ERP and MES platforms sit at the center of modern manufacturing operations, connecting business processes with production, inventory, supply chain, quality, and shop-floor activities. A weakness in either environment can therefore extend beyond a compromised application and affect sensitive business data, production workflows, or connected operational systems. Yet standard application penetration testing may not always examine the integrations, privileged workflows, and manufacturing-specific attack paths that make these platforms unique.
This guide examines seven critical areas in ERP and MES penetration testing: ERP business logic and transaction workflows, MES production workflows, role-based access and privilege boundaries, ERP-MES APIs and system integrations, sensitive manufacturing and business data, remote and third-party access, and IT/OT attack paths. The goal is to help manufacturing security teams understand what a more complete ERP and MES penetration testing scope should validate.
Also Read: AI-Powered OT Penetration Testing: What's Changing for Manufacturers
Understanding ERP and MES in Manufacturing
ERP and MES systems serve different functions, but modern manufacturing environments often depend on both to keep business and production processes connected. Understanding where each system fits helps identify why their security testing needs to go beyond a standard enterprise application assessment.
ERP may provide business-level information such as orders, materials, or production requirements to MES, while MES can send production status, quantities, quality information, and other operational data back to ERP. These integrations create additional interfaces, accounts, APIs, data flows, and trust relationships that can expand the attack surface.
For penetration testing, this means security teams should assess not only the ERP and MES applications individually, but also how they communicate with each other and with connected production environments.
7 Critical Areas Most Pen Tests Skip
While basic vulnerabilities can be found with a standard penetration test, industrial environments frequently call for a closer examination of how ERP and MES systems support business and production workflows. When testing concentrates solely on traditional application vulnerabilities, the following seven areas can uncover flaws that can go unnoticed.
1. ERP Business Logic and Transaction Workflows
ERP security testing should examine whether users can manipulate business processes beyond their assigned responsibilities. This includes testing approval workflows, transaction controls, order processing, procurement functions, financial transactions, and segregation-of-duties controls for unauthorized actions or workflow bypasses.
2. MES Production Workflows
MES testing should go beyond identifying technical vulnerabilities and examine whether production workflows can be manipulated. Testing can assess whether unauthorized users can modify work orders, production information, material records, quality data, production status, or other manufacturing functions beyond their intended permissions. Before testing production-related functions, define the scope, testing window, approval requirements, and rollback conditions, and test a copy or non-production environment first where feasible.
3. Authentication, Authorization and Privilege Boundaries
ERP and MES environments often contain multiple user roles, including administrators, operators, engineers, managers, suppliers, and other business users. Penetration testing should assess authentication and authorization controls to determine whether each role can access only the systems, functions, and data appropriate to its responsibilities and whether privilege escalation or horizontal access is possible. Testing should also examine MFA, session handling, and service-account credentials where applicable.
4. ERP-MES APIs and System Integrations
The connections between ERP and MES can introduce additional attack surfaces. Testing should assess APIs and integration points for authentication and authorization of weaknesses, insufficient input validation, excessive data exposure, insecure service accounts, and the ability to trigger unauthorized actions across connected systems.
5. Sensitive Manufacturing and Business Data
ERP and MES systems can contain valuable information spanning both business and manufacturing operations. Testing should determine whether unauthorized users can access production data, inventory information, supplier or customer records, manufacturing configurations, quality information, credentials, or other sensitive business data.
6. Remote and Third-Party Access
Remote connections can provide legitimate users, vendors, integrators, and service providers with access to ERP and MES environments, and some of these connections may terminate inside the manufacturing network. Testing should evaluate VPNs, remote administration tools, vendor connections, privileged accounts, and service accounts to determine whether access is appropriately restricted and whether compromised credentials could provide broader access. The assessment should also identify which security controls defend each transition from remote or third-party access toward MES or connected OT environments.
7. IT/OT Attack Paths
ERP and MES systems can sit between enterprise business processes and manufacturing operations, making their connections important to assess. Testing should determine whether compromising an ERP, MES, integration layer, or connected enterprise system could create an unauthorized pathway toward more sensitive manufacturing or OT environments.
Also Read: SSO Penetration Testing: What Happens When the Identity Provider Is Compromised?
ERP vs. MES Penetration Testing: What Changes?
