Manufacturing Security Teams Extend Their Patching Trust Standard To Autonomous Agents

AI agents are being permitted to investigate and act inside production environments faster than most organizations have decided what those agents are allowed to break. Security teams in continuous manufacturing have been settling that question for years. A patch applied at the wrong moment stops a production line, so the authority to apply one gets earned and documented before it is used. The tests those teams run on each other turn out to be the same tests an agent has to pass.

Mario Manzano is IT Manager for Infrastructure, Security and Collaboration at Peco Foods, a fourth-generation family-owned poultry processor headquartered in Tuscaloosa, Alabama, with about 7,500 employees across roughly 20 facilities. He has worked in IT for nearly 30 years and has spent 13 of them at Peco, where he helped lead a recent architecture overhaul. One team handles both the network that keeps the plants running and the security work that takes it offline, so Manzano answers for the uptime his own patches interrupt.

"The same things you need in a team apply to an AI agent. Do you trust the technology? Is there clear accountability, or avoidance of it?" he says. Trust and accountability are what his team spent years building with production, and that record is why the plant lets IT near the floor. Manzano now asks the same two questions before an agent is allowed to make changes on its own.

Layers buy time

Peco uses the Purdue model, which separates an industrial network into layers and restricts what moves between them. Plant floor equipment sits at the bottom, control systems in the middle, business systems on top. A flaw in one layer cannot travel to the floor on its own, so most patches can wait for the right opening.

Finding that opening is easier when a system has a twin. Two devices doing one job means the second can carry traffic while the first is patched, and the line keeps running. Failing that, food plants shut down for cleaning on a regular schedule, and IT does its work during those breaks. When there is no twin and no cleaning break, controls go up around the vulnerable system to limit what can reach it, an approach relied on in settings where equipment cannot be patched. "In the meantime, we have compensating controls in certain cases, or we find a good opportunity to stop, be a surgeon, and get out of there," Manzano says.

Borrowed downtime

Plants go offline for reasons that have nothing to do with security. Equipment gets replaced, utilities schedule maintenance, and the line goes quiet either way. Production and IT now share those dates in advance so patching can ride along. "They let us know we're going to have a transformer change this weekend, or the power company is going to do some maintenance, and we have no choice but to stop. Is there anything you need to do in that time? We can bring a small generator, we can bring some battery backup, and we can do the pending work that's been sitting on the list," he notes.

A shutdown already on the calendar costs production nothing extra to share, and it hands IT hours it would otherwise have to request. Grid power going down does complicate the offer, since the systems IT depends on go down with it, which is why they arrive with portable generators and battery backup.

Those hours are worth more than they were. Food and agriculture organizations absorbed 265 ransomware attacks in 2025, and critical manufacturing recorded more incidents than any other sector. One compromised plant disrupts every customer waiting on what it produces.

Asking before downloading

Employees who need a tool are encouraged to ask for it first, and the security team answers quickly enough that asking stays easier than working around a block. Speed is what makes the policy hold, because a slow answer sends people looking for their own solution. "Trust your users with their job and their responsibilities, but don't entirely trust that they know which tools to pick and what to download," Manzano says.

The behavior it addresses shows up in every industry. "It's usually the human component. People try to do the right thing most of the time, and they want to perform. In their haste, they try to get resources, download a tool, get on a website, and that's when things go sideways," he adds. Treating that as a question about tool selection keeps security inside the workflow, which is how other practitioners describe building a shared responsibility for it.

Upgrades without downtime

Manzano is watching for tools that would remove the scheduling conversation entirely. A network switch shows what that looks like, since it runs constantly and carries email, reporting, and telemetry that keep moving.

The device loads the new software next to the version already running. The old one keeps handling traffic while the system tests whether the new one behaves, and only after it passes does the device switch over to it. "You flip the switch, and the switch never stops. It just keeps going. That carries a lot of value for operations that can't stop," Manzano says.

That prospect shapes what his team buys today. Peco's overhaul added zero trust access controls, which verify every request even when it comes from inside the network, and aligned the program to the NIST Cybersecurity Framework. Products now get judged on whether they pull data from separate systems into one place. "We select things that bring our platforms together, unify our telemetry, and give us the best data and better reports from an overall perspective," he notes.

Agents as teammates

Manzano's advice for teams weighing how much to hand an agent comes from a book about people. The Five Dysfunctions of a Team, Patrick Lencioni's 2002 study of why groups underperform, names five ways a team falls apart. It starts with an absence of trust, which leads to people avoiding disagreement, then to decisions nobody commits to, then to nobody holding anybody accountable. Manzano runs software through that list.

Most organizations are moving faster than the list allows. Agents get added a few at a time, week over week, and the pace outruns any decision about which ones can act alone or who answers when one gets something wrong. Teams building toward governed agentic operations are settling those questions first. "An agent to augment your team is another team member," he says.