Illustration: a scan film, in point clouds, of the places a manufacturer runs: the plant from the air, a robot cell welding a frame, a line of CNC machines, an open PLC cabinet, a control room, an assembly line and the Cantic mark. The labels show synthetic readings and addresses.
We break into your factory before a criminal shuts it down.
From your website to the machines that run your lines. With Fortify, we write the fix within 24 hours.
Manufacturing
One way in can stop every line you run.
Every line to the internet is a door.
Eclipse, our own model trained to attack, keeps going until it can prove full control.
In plain words: an attacker that works for your company.
How far Eclipse goes
- Website
- Apps
- Logins
- Cloud
- Servers
- Internal network
- Machines
What your business runs on
We know what a factory runs on. So do criminals.
Outside firms
- Machine builders
- Line integrator
- Your IT provider
- ERP and software firms
- Building services contractor
Remote access
- VPN
- Remote desktop
- Remote support
- Vendor portals
- 4G routers
-
Production line
- PLCs
- Operator panels (HMI)
- Robot cells
- CNC machines
- Integrator’s remote access
-
Control room
- SCADA
- MES
- Production history
- Engineering workstation
- Building management
- Compressed air and power
-
Warehouse
- Warehouse system
- Automated storage
- Labelling and scanners
-
Office
- ERP
- EDI orders and invoices
- Design files (CAD)
- Payroll
-
United States and worldwide
Boston Scientific, the medical device maker
A network outage disrupted manufacturing and shipping worldwide; it said it would likely miss guidance.
Sources Boston Scientific MedTech Dive
-
United States and worldwide
West Pharmaceutical Services, the drug packaging maker
Systems taken offline worldwide; it said data was taken and some systems encrypted.
-
United Kingdom
Jaguar Land Rover (JLR), the carmaker
All global systems shut down; production restarted in phases from 8 October 2025.
Sources JLR UK government
Compared
This is not a yearly pentest.
| A normal pentest | Cantic |
|---|---|
| Once a year | Day and night, and on every change |
| A PDF weeks later | Proof as it happens, with a replay |
| Stops at the website | From the website to the server and the machine |
| You work out the fix | We write the fix within 24 hours |
| You hope it holds | We attack again to check it holds |
Under your control
Inside the rules you sign.
Guardrails and data privacy for factories, their lines and their designs.
Nothing runs until you sign
An authorisation and rules of engagement, signed by someone entitled to authorise the test.
Inside the limits you set
Your scope, hours and limits. It stops once it can prove control.
Stop it within 60 seconds
Rate-limited and time-boxed, so your systems do not slow down.
Every action on the record
Hashed and timestamped in a ledger you can inspect, and followed live.
A person on every critical finding
A named lead on our team.
No outside AI company sees your data
Eclipse is our own model, on our own servers.
Destroyed when the work is done
Deleted in several steps on our side; we do not keep it. First test reports: 14 days unless you subscribe.
Your IT provider gets the fix
Findings and fixes go to your own team or your IT provider.
Regulation
The rules a manufacturer answers to.
- NIS2 covers makers of electronics, electrical equipment, machinery, vehicles and medical devices, and chemical makers and distributors (Annex II). 1
- A significant incident needs an early warning within 24 hours and a notification within 72 hours (Article 23). 1
- Spain has not yet written NIS2 into law; in July 2026 the Commission took it to the EU Court of Justice. 2
Questions
What buyers ask us
- We are a factory, not a tech company. Is this for us?
- Yes: manufacturing was the sector most targeted by ransomware in the EU and in Spain from July 2024 to June 2025 (ENISA).
- Have you tested companies like ours?
- We never name clients, but at one industrial supplier Eclipse found a way to open payroll and internal financials.
- Does it help with NIS2 or ISO 27001?
- Yes: every step is recorded, from the signed scope to the retest, but it does not certify compliance.
How it starts
Your results in one day.
You sign the rules
An authorisation and rules of engagement, signed before anything runs.
Eclipse tests what is in scope
From the outside, the way an attacker would. There is nothing to install.
We put the findings on the table
In plain words, with what to do. Every finding comes with proof.
Sources
- EU Official Journal (publications.europa.eu), Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive), . Read on .
- European Commission, Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose the rules on cybersecurity, . Read on .
- NIST, Guide to Operational Technology (OT) Security, NIST SP 800-82r3, . Read on .
- ENISA, ENISA Threat Landscape 2025, . Read on .