Black Hat USA 2026 and DEF CON 34 brought three threads that matter to manufacturers: the inside story of the December 2025 attack on Poland's energy sector and a manufacturing company (lateral movement into OT through a private APN), weaknesses in industrial protocols and engineering software (CC-Link IE TSN, OPC UA, open62541, Siemens S7), and vulnerabilities in local AI runtimes. We cover what was actually presented and propose a 30-day action list.

The Polish amendment to the National Cybersecurity Act (KSC2), transposing the EU NIS2 Directive, enters real enforcement in the second half of 2026. Factories producing chemicals, food, machinery, automotive, electronics or medical devices — if they employ more than 50 people — are classified as "important entities" and fall under the full obligations package. This article walks through the ten Article 21 NIS2 requirements from an MES perspective: which functions already produce compliance evidence, what is missing, how every external API (OpenAI, cloud LLM, SaaS MES) grows your audit surface, and what to do concretely in the remaining months of 2026.