Warehouse OT Security in 2027: The Attack Surface Nobody's Watching

Last fall, a friend who sells warehouse software came to tour my facility. On his way out he asked, casually, "So how do you guys handle OT security here?"

I froze for three seconds. "OT? You mean overtime? Yeah, we do plenty of that."

He laughed. "Operational Technology."

I wanted to sink through the floor. Turns out my little 3,000-square-meter warehouse has been surrounded by OT for years — the PLC cabinet running the conveyor, the aging server that dispatches our scanners, the row of cameras by the dock doors, the two AMRs we bought last year. I just never knew it had a name. And by 2027, the number of connected "iron boxes" in warehouses like mine will only grow. So today, let's talk about where the attack surface actually is — and how a small warehouse that can't afford the fancy stuff is supposed to survive.

Two true stories that scared me straight

The first one is from June 27, 2017. NotPetya broke out, and Maersk — one of the world's largest container shipping companies — watched 45,000 PCs and 4,000 servers get wiped in a matter of minutes. The malware took down terminal operating systems across 76 ports. The entire company fell back to paper: bookings by phone, yard work by handwritten slips, and global teams spent weeks reinstalling machines one by one. Public reports put the direct loss at $200–300 million.

Think about that. It wasn't stolen trade secrets that hurt. It was "the systems don't work anymore," so business stopped. For a warehouse, that's ten times scarier than a data leak — your inventory is still sitting on the racks, but with the WCS dead, nobody knows where anything is or which order ships next.

The second story is much more recent. In June 2025, the American food distributor UNFI detected unauthorized activity on its systems and took its core systems offline to contain the breach. The result: distribution disrupted for more than 30,000 retail locations, empty shelves even at Whole Foods. Industry media estimated the incident would cut $350–400 million from UNFI's 2025 sales, with $65–75 million in extra pretax costs.

UNFI is a giant, and it still got hit. Then in July 2024, a botched global software update froze logistics networks in multiple places — no hackers involved at all. That tells you everything about how dependent modern warehouses have become: we're long past the era when you could just unplug the network and keep working.

Let me inventory our attack surface — all of it

After my friend left, I spent one afternoon counting every single thing in my warehouse that has electricity and a network cable. I wish I hadn't:

1. Cameras: 16 of them. The installer left every single one on the factory default — admin/admin — and 4 were exposed to the public internet so "the boss can check from his phone." In theory, anyone on earth who can scan ports could watch my warehouse feed.
2. The WCS dispatch server: an 8-year-old Windows box, patches three years out of date, because "if we update it, the dispatch software might break." Both AMRs take orders from it. If it dies, the two little robots become very expensive paperweights on the spot.
3. The conveyor PLC: connected through a cheap serial-to-Ethernet converter, password still the factory default. Once an attacker is inside the network, this thing is an open back door.
4. Router and fiber modem: installed by the ISP, management password never changed — still the one printed on the installation sheet.
5. Scanners and label printers: plugged into the office network switch for convenience. If the accounting PC catches something, none of them escape.
6. Cloud WMS accounts: two former employees who quit last year can still log in. I simply forgot to delete them.

My friend listened to my inventory and said, deadpan: "This isn't a warehouse. It's a sieve." He wasn't wrong — but at least now I know exactly where the holes are. And looking toward 2027, with cheaper AMRs, vision cameras, and 5G gateways all joining the network, the holes will only multiply. Ransomware gangs figured this out long ago: encrypt 10 office PCs and you'll grit your teeth and reinstall; lock down one conveyor line and the whole warehouse stops. Stopping OT hurts way more than stopping IT.

The math: enterprise solutions are not for us, so here's the small-warehouse version

My friend showed me an enterprise OT security package: zero-trust architecture, a 24/7 security operations center, red-team exercises twice a year. I closed the quote after one glance — one year of that would cover several years of my warehouse rent. We small warehouses can't burn that kind of money.

So I built the dollar-store version myself, over one weekend. Here's the comparison:

Total: under $100 and one weekend of my time. Did it work? Early this year, an office PC got hit by a phishing email and ransomware. Accounting was in tears. But the equipment network had been isolated long before, so the WCS server, the AMRs, and the cameras were untouched. We spent half a day reinstalling that one office PC, and warehouse operations never stopped for a minute.

A counter-intuitive take: small warehouses actually have it easier

That sounds like cope, but two years of thinking about it convinced me it's true. Enterprises struggle with OT security because they're too big to even inventory — hundreds of thousands of connected devices, nobody can produce an accurate asset list, patch status is guesswork. My warehouse? Twenty-some connected devices. I counted them all in one afternoon, threw them in a spreadsheet, changed the passwords that needed changing, isolated what needed isolating.

The real trade-off for a small warehouse was never "security versus insecurity." It's "security versus convenience." After the split, our veteran tech grumbled about hopping networks to tune the PLC — so I ran one wired line to the maintenance room reaching both subnets. My fix: make the inconvenience the equipment's problem, not the person's. I ran one wired line to the maintenance room that can reach both subnets. Security intact, veteran happy. Remember this: any "security measure" that makes life harder for the floor crew will eventually get bypassed by the floor crew — and that's when you're truly insecure.

Advice for fellow small-warehouse owners

1. Inventory before you spend. Take one afternoon and list every connected device: what it is, where it is, whether the password was changed, which network it's on. The list itself is half the security.
2. Default passwords are the root of all evil. Cameras, routers, PLC gateways, printers — change the factory password on day one. Attackers scan for exactly these.
3. Separate the office network from the equipment network. Highest ROI move there is. One secondhand router does the job. An infected accounting PC must never take down the conveyor.
4. Keep backups offline. Copy the WCS configs and data to an external drive weekly — and unplug it when done. Ransomware can't reach a hard drive sitting in a drawer.
5. Delete ex-employee accounts the same day. Put it in the checklist; don't rely on memory.
6. Don't believe "we're too small to be targeted." Most attacks today are automated scans — they walk in wherever there's a vulnerability, regardless of your square footage. If giants like UNFI get hit, small warehouses get no exemption.

Looking toward 2027, my prediction is simple: OT attacks on warehouses will grow, not shrink. AMRs keep getting cheaper — small warehouses will buy them too. Vision cameras, smart tags, 5G gateways, one after another onto the network. The good news? The defense logic never changes: inventory, change passwords, segment, back up. Those four moves will still work in 2027. The big companies have their SOCs and zero trust; we have our spreadsheets and secondhand routers. Different playbooks, same goal: never let one infected office PC take down the entire warehouse.

Small warehouses have their own way of surviving: spend money where it counts, and in security, it's not about whose solution costs more — it's about whose sieve has fewer holes.

By Xiao Ma, Small Warehouse Owner