Endpoint protection for a manufacturer with old computers running factory equipment

For older computers that directly control factory equipment, don’t start by installing a standard endpoint-protection agent everywhere. An agent can be unsupported on an old operating system, interfere with vendor software, or affect a process. Treat these as OT assets and validate any endpoint change with the equipment vendor and controls engineer.

A practical approach

1. Inventory and classify each machine: OS/version, machine and process controlled, software, network connections, vendor support, and whether the PC is safety- or production-critical. CISA calls an OT asset inventory foundational to protecting these environments. (cisa.gov)
2. Check compatibility before choosing endpoint software: confirm the agent supports the exact OS and hardware, and test it on a representative spare or during a planned maintenance window. If it isn’t supported or can’t be safely tested, don’t force it onto the machine.
3. Use compensating controls where agents aren’t viable: isolate the computer in an OT segment; allow only necessary traffic; block direct internet access; and tightly control vendor/remote access through a monitored gateway or jump host with MFA. NIST recommends considering additional protections for unpatchable OT systems, including network protections and inline security devices. (nvlpubs.nist.gov)
4. For stable, dedicated-purpose PCs, consider application allowlisting—but coordinate with the vendor and test thoroughly, since blocking an unexpected executable can disrupt production. (nvlpubs.nist.gov)
5. Maintain recovery options: verified offline backups or images, documented restoration steps, and a tested plan to recover safely. Keep removable media controlled and scanned on a separate system before it reaches the factory network.

Bottom line: use endpoint protection on legacy factory PCs only when it’s supported and proven safe; otherwise prioritize isolation, tightly limited access, monitoring, and recovery. NIST’s current final OT-security guide is SP 800-82 Rev. 3; its Rev. 4 is still a draft, with comments due November 30, 2026. (csrc.nist.gov)

To narrow this to a concrete design, the key details are the PCs’ operating systems, whether they’re network-connected, and what equipment/vendor software they run.

For a plant with legacy Windows machines, I'd avoid rolling out one standard EDR across everything. Split the fleet by what each machine can actually run, then apply different controls to each group.

1. Inventory first, passively. CISA's zero-trust OT guidance says passive network monitoring is the safe default for discovering assets, since active scanning can disrupt legacy devices (Passive network monitoring is the safe default for OT asset discovery and anomaly detection — active scanning risks disrupting legacy devices that were never designed to handle unexpected network queries.). Record OS version, patch status, network paths, and what each machine controls.

2. Tier the endpoints.

• Patchable, modern machines (Windows 10/11): Standard EDR/AV is usually fine, but test it against your control software and set exclusions with the equipment vendors before rollout.
• Unpatchable legacy machines (XP, 7, Server 2003/2008): Standard IT agents often won't install or will destabilize them. Use an OT-specific product that explicitly supports these OSes. Examples from vendor material include TXOne Stellar (covers Windows 2000 through Windows 11 with one-minute visibility and zero-disruption prevention), Acronis Cyber Protect for OT (supports Windows XP SP1 through Windows 11 and Linux kernels 2.6.9 through 5.19), and Sophos Endpoint for Legacy Platforms (a new add-on providing comprehensive security for a range of Windows and Linux endpoint and server operating systems that extend beyond the standard end-of-support dates). Verify these claims in a pilot; vendor marketing isn't independent testing.
• Machines that can't take any agent: Protect them at the network layer. CISA's guidance endorses agentless enforcement at the network layer for the many legacy assets that can't run software clients, which is a third-party analysis of the guidance, so check the original PDF if you rely on it.

3. Use compensating controls for the machines you can't protect directly.

• Segment the network so legacy machines are reachable only from what they need. CISA notes that legacy OT systems already possess many of these foundational segmentation techniques, including physical air gaps, dedicated virtual local area networks (VLANs), and carefully controlled access to sensitive zones, which gives you a baseline to build on.
• Restrict removable media and remote access, and enforce identity-bound access to engineering and HMI workstations.
• Use application allowlisting where the vendor supports it, so only known control software runs.
• Keep image-based backups and a tested recovery procedure. Operators need to restore machines without waiting for IT.

4. Pilot before scaling. Test on a spare or non-critical machine first, measure CPU and memory impact, and check for interference with real-time control timing. One manufacturer's rollout of standard endpoint software failed when it encountered legacy machines that couldn't handle the updates. As a result, production was disrupted, and the company incurred losses.

5. Align with your compliance obligations. If you're subject to IEC 62443, NIS 2, NERC CIP, or GxP, document the tiering and compensating controls. Those frameworks generally expect a documented risk decision for unpatchable systems.

To narrow this down, I'd need to know:

• The OS versions and approximate count of legacy machines
• Whether any of them are internet-connected or reachable from the business network
• Whether you have an in-house OT/security team or need a managed partner
• Your compliance requirements and rough budget

Securing legacy computers in a manufacturing environment requires a shift from traditional IT security to an OT-centric (Operational Technology) approach that prioritizes production uptime over standard patching cycles.

Because these machines often run unsupported operating systems (like Windows XP or 7) and cannot be easily updated or replaced, the industry standard is to implement "compensating controls"—layers of security that protect the machine from the outside in, rather than relying on software installed directly on the legacy endpoint.

