Cybersecurity in the food & beverage industry: the hidden risk of legacy IT
Still working doesn’t mean secure.
Why UK food manufacturers must rethink ageing ERP systems, test recovery and protect production
There is something slightly ridiculous about the relationship we have with technology.
Personally, many of us upgrade our phones every few years. We expect our banking apps to be current. We wouldn’t tolerate a laptop that took ten minutes to start, and the idea of swapping a modern smartphone for a Nokia 3310 would probably be greeted with some combination of amusement and horror.
Yet walk into parts of British industry and the technology supporting businesses worth hundreds of millions of pounds can sometimes feel remarkably similar to that Nokia.
It works. Everybody knows how to use it. Nobody particularly wants to touch it. And somebody will usually tell you that replacing it is too expensive.
In the UK food industry, I think we need to start questioning that logic rather more seriously. Because the latest warning from the National Cyber Security Centre isn’t really a warning about AI. It is a warning about what happens when modern attackers meet ageing technology. And for organisations responsible for putting food onto Britain’s supermarket shelves, that should make boards sit up and take notice.
For UK food and beverage manufacturers, cyber security is a business continuity issue, not just an IT concern. Food manufacturing ERP systems support everything from production planning and inventory management to batch traceability and customer fulfilment. Understanding the legacy technology behind those processes is an essential starting point for protecting food supply chain resilience
It works. Everybody knows how to use it.
Nobody particularly wants to touch it. And somebody will usually tell you that replacing it is too expensive.
In the UK food industry, I think we need to start questioning that logic rather more seriously. Because the latest warning from the National Cyber Security Centre isn’t really a warning about AI. It is a warning about what happens when modern attackers meet ageing technology. And for organisations responsible for putting food onto Britain’s supermarket shelves, that should make boards sit up and take notice.
For UK food and beverage manufacturers, cyber security is a business continuity issue, not just an IT concern. Food manufacturing ERP systems support everything from production planning and inventory management to batch traceability and customer fulfilment. Understanding the legacy technology behind those processes is an essential starting point for protecting food supply chain resilience
Cyber-attack readiness for UK food manufacturers
Reporting on the National Cyber Security Centre’s latest assessment, Sky News quotes NCSC chief executive Dr Richard Horne warning of an “unprecedented rise” in cyber incidents, arguing that vulnerabilities tolerated for too long can now be discovered and exploited at extraordinary scale.
The uncomfortable message isn’t simply that cyber criminals are becoming more sophisticated. It is that we have spent years giving them an increasingly attractive target. The NCSC says AI use by hostile actors is highly likely to increase the scale and efficiency of activities including ransomware, social engineering and vulnerability exploitation, with AI-powered malware highly likely to feature in ransomware attacks on UK critical national infrastructure by 2028.
Dr Horne describes the historic problem rather neatly as “tech on the cheap”. This phrase will probably resonate with quite a few IT leaders. Because old technology rarely becomes old overnight. A strategic system becomes a legacy system one budget cycle at a time.
“Let’s leave the upgrade until next year. The business has other priorities. It still works. We haven’t had a problem so far.” |
Eventually, an application that was going to be replaced “in a couple of years” goes on to celebrates its fifteenth birthday. And then its twentieth.
Legacy IT risks in the food and beverage industry
When I was IS Director at AB Agri, this was something we recognised very clearly.
When considering ageing business applications, it was tempting to look at the application itself and ask whether it still did the job, such as process orders, plan production and produce an invoice
If the answer was yes, replacing it could look like unnecessary cost. But that misses the bigger risk.
The application sitting on the screen isn’t necessarily where the real vulnerability lies.
Underneath it may sit an operating system that is increasingly difficult or impossible to patch.
Underneath that may sit an ageing database platform.
Around both can sit integrations, interfaces, bespoke code and infrastructure accumulated over many years.
The user sees an application that still works. The organisation may actually be relying upon a technology stack that is becoming steadily harder to secure and recover. It is a little like looking at your Nokia 3310 and saying, “What’s the problem? It still makes calls.”
But this isn’t really the right question anymore. The question is whether the technology beneath your business is supportable, patchable, recoverable and resilient enough for the world in which it now has to operate.
Cyber recovery for food manufacturers: why backups aren’t enough
Backups are essential. But a backup is not the same thing as recoverability. This distinction becomes extraordinarily important after a serious compromise.
If your database environment has been compromised, how confident are you that you have a clean recovery point?
If your operating system hosting the application is obsolete or no longer supported, can you actually rebuild it?
Can you obtain the installation media?
Can you obtain the patches?
Do you still have the necessary licences, configuration information, encryption keys and technical knowledge?
Will the old application install successfully onto anything you can now procure?
And has anybody actually tested all of the above, rather than simply checking that last night’s backup job displayed a reassuring green tick?
