The vendor dials in. The change control doesn't.

Here is an uncomfortable observation from two decades on plant floors: the most dangerous instrument in your factory is not the press, the weld cell or the laser cutter. It is a laptop in a service van three time zones away. It carries no badge, needs no escort, signs no work permit and files no change request – and this week it is in the news, after suspected intrusions into European supermarket OT environments came through exactly that door: routine remote access.

The session is the change

The coverage has been all threat actors, indicators and network segmentation. One vendor of remote-access tooling spent the week publicly urging manufacturers to tighten their controls – a telling admission of how soft the default still is. Nobody asked the plant question: what does that same channel do to a quality system when it lives inside the factory and is used, legitimately, every week?

Under IATF 16949 and VDA 6.3 change-management logic, a process change does not care who made it, or from where. A technician who walks through the turnstile to move a torque controller from 18 to 19 Nm triggers a chain: work permit, change request, PFMEA review, revalidation runs, sometimes a PPAP notification to the customer. The identical nudge, made over a VPN by a vendor engineer at 2 a.m., triggers nothing. Your PPAP is a signed photograph of one moment. Your control plan, capability studies and reaction plans all assume the process stays where you left it. Every undocumented remote session converts that assumption into a rumour – the validated process you certified becomes something you believe rather than something you know.

What the attacker knows that the auditor doesn't

I hold a CEH certification and my name sits on T-Mobile's public bug-bounty Hall of Fame for a clickjacking disclosure. The most durable lesson from that side of my work maps straight onto a plant: the entry point is never exotic. It is the routine path nobody audits. A forgotten subdomain. The page that accepted the overlay. The vendor account whose credentials never rotate. A factory is no different: the remote maintenance channel is the one path that produces no paper, which makes it the one path no auditor ever walks.

An intruder who reaches a PLC does not need to break anything to cause escapes. Ransomware is loud; it wants to be seen. A two-percent nudge on weld current or clamp pressure is quieter – no encrypted files, no ransom note, just product drifting out of specification and onto a truck. And attackers did not invent this failure mode. At WITTE Automotive I lost count of the QRQC sessions that ended not at our own press but at a supplier who had tuned a parameter weeks earlier and told no one. The 8D trail – containment, sorting, warranty cost – always led back to a change nobody gated. The door stood open long before anyone hostile knocked.

Ransomware announces itself. Parameter drift waits for your customer to announce it for you.

Close the gate, not the vendor

The answer is not to ban remote access. You will lose that fight, and a machine idling while an engineer books a flight costs more than the risk it removes. Sequencing is everything. At SNOP, where I built the QA/QC department from the ground up at a 900-strong greenfield plant, vendor-access rules went into the quality manual before the first machine was delivered. Day-one rules are cheap. Retrofitting them into a running plant costs multiples, because by then every vendor has always done it this way, and every line has a production plan that outranks your policy.

In practice the rules look like this. Brokered sessions through a monitored jump host, never direct vendor tunnels. Read-only by default; write access granted per session, against a ticket, with recording on. Every write session generates a change receipt – parameter values before and after – that feeds the QMS, and if it touched a special characteristic, revalidation fires per the control plan. Remote access also sits in the PFMEA as a process input, with undocumented parameter change as a named failure mode and periodic audits of controller values against PPAP golden values as the detection control.

The € arithmetic is not close. An hour of brokered-access friction costs a few hundred euros of vendor downtime. One ungated change that reaches the field costs sorting, containment, 8D hours, expedited freight and a customer quality manager who now reads your shipping labels with suspicion. I have signed off on both bills. One is a rounding error; the other is a line item someone above you starts asking about.

Auditors audit what arrives on paper. Attacks and parameter drift arrive through a socket. For twenty years we built our gates on an unspoken assumption: that a change had to walk through the door wearing a badge. The supermarket intrusions should be read as a quality warning, not only a security one. The gate that stops a technician from turning one screw does not exist for a vendor with a token. If quality owns the product – and under every standard we certify to, it does – then quality must own the gate on remote access. Build it on day one, or you will retrofit it one escape too late.