whole service department: five engineers, one password, no expiry, no log. I pushed back. Some caved, one threatened the warranty. What bothered me was not their position. It was that my audit checklist had nothing behind it. IATF 16949, VDA 6.3, even AS9100 ask whether the supplier can support the machine. Whether anyone knows who is inside it at 2 a.m. is nobody's question.

My other working life is breaking systems on purpose – certified ethical hacking, bug-bounty disclosures – and this is the oldest pattern there is. The reliable way into a complex system is never the front door. It is the access somebody provisioned for convenience and never revisited. Supplier quality audits the vendor's outputs. IT security, in most plants, barely knows the session exists. Nobody owns the seam.

How a remote session becomes a quality escape nobody owns

Walk the failure forward. A service engineer, tuning a fault on a sister machine at another customer, opens the tunnel at 2 a.m. and nudges a servo gain or a weld-current window. Your parts still conform. Mostly. Traceability records your process parameters, not his keystrokes. SPC catches drift three weeks later and blames tool wear. IT sees no breach, because there was none: he used a legitimate credential, issued years ago, that nobody revoked. Quality opens an 8D. IT closes a ticket. The escape sits between two departments that never share a meeting.

I have chased escapes that came out of exactly this gap. One dimensional drift cost three weeks of containment; the root cause was a parameter change a machine builder pushed in remotely during an unrelated service call, and never logged. Our traceability file was spotless, because it recorded our process, not their intervention. Nobody lied. The system simply had no memory of the event that changed the process.

Every credential you do not govern is a process parameter you do not own.

Least privilege is a control plan, not a security product

What CISA and the FBI are asking for is not a purchase. It is an audit-scope extension, and quality people are unusually well equipped to run it. Treat remote access as a special characteristic. Write it into the PFMEA: failure mode, unauthorised or unlogged parameter change via vendor session; detection, none – if you are honest. Then the controls go into the control plan, in the row next to torque and weld current: named access, time-boxed dual-approved sessions, log review.

In practice this means no shared accounts. One named individual per credential, with an expiry date, re-checked at every supplier audit. Sessions open by ticket, approved by plant and quality, and close when the ticket closes. Session logs get retained and reviewed like calibration records – same cadence, same signature. And you audit the vendor's access hygiene the way you audit their Cpk: account list, revocation record, date of last log review. A supplier who cannot produce those has a capability index of zero on this characteristic, whatever the paperwork claims.

Price the trade-off in euros at contract award, not during the 8D. A permanent tunnel in the service contract saves the builder a few hundred euros a year in travel and discounted diagnostics. One supervised day on site costs a flight, a hotel and eight hours of your engineer's time – call it €1,200 all-in. One escaped lot at a body-in-white tier one runs €40,000 in sorting, containment and premium freight before the customer is even mentioned.

The next recall in this industry will not start on your line. It will come through a door your quality management system never mapped: a credential issued at commissioning, a tunnel nobody closed, a change nobody logged, in a plant where everyone assumed the risk was somebody else's department. Black Kite counted 1,183 manufacturers who learned that connectivity is part of the process the hard way. Quality owns the product, the process and every characteristic that makes a part conform. A remote session that can alter the process is such a characteristic. Extend the audit to the session log, and own the connection the way you already own the torque wrench.