Sector · Industry

A formula does not lose value because the process moved to a new server.

Designs, formulas, production processes, and product engineering keep competitive value for decades. At the same time, much of the technology around them is operational: equipment that cannot stop, with a life cycle measured in many years and replacement that depends on the manufacturer.

01Sector profile on the ruler

The comparison available

Cohort

67,121

companies · Critical industry

Sector median

63.1

High

Half the cohort between

59.3 – 72.3

p25 – p75

Standard deviation

9.39

Distribution by band

Critical14.7%
High56.4%
Moderate28.8%

H · time horizon

0.8784

E · observable exposure

0.5524

Cohort medians at the cutoff date. H accounts for the shelf life of the data the cryptography protects; E, for the surface reachable from outside. Both describe the cohort, not your organization.

The industrial cohort is the largest on the operational ruler and occupies a middle position among the sectors with their own page: more exposed than technology, less than government and healthcare. Internal dispersion is meaningful — size, degree of digitalization, and chain integration produce quite different positions within the same sector.

The aggregates describe the cohort at the cutoff date, with an anonymity floor. No company is identifiable in them.

What this comparison is measured against

Cutoff date: July 12, 2026
Run: producao_324k_20260712
Population: 316,911 companies
Sectors: 15 sectors in the engine taxonomy
Anonymity floor: K = 30

Limits of the comparison

The ruler is a static reference base, not a continuous measurement: there is no automatic update between one run and the next.
Comparison is always against anonymous aggregates, never against another organization's individual result.
A public-mode result does not compare to a complete-mode result, because the two readings start from different kinds of evidence.

02What distinguishes the sector

Industry combines durable trade secrets with a rigid operational environment: the technology controlling production has availability constraints that office technology does not, and the decision to replace is rarely the operator's alone.

Trade secrets with long-term competitive value.
Operational technology with continuous availability requirements.
Equipment cycles measured in many years.
Dependency on the manufacturer for any cryptographic change.

03Data shelf life

The relevant horizon here is competitive advantage, not contract term: a production process captured today and decrypted later would still be useful to a competitor if the product is still in production — and industrial products usually are.

Designs, formulas, and product specifications.
Process parameters and production engineering.
Supply contracts and long-term agreements.
Unpublished research and development data.

Typical dependencies

Equipment and control system manufacturers.
Integrators responsible for the operational environment.
A supply chain with direct digital integration.
Connectivity providers between plants and headquarters.

04The sector's HNDL context

Risk here runs on two clocks. Intellectual property, which stays valuable for decades and therefore justifies capture today for later use. And the operational environment, whose cryptographic replacement depends on manufacturer, validation, and scheduled downtime — which makes the remediation timeline structural, not an internal decision.

05What applies

With an operational environment sensitive to interruption, the external readout is what fits — and the manufacturer chain is usually where prioritization pays off most.

Exposure Report

In production

A readout of the public surface, without touching the operational environment.

Third-party assessment

In production

Ranking the manufacturer and integrator chain by exposure.

Sector Benchmark

In production

Position against the industrial cohort, with percentile and band.

The limits of this readout

Collection does not reach isolated operational networks, which is where part of the risk lives.
The assessment is external and does not interact with industrial control systems.
The readout does not estimate cost, timeline, or feasibility of replacing equipment.
Sector medians authorize no conclusion about a specific company.

Other sectors

All sectors

Boundary

Where measurement ends

Adequacy programNot implemented

Measurement ends at: the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries — work carried out by the organization's own teams and suppliers.

This readout delivers

Exposure of the publicly exposed corporate surface.
Priorities across the manufacturer and integrator chain.
Position against the industrial cohort, with a cutoff date.

After the change, GWK

Re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.
States scope, mode, coverage, and run for both measurements, so the difference is interpretable.
Attributes the observed effect only to the scope actually changed and verified.

Not included

Executing the change: GWK does not alter the client's configuration, certificates, or infrastructure.
Deployment, assisted operation, or change management.
An adequacy program: it exists as a GWK engineering project, not as a contractable capability.

Start from the corporate surface

The external readout does not touch the operational environment and already shows corporate and chain exposure — which is where the prioritization decision usually starts.

Discuss an assessment Review the methodology