1. Foundational Strategy: Network Isolation

The most effective way to secure legacy equipment is to stop it from being a target in the first place.

• Micro-segmentation: Isolate legacy machines into their own "cells" or network segments. Use an industrial firewall or Next-Generation Firewall (NGFW) to enforce a "deny-by-default" rule, allowing only the specific, minimal traffic required for the machine to function.
• Kill Internet Access: Ensure these machines have no direct path to the internet. If they must communicate with the outside world, route that traffic through a secure industrial gateway or proxy.
• Establish a Bastion Host: If technicians need remote access, do not allow direct connections to the legacy machine. Use a "jump host" or "bastion host" that sits between your network and the machine. All remote sessions must be authenticated, encrypted, and monitored through this single gateway.

2. Endpoint Protection for Legacy Systems

If you must install security software, ensure it is purpose-built for OT environments. Standard IT antivirus will often crash factory software or consume too much memory.

• Look for OT-Specific EDR/EPP: Several vendors provide solutions explicitly designed for legacy Windows platforms (XP, 7, Server 2003/2008). These tools (e.g., TXOne, Acronis Cyber Protect for OT, or Sophos Endpoint for Legacy Platforms) use lightweight, behavioral-based detection that does not require constant online updates.
• Application Control (Allowlisting): Rather than traditional antivirus (which relies on scanning for known threats), use "allowlisting." This approach blocks any software from running unless it is explicitly on an approved list. This is highly effective for factory machines, which typically only need to run one or two specific applications.

3. Practical "Compensating Controls"

When the machine cannot be patched, implement these manual or physical safeguards to mitigate risk:

• USB Control: USB sticks are the most common vector for bringing malware into a factory. Disable USB ports physically or use software to strictly control which devices can be plugged in.
• Immutable Backups: Maintain a "golden image" (a full backup of the software and configuration) of every legacy machine. If a system is compromised, you can restore it quickly without needing to rely on vendor support.
• Passive Monitoring: Use passive network discovery tools to monitor the traffic around your legacy equipment. These tools "listen" to the network to identify threats without sending active scans that could cause a sensitive PLC or HMI to crash.

Summary Checklist for Implementation

1. Inventory Everything: You cannot protect what you don't track. List every machine, its OS, and its network dependencies.
2. Define Communication Paths: Identify exactly who needs to talk to the machine and why. Block all other traffic.
3. Apply Compensating Controls: Add layers like firewalls, jump hosts, and USB lockdowns.
4. Adopt a Risk-Based Mindset: Document the risks for each legacy system. If a system is fully isolated and has no internet access, it may be safer than a modern system that is connected to the cloud.
5. Plan for Life-Cycle Management: Even if you can't replace them today, include these machines in your long-term technology roadmap. As budget allows, prioritize replacing the most critical/exposed systems first.

Professional Recommendation: Given the high risk of production downtime, consult with an OT-specialized cybersecurity firm before deploying any agents or scanning tools. They can help you perform a risk assessment to ensure that the security measures you add do not inadvertently stop your production lines.

For factory computers, don’t treat endpoint protection as a standard office-PC rollout. A scan, update, or quarantine action can disrupt a production process, so safety and uptime come first. NIST and CISA recommend a layered, risk-based approach that accounts for OT reliability requirements and tests changes before applying them. ¹²¹⁰

A practical approach:

1. Inventory and classify the machines. Record each computer’s OS and support status, machine/process controlled, vendor dependencies, network connections, and whether it can be replaced or isolated. Prioritize internet-connected, shared, and production-critical systems.
2. Separate OT from corporate IT. Put factory equipment in appropriately segmented network zones, restrict traffic to what is required, and tightly control remote/vendor access. Network segmentation and monitoring are especially important where old systems cannot be patched. ¹⁰¹⁴
3. Choose endpoint controls per machine—not one policy for all. Use vendor-approved antimalware/EDR where supported, and test it on a representative machine or offline image first. For sensitive HMIs or fixed-purpose PCs, application allowlisting can be a useful additional control; CISA specifically recommends it for HMIs. ¹⁰
4. Avoid disruptive defaults. Before broad deployment, validate scan schedules, updates, reboots, quarantine/remediation, and resource use with the equipment vendor and operations team. Prefer staged rollout and change windows; retain a tested rollback plan and system backups.
5. Compensate for unsupported operating systems. Endpoint software can add protection, but it does not restore missing OS security updates. Reduce exposure with isolation, allowlisting, least privilege, restricted removable media, controlled maintenance access, and a funded replacement plan. ⁸¹⁴
6. Monitor and maintain. Centralize alerts and logs where practical, keep signatures and supported tools current through a controlled process, and regularly test recovery and incident-response procedures. ⁶¹⁰

Product selection: First check the exact OS, edition, and endpoint agent support matrix—support varies by version and deployment method. Microsoft currently documents a Defender for Endpoint path for Windows 7 SP1 Pro/Enterprise, but that should not be taken as proof that a particular factory application or device vendor supports it. ⁸ Ask the machine/OEM vendor to approve the agent and configuration before production deployment.

A good starting point is a small pilot on one noncritical or replicated machine, followed by a staged rollout. The best choice depends on the OS versions, equipment vendors, and whether the computers run HMIs, engineering tools, or general-purpose applications.