The manufacturing industry has been one of the most targeted sectors of cyber criminals worldwide for several years. If a heavy industry company does not want to become a victim, it must be able to protect its sensitive data and industrial IT systems. Sacrifices must be made for different levels of IT protection, firewalls, log collection and analysis systems, endpoint protection, but physical security has to be increased as well. Most of these are now available as services, so a customized solution can be easily compiled according to the level of security and financial possibilities to be achieved. To find the best defence and ensure the right combination of people, process and technology, the preparation of a preliminary risk analysis is essential. For the effective realization, it is crucial to develop implementation plans and decision support tools that help owners, operators, and the vendor community asses when and how to apply cyber informed engineering in current infrastructure and technology offerings. In this paper we give an insight into the situation of an old-type steel mill company where the IT system is insufficient, or outdated, or the IT solutions implemented in technological equipment are not necessarily compatible with each other. We highlight the impact of such “semi-automated” character on cybersecurity solutions and production efficiency.