Although the systems serve diverse functions, users, data, and operational procedures, ERP and MES penetration testing share fundamental security concepts. The following table illustrates how the testing focus varies between factory execution environments and enterprise business systems.
| Area | ERP Penetration Testing | MES Penetration Testing |
|---|---|---|
| Primary Focus | Enterprise processes and business data | Manufacturing processes and production data |
| Key Users | Finance, HR, procurement, supply chain, management | Operators, engineers, production teams |
| Main Testing Areas | Business logic, access control, transactions, workflows | Production workflows, access control, work orders, manufacturing functions |
| Integrations | APIs, databases, MES connections, finance, CRM, HR, supply chain, and third-party business systems | ERP, APIs, databases, production systems, equipment, and OT/ICS-related systems |
| Key Concern | Data confidentiality, transaction integrity, business-process abuse, and availability | Production integrity, operational continuity, unauthorized manufacturing actions, and availability |
| Typical Attack Paths | External Access → Compromised Account → ERP → Integration/API → MES → Connected OT | External Access → Compromised Account → ERP → Integration/API → MES → Connected OT |
| Testing Considerations | Business operations and data sensitivity | Production operations, system availability, and manufacturing dependencies |
The distinction matters: MES testing must consider whether vulnerabilities could impact manufacturing workflows and related operational settings, whereas ERP testing focuses on whether attackers can alter business processes and enterprise data.
How ERP and MES Attack Paths Can Develop
The system where the first vulnerability was found is not always the only place where an ERP or MES compromise occurs. Manufacturing environments and enterprise applications can be connected through trusted network relationships, connected accounts, APIs, and integrations. A mapped attack path does not automatically mean the path is exploitable. Testing should determine whether the required conditions, access, permissions, and controls allow the path to be used in practice.
How to Prioritize ERP and MES Penetration Testing Findings
Not every finding from an ERP or MES penetration test represents the same level of risk. Instead of relying only on a technical severity score, manufacturing teams should prioritize findings based on exploitability, asset criticality, privilege level, production impact, attack paths, data sensitivity, and existing controls.
Key Factors to Consider
- Exploitability: Prioritize vulnerabilities that can be realistically exploited based on the access, conditions, and technical complexity required.
- Asset Criticality: Give greater priority to findings affecting critical ERP, MES, integration, or manufacturing systems and the business processes they support.
- Privilege Level: Give increased attention to findings that enable administrative or privileged access, especially when those privileges can provide access to additional systems or functions.
- Production Impact: For MES findings, assess whether exploitation could affect production workflows, work orders, quality information, manufacturing operations, or system availability.
- Attack Paths: Elevate findings that can be combined with other weaknesses to create a pathway from external or enterprise systems toward sensitive manufacturing or OT environments.
- Data Sensitivity: Prioritize unauthorized access to credentials, production information, manufacturing configurations, supplier data, customer information, and other sensitive records.
- Existing Controls: Consider whether segmentation, MFA, authorization controls, monitoring, or other compensating controls reduce the practical risk of the finding.
| Priority | Typical Characteristics | Recommended Action |
|---|---|---|
| Critical | Exploitable weakness with privileged access, sensitive data exposure, or a credible path toward critical manufacturing environments | Immediate containment and remediation planning; begin corrective action within 24 hours where feasible. |
| High | Significant unauthorized access, business-process manipulation, or exposure affecting important ERP/MES systems | Remediate within 30 days or the next approved maintenance window, whichever is appropriate. |
| Medium | Limited access or impact, but could become significant when combined with other weaknesses | Remediate within 90 days or the next planned security cycle. |
| Low | Limited exploitability, exposure, or business impact | Address within the planned security cycle based on risk and available resources. |
Moving Ahead
ERP and MES penetration testing should look beyond conventional vulnerabilities to examine business logic, production workflows, access controls, integrations, sensitive data, remote access, and potential IT/OT attack paths. Testing these areas helps manufacturers understand how weaknesses could affect both enterprise operations and production environments. A well-scoped assessment also makes remediation more focused by connecting technical findings with real business and manufacturing risk. Use the ERP & MES Penetration Testing Scope & Risk Assessment Checklist to review whether your current testing coverage leaves any critical areas unassessed.
