The essentials in 30 seconds
- Protecting intellectual property means stopping drawings, CAD files, bills of materials and recipes from leaving the company without control.
- DLP rules see CAD formats, archives and exports poorly; these failures stay silent.
- Subcontractors and the IT/OT boundary are the blind spots: you put them to the test with synthetic files, then test again.
Protecting intellectual property in manufacturing means stopping drawings, CAD files, bills of materials and manufacturing recipes from leaving the company without control, whether the exit goes through an engineer’s workstation, an exchange with a subcontractor or the boundary between business IT and industrial systems (OT). The only way to know whether your controls hold is to put them to the test: replay exfiltration attempts with synthetic files and check what is blocked, detected or ignored.
Why manufacturing is a target apart
In a bank, sensitive data often sits in a customer database. In manufacturing, it is scattered: a CAD assembly of several hundred files, a CNC program on a shop-floor USB stick, a process routing in the ERP, a specification sent to the mould supplier. Each object has its own value, and its leak can cost years of technological lead.
Three particularities complicate the defence:
- Formats that DLP understands poorly. The native files of CAD software (parts, assemblies, neutral exchange formats such as STEP or IGES) do not contain the text patterns that many rules rely on. An engine tuned to detect card numbers sees nothing in 3D geometry.
- A partner ecosystem open by necessity. Design offices, subcontractors, toolmakers, test laboratories: sharing is the business. Blocking every exchange is not an option.
- Two network worlds that talk to each other badly. Workshops have their own equipment, their supervisory workstations, sometimes remote maintenance access managed by the machine suppliers.
The risk does not only come from external attackers. An engineer leaving for a competitor with a copy of their workspace is a classic scenario, covered in detail in our article on the insider threat and trusted users.
CAD files: the link your rules ignore
Most of the industrial DLP policies we come across rely on two mechanisms: the file extension and classification labels. Both break easily.
What makes detection fail
- An assembly compressed into an archive, possibly encrypted, is no longer recognised by its extension.
- An export in a neutral or mesh format (STL for 3D printing, for example) often loses the label applied to the original file.
- A screenshot or a PDF of a drawing carries the essential information without triggering any rule based on file type.
- Files extracted from the PLM to a local folder leave the scope where classification is enforced.
These failures are silent: the console stays green, no alert comes up. This is exactly the mechanism described in DLP false negatives. And without reliable classification of technical data, the DLP has nothing to rely on, as developed in the article on how DLP depends on classification.
What to aim for
Rather than trying to recognise every format, combine several signals: fingerprinting of files from the PLM, marking at the source, volume and context of the exit (an engineer pushing several gigabytes to personal storage on a Friday evening). Then check that this combination actually works.
Subcontractors: sharing without losing control
The subcontractor legitimately receives drawings. The question is not how to prevent it, but through which channel, what exactly, and what happens if the official channel is bypassed.
| Exchange channel | Main risk | What to check |
|---|---|---|
| Secure exchange portal or supplier PLM | Rights too broad, links that never expire | Scope actually shared, lifetime of access, logging |
| Email with attachment | Sending a complete assembly instead of just the part needed | Outbound rules on technical files, including inside archives |
| Consumer file transfer service | Uncontrolled channel, bypassing a portal deemed too slow | Blocking or detection of uploads from the browser |
| Subcontractor remote access to your systems | Direct copy from your servers | Filtering of outbound transfers on the remote session |
The broader subject of partners is covered in data leakage at third parties and subcontractors.
The IT/OT boundary: a DLP blind spot
Diagram · where technical data gets out
Yet these networks contain intellectual property: CNC programs, process parameters, recipes. And they have exits:
- the upward flows to IT (historian, MES, ERP), which create gateways;
- the remote maintenance access of machine builders;
- the removable media used to load programs onto the machines;
- the “dual use” workstations plugged in sometimes on the shop floor side, sometimes on the office side.
Focus on the exchange zone between the two worlds, the control of outbound flows at this boundary and the use of removable media. Checking network controls is detailed in the article on egress filtering and network DLP.
A concrete scenario: a departure at the end of the month
A methods engineer hands in their resignation. During their last weeks, they still have their access to the PLM and the shop floor. Here is what an active test must be able to answer, with synthetic files that mimic a real assembly:
- Does a bulk extraction from the PLM to their workstation generate an alert, and who receives it?
- Is copying the archive to a personal USB stick blocked or merely logged?
- Is the upload to personal cloud storage from the browser detected?
- Does a message to a personal address, with the file renamed, get through the email filter?
- Is a transfer from a less monitored shop-floor workstation visible?
Each answer is a measured fact, not an assumption drawn from the configuration. If three paths out of five get through without a sound, you know where to put the effort.
Next step
Would a synthetic assembly get out of your design office?
A 30-minute guided demo, on pre-built result sets: the campaign across the 8 channels covered, the report and its detail, nothing to install. The POC then replays one standard scenario with synthetic data, from a representative machine in your network, through your real egress controls. What actually gets out through your egress paths is what the pilot shows you.
What an industrial CISO should check
- Inventory the technical data to protect and its actual locations (PLM, file shares, workstations, shop floor).
- Check that DLP rules cover native and neutral CAD formats and archives.
- Map the exchange channels with each category of subcontractor.
- Identify the gateways between IT and OT, including remote maintenance access.
- Govern removable media on the shop floor side.
- Plan a reinforced monitoring procedure for sensitive departures, together with HR and legal.
- Test every control with synthetic data, then test again after every change.
The last point is the only one that turns a policy into evidence. The general method is described in our page on data exfiltration testing.
Frequently asked questions
Does a standard DLP protect CAD files?
Partially. It can rely on the extension, a label or a fingerprint, but these signals often disappear after compression, an export or a capture. Only a test tells you what is actually covered.
Can exfiltration be tested without exposing real drawings?
Yes, it is even the rule: synthetic files are used that reproduce the structure and markers of the real files, with no industrial value whatsoever.
Should the OT network be included in the tests?
Include the boundary between IT and OT rather than the equipment itself. The tests must have no impact on production and be defined with the shop-floor managers.
How should subcontractors be handled in the approach?
First test your own exits towards them: authorised channels, possible bypasses, volume sent. Checking their own security is a matter of contractual clauses and audits.