Their office network and shop-floor equipment sat on the same flat switch. A phishing email opened on an office computer could, in theory, reach the machines running production.
Nobody had mapped what was connected to what. Fixing one problem meant risking another, so the setup stayed as-is for years.
Mapped every device on the network office and shop floor, before touching anything.
Split the network so shop-floor equipment and office systems can no longer reach each other.
Put 24/7 monitoring on both sides tuned to what normal looks like on a shop floor.
Scheduled the cutover for a weekend so production never lost an hour.
Since segmentation, the shop has logged zero hours of production downtime tied to a network issue. Office and shop-floor systems are now monitored separately, and an incident on one side can't touch the other.