Automotive firms face crisis after 24 hours' outage

GitProtect Lab has published research showing that 87% of automotive organisations cannot sustain more than 24 hours of operational downtime. The study also found that 19.5% face an immediate crisis within two hours of an outage.

The findings point to narrow recovery windows across vehicle manufacturing and supply networks, where production delays can quickly spread beyond a single plant.

The report surveyed automotive specialists from a range of operational backgrounds. The largest group of respondents, at 29%, came from automotive software, DevOps, or technology providers, followed by engineering, testing, and design consultancies at 27.5%, mobility, fleet, and logistics operators at 21%, Tier-1 and Tier-2 suppliers at 14%, and original equipment manufacturers at 8.5%.

The research found that 39.5% of respondents said their organisations could withstand only two to 12 hours of downtime before downstream distribution networks begin to break down. Another 28% said they could manage 12 to 24 hours by relying on physical inventory buffers. Only 8.5% said they could tolerate one to three days of minor delays.

Recovery gaps

The study also highlights weaknesses in restoration processes after an incident. Only 23% of organisations said they could fully restore a compromised factory's golden image templates and configuration data in under four hours using automated pipelines.

Nearly half, or 46.5%, said restoration takes between four and 24 hours because recovery workflows remain heavily manual. A further 18% said full data restoration required between two and five days or longer during business continuity testing, while 8% said they had never conducted a full restoration drill for an entire manufacturing facility's operational technology data.

These figures suggest some companies may have continuity plans in place but lack tested procedures to bring critical production systems back online quickly. In factories where software, robotics, and engineering systems are closely linked, recovery speed can determine whether disruption remains local or spreads through broader supply chains.

Network exposure

The research found that 78.5% of automotive organisations operate with flat, dual-homed, or improperly segregated IT and OT networks. That structure can create paths for an attack on corporate systems to move laterally into plant environments.

It also found that 5 in 9 respondents, or 55.5%, considered plant managers only moderately prepared or not prepared at all to maintain assembly line operations if a manufacturing execution system is frozen by ransomware. This points to a combination of technical and operational risk, especially where manual fallback processes are limited.

Automotive groups have become more reliant on connected systems across design, production, logistics, and servicing. Modern manufacturing plants depend on a mix of enterprise IT, industrial controls, engineering data, and supply chain software, making separation between corporate and plant systems an important line of defence.

Backups mixed

Backup arrangements were more varied. The study found that 70.5% of respondents use isolated backup protection strategies.

Within that group, 26% said they isolate critical engineering blueprints and machine configurations in immutable write-once-read-many storage. Another 44.5% said they back up data to independent cloud tenants with multi-factor authentication controls.

Still, 17.5% reported only partial protection. Another 12% said backups remain connected to the primary network or that they do not have a centralised backup system at all.

These results indicate that while many automotive organisations have taken steps to protect recovery data, a notable minority remain exposed if attackers reach production systems and connected backups at the same time. In ransomware incidents, the ability to restore trusted copies of system configurations, design files, and plant data often determines how long operations remain offline.

The report places these risks in a sector where digital dependence is increasing. Vehicle makers and suppliers now manage not only factory equipment but also software development environments, connected vehicle functions, and distributed logistics systems, all of which add to the complexity of recovery planning.

GitProtect Lab's research focuses on cyber threats, DevOps risks, and recovery readiness. In this study, the most striking finding was the short period many automotive organisations said they could endure before an outage becomes a wider operational crisis: less than a day for 87%, and less than two hours for nearly one in five.