There is horrible irony here. A business can spend twenty years religiously changing tapes, checking backup logs, moving copies off-site and congratulating itself on being well protected, only to discover during an actual crisis, it no longer possesses a viable technology environment into which those backups can be restored.
A backup you cannot restore into a clean, supported environment isn’t much of a recovery strategy. It is a collection of historical data accompanied by hope. |
How cyber incidents disrupt food and beverage supply chains
This is where the discussion becomes particularly important for the food & beverage industry.
Imagine a food manufacturer losing access to the systems controlling orders, recipes, production planning, procurement, warehousing, traceability, labelling, despatch and invoicing.
The factory itself might be perfectly operational. The production lines haven’t disappeared. The people still know how to make the product. The ingredients might even be sitting in the warehouse. But can the business confidently decide what to make, demonstrate which batch used which ingredients, print the right labels and even allocate stock to customer orders and dispatch reliably?
A cyber incident that starts in IT can very rapidly become a major operational shutdown. And across an interconnected food supply chain, the consequences don’t necessarily remain inside one company.
This is precisely why the NCSC warning feels so relevant. Dr Horne explicitly raises the prospect of leaders one day having to explain their choices when “food isn’t on shelves”, and businesses have gone under.
Security Minister Dan Jarvis, also quoted by Sky News, says cyber threats are growing more sophisticated and points to government investment including a new National Cyber Shield and an AI Cyber Security Centre of Excellence. But government action cannot remove the technology debt inside an individual manufacturer, distributor or retailer. That responsibility still belongs to the business.
The business case for food manufacturing ERP modernisation
For years, we have tended to justify technology modernisation through efficiency.
Replace an ageing ERP system and perhaps we can automate more processes, improve planning, remove spreadsheets, reduce manual intervention or give management better information. All perfectly reasonable.
But I think the equation is changing. The old question: “What additional ROI will we get from replacing this system has shifted to a more urgent question: “What are consequences if this system becomes unavailable tomorrow and we cannot safely recover it?”
That creates a very different conversation.
An old ERP platform that costs millions to replace can look expensive when compared with another year of maintenance. It can look considerably less expensive when compared with an extended production shutdown, an inability to service supermarket customers, loss of confidence in traceability information, damaged customer relationships and, in the worst case, the viability of the company itself.
The NCSC’s message is that AI is allowing existing weaknesses to be identified and exploited at greater speed and scale. So doing nothing isn’t standing still. The risk around you is changing even if your technology is not.
Building cyber resilience into food manufacturing ERP
Choosing ERP software for food manufacturing should involve more than comparing features. Alongside production planning, procurement, stock control and traceability, food and beverage businesses should ask how the underlying systems will be supported, secured and recovered. A connected operation still needs a credible recovery plan.
Start with the processes your business cannot afford to lose. Can you trace ingredients through production to finished batches? Can you access recipes, manage warehouse stock and fulfil customer orders if a critical system becomes unavailable? Use those questions to prioritise legacy system modernisation, identify dependencies and test recovery against the practical needs of the food and beverage supply chain.
Food industry cybersecurity: making resilience a board priority
Which brings me back to the Nokia picture. On one side, the latest smartphone. On the other, a Nokia 3310. One runs your life. The other, metaphorically at least, may still be running your business.
There is humour in that comparison, but increasingly there is something rather uncomfortable about it too.
Nobody expects every UK food manufacturer to replace every legacy system tomorrow. Most businesses have accumulated technology over decades, and modernisation has to be practical, prioritised and commercially sensible. But every board should understand where its technology equivalent of the Nokia 3310 is hiding.
Not simply which applications are old, but which operating systems are unsupported. Which databases are unpatched. Which integrations nobody understands anymore. Which servers cannot readily be rebuilt. Which critical systems depend upon one person who knows how they work. And, perhaps most importantly, which backups have genuinely been proven through recovery rather than merely backed up.
This isn’t an argument for technology for technology’s sake. It is an argument for treating the technology that feeds the nation with the seriousness we already apply to food safety, product quality, physical assets and continuity of supply.
The NCSC describes this as a moment of choice, warning that decades of underinvestment have left weak technology and operational foundations exposed to a new generation of threats.
For the UK food industry, I think that choice is becoming increasingly stark.
“Still working” and “safe to keep running the business on” are two completely different things. |
Cyber security is no longer simply about protecting IT. It is about protecting production. Protecting customers. Protecting the business. And, ultimately, protecting our ability to keep food on Britain’s shelves.
Perhaps it’s time we gave the Nokia the retirement party it deserves.
Looking at the next step for your food and beverage business? Explore HSO’s ERP solutions for food and beverage manufacturing and how a connected approach can support planning, procurement, production, inventory and finance.