The exposures that turn into downtime
Most attacked, four years running
Manufacturing drew 26% of the incidents IBM X-Force responded to in 2024, more than any other industry, and extortion was the most common outcome.
Internet-facing services nobody owns
Ports opened for a supplier, a project or a test stay open. Each one is attack surface that nobody has signed off on.
Suppliers inside your network
Integrators and suppliers are given access for a project and keep it. NIS2 expects that supplier risk to be managed and reviewed.
Shut the open doors
TENET lists network security group rules that open services to the internet and maps how an exposed resource, an over-privileged identity and a critical system connect. You close the link that breaks the most paths first.
- Internet-facing ports per network security group
- Attack paths from entry point to target
- Identities shared across corporate and supplier systems
RDP open on vm-mes-gateway
Foothold · production integration host
Managed identity with broad role
Pivot · reaches other subscriptions
ERP database
Target · reachable through the chain
HTTPS supplier portal
Expected exposure
Sentinel: credential theft attempt
Engineering workstation
Defender: ransomware behaviour
Blocked on a file server
Lateral movement techniques
Partial control coverage
Initial access via RDP
Path closed
Respond with full context
Microsoft Sentinel and Defender incidents are placed next to the identities, devices and attack paths already tracked, and MITRE ATT&CK mapping shows which techniques your Microsoft controls cover.
- Incidents linked to root cause
- MITRE ATT&CK coverage of your controls
- Any finding turned into a remediation task
Catch degradation before downtime
ERP, MES and integration workloads on Azure are watched against learned baselines. Resource Health events and application failures sit in the same view, so a slow decline is caught before production stops.
- Baselines learned per resource
- Resource Health events alongside
- Application failures by app
vm-erp-app
Memory far above baseline
integration-api
Dependency timeouts rising
sql-mes
Resource Health event reported
storage-plant-data
Within baseline
Article 21(2)(j) · multifactor authentication
Failing · supplier accounts
Automation integrator
Admin access · review overdue
Article 21(2)(d) · supply chain security
Evidence incomplete
Logistics partner
Questionnaire complete
Manage supplier and NIS2 risk
TENET maps your Microsoft 365 and Azure configuration to NIS2 articles and NIST CSF 2.0, and keeps a supplier register with review dates and questionnaires next to the technical controls.
- NIS2 and NIST CSF 2.0 readiness
- Supplier register with review dates
- Questionnaires sent and tracked
FAQs
Are manufacturers and infrastructure operators in scope for NIS2?
NIS2 covers energy and transport operators, and manufacturers of certain products such as machinery, electrical equipment and vehicles. Scope depends on your size and on how your EU member state has transposed the directive. TENET maps your Azure and Microsoft 365 findings to NIS2 articles and NIST CSF 2.0 categories.
Read how TENET supports NIS2 compliance and NIST CSF 2.0.
Does TENET monitor plant-floor or OT networks?
Could TENET disrupt running workloads?
No. TENET only reads data. It does not deploy agents or change resource configuration, so the Azure workloads you run today are not altered when you connect it.
See the Microsoft cloud integration guide for the exact roles and setup steps.
Find your Microsoft cloud risk
Connect your Azure and Microsoft 365 tenant with read-only access and see which identities, exposures and anomalies matter most.