Manufacturing cybersecurity from threat to action: a taxonomy-guided decision support framework

An attack taxonomy is essential for defending manufacturing systems against cyber-physical threats by enabling systematic understanding and classification of threat attributes. However, existing taxonomies typically focus on a limited set of attributes and fail to comprehensively integrate threat actors, system-level and operational impacts, and potential countermeasures within a unified framework. Additionally, converting taxonomy-based knowledge into actionable guidance for cybersecurity tool development and decision-making remains challenging and understudied. To address these gaps, this study introduces a comprehensive attack-countermeasure taxonomy along with a taxonomy-guided decision-support framework, providing an end-to-end approach from threat identification to mitigation in manufacturing systems. Specifically, the proposed taxonomy classifies threat actors and their intent, system behavioral deviations during threat events, attack methods, and attack targets and incorporates both operational and system-level impacts. Furthermore, a structured classification of countermeasures is integrated within the taxonomy, supported by illustrative examples of potential countermeasures. Unlike previous taxonomies, this model captures the entire attack chain—from adversarial intent to observable system deviations and corresponding countermeasures. The taxonomy’s practical implementation is demonstrated using realistic attack scenarios, real-world incidents, and relevant academic case studies. Building upon this foundation, the proposed taxonomy-guided decision-support framework shows explicitly how each taxonomy layer helps guide threat identification, risk modeling and assessment, and appropriate countermeasure selection and deployment. Moreover, the framework highlights how the taxonomy complements existing cybersecurity tools, frameworks, and methodologies to facilitate context-aware and risk-informed security decisions in smart manufacturing environments.