The breach is contained. The product isn't.

Here is an uncomfortable observation about the Boston Scientific cyberattack. The plants went dark, IT rebuilt what the attackers touched, and the recovery is being reported like a victory. Restoring a disrupted manufacturing network is real work. The people who did it deserve credit. But I have spent two decades in automotive and aerospace plants, and I read that coverage waiting for one question nobody asked: what was being made between the moment the intruders got in and the moment containment was declared – and who put a hold on it?

I read incident timelines the way other quality directors read control charts. That is what a CV does to you when it holds a CEH, thirty-plus security certifications and a place on T-Mobile's bug-bounty Hall of Fame for a clickjacking disclosure, alongside quality directorships under IATF 16949 and AS9100. Two professions. One grammar: how complex systems fail, and how to build them so they don't. This week brought more of the same – Boston Scientific still recovering, a food-and-agriculture warning, water utilities flagged as targets – and every report ends the same way. Contained, measured in uptime.

The intrusion timeline is a lot number

Every forensic investigation yields three timestamps: initial access, dwell time, containment. Read them against production genealogy, left to right, and they define a suspect population. Every unit processed, tested or shipped inside that window is suspect stock. Not because anyone assumes the attackers edited a welding parameter or a vision system's reference image. Because you can no longer prove they didn't – and record integrity is precisely what the incident threw into doubt.

A device manufacturer answers to regulators who think in lot traceability and unique device identifiers; an aerospace supplier answers to AS9100 and the authority behind it. Both will eventually demand the same artefact: the forensic timeline mapped onto serial numbers, with a disposition for everything inside it.

I built the QA/QC function for a 900-plus-employee greenfield plant with traceability designed in from day one, so "which cavity, which shift, which parameter set" was a query, not a task force. Most plants inherit systems that answer those questions only when everything is healthy. A cyber incident is, by definition, the scenario in which nothing is.

The structural failure is simple. The recall procedure lives in the quality manual; incident response lives with IT under ISO 27001. In the average plant the two documents have never been introduced. They share a canteen and nothing else.

Containment arithmetic beats reassurance

During an outage your customer's supplier quality engineer does not want the legal-vetted press release. They want lot ranges, interim controls and disposition logic: what is on hold, what the interim inspection covers, what ships and on whose signature. "We are confident there was no impact on product quality" is the fastest way to turn an incident into an escalation, because the SQE hears a boundless claim with no data behind it.

The calm alternative is the oldest craft in quality. I went a quarter with zero critical customer escalations across multi-site operations, and not because nothing went wrong. We bounded suspect populations with data before the customer had to ask twice: here is the range, here is the evidence, here is the interim control, here is the closure date. The containment discipline behind the QRQC and A3 work at WITTE Automotive transfers verbatim. An 8D does not care whether the nonconformity came from a worn tool or a ransomware actor.

The arithmetic is not close. Say the grey zone holds 40,000 components. Over-quarantining costs 100 percent inspection at €4–5 a part plus two weeks of line-side friction – the best part of €200,000. An escape costs sorting at the customer, stopped lines, expedited freight and a re-audit at five to ten times that, before anyone mentions a regulator; for a device maker the recall exposure is effectively uncapped. Over-quarantine is the cheap ticket. What it really costs is courage, because the grey zone includes product already sitting on a customer's shelf, and someone senior has to sign the page that names it.

What the machines were doing during the attack

The forensic timeline covers the network. Production has its own. Interrupted cycles strand parts mid-process – mid-weld, half-cured, parked in a washer whose programme never finished. When MES logging degrades, operators record on paper, and that box of signed travellers becomes the only genealogy two shifts of product will ever have.

Then comes the part nobody plans: the cold restart. Ovens re-ramp, lines come up cold, and the first parts out the other end come from a process that has effectively never been validated. No first article. No deviation signature. No PFMEA review. It is the largest unvalidated process change a plant will ever execute, run under crisis pressure by people who are exhausted and relieved. In a routine IATF or AS9100 audit, that single morning generates more findings than most plants collect in a year.

So write it into the incident response plan in peacetime: a pre-authorised restart protocol, first-article hold points on defined stations, a deviation template with signatures already agreed. And make it fast. Booz Allen warned this week that AI-driven attacks are approaching autonomous capability and response windows are narrowing. I design and deploy multi-agent AI systems myself, so I take that literally: when dwell time compresses from weeks to hours, the containment decision happens at machine speed, and the quality disposition cannot sit in a queue waiting for a meeting.

Restored is an IT word. Contained is a quality word.

Quality management and incident response are not neighbouring disciplines; they are the same discipline pointed at different failure modes. The plant that survives the next attack intact will have a quality engineer in the war room with the same authority as the security lead, translating timestamps into lot boundaries in real time. So when IT reports the incident contained, ask the only follow-up that matters: since when – and what did we ship in between?