So-called dark fabs — factories capable of operating with minimal human intervention thanks to artificial intelligence, robotics, and autonomous systems — are moving beyond the realm of futuristic ideas. In the semiconductor industry, where robots, automated material handling systems, AI-based inspection, digital twins, and connected operational technology already coexist, the next challenge isn’t just automating more. It’s also preventing a compromised identity, tampered data, or a vulnerable device from making decisions inside an almost fully autonomous plant.
Dark fab cybersecurity in 30 seconds
- Semiconductor factories are moving from automation toward systems that can sense, decide, and act with less human intervention.
- SEMICON Taiwan 2026 put Zero Trust, OT security, and data protection among the priorities of smart manufacturing.
- Hiroshi Esaki, of the University of Tokyo, argues for extending Zero Trust from IT into operational technology.
- NIST warns that closer IT-OT connectivity widens the attack surface and can affect production, physical safety, and continuity.
- In an autonomous factory, trust also has to be verified between machines, applications, data, and AI agents.
The issue gained prominence during SEMICON Taiwan 2026, held September 2-4 in Taipei. This year the trade show debuted its Smart Fab Zone, dedicated specifically to the evolution of semiconductor factories from traditional automation toward intelligent systems capable of sensing their environment, making decisions, and coordinating processes.
SEMI lists collaborative robots, humanoid robots, automated material handling systems (AMHS), AI-based inspection, the Industrial Internet of Things (IIoT), virtual metrology, and digital twins among the technologies accelerating this shift.
A factory can produce more data and make more decisions without workers present. But that also means a malicious command can spread much faster before anyone detects it.
A dark fab can’t automatically trust its own machines
The term lights-out factory describes a facility able to produce with little to no continuous human presence.
Siemens explains that this model is already viable for certain repetitive processes, and that operations management software can coordinate fully automated lines while human operators supervise them remotely. For more complex products, it’s more common to talk about lights-sparse factories, where only certain zones operate autonomously.
The semiconductor industry brings together many of the right conditions to move toward that model.
A modern plant has thousands of sensors, process equipment, robots, controllers, inspection systems, servers, management applications, and industrial networks. AI now adds systems capable of interpreting all that data and modifying parameters without necessarily waiting for a human order.
That changes the logic of cybersecurity.
In a conventional factory, an attacker who compromises an account might try to reach a server. In a highly autonomous facility, a compromised identity could potentially interact with systems that control physical movements, production parameters, manufacturing recipes, or inspection processes.
That’s why the traditional model of trusting whatever sits inside the network loses its usefulness.
Zero Trust starts from precisely the opposite idea: no identity, device, application, or connection should be considered trustworthy simply because it’s inside a given perimeter.
Every access has to be authenticated, authorized, and limited according to context.
In an autonomous factory, this principle has to extend far beyond the employee logging in.
It also applies to a robot requesting information from another system, an industrial tool downloading an update, a cloud service querying telemetry, a digital twin receiving production data, or an AI agent that wants to modify a configuration.
From Zero Trust for IT to Zero Trust for OT
One of the debates at SEMICON Taiwan 2026 centered precisely on this transition.
Hiroshi Esaki, a professor at the University of Tokyo and one of the speakers at the Semiconductor Cybersecurity Global Summit, proposed an AI-native cybersecurity model applicable to both IT and operational technology (OT).
His talk explicitly covered the use of Zero Trust to eliminate silos, certification of cybersecurity measures, and the arrival of physical AI and autonomous agents.
Esaki also noted that Japan began developing cybersecurity measures specific to the semiconductor industry in 2024, extending a strategy previously applied to other industrial facilities.
That approach covers several levels: products and services, factories and labs, entire organizations, and finally the supply chains that cross borders.
That’s not a minor distinction.
Semiconductor plants depend on a huge number of suppliers. Industrial equipment, remote maintenance, software, firmware, cloud services, and analytics tools can come from different organizations.
Zero Trust applied only to a company’s own employees leaves out a significant part of that attack surface.
Data becomes another critical security component
Autonomous manufacturing also introduces a risk different from classic data theft: the silent manipulation of data.
An AI system can only make good decisions if it works with reliable information.
If an attacker alters sensors, inspection results, calibration parameters, or data used by a digital twin, it may not even be necessary to directly compromise a machine’s controller.
It can be enough to make the autonomous system make a bad decision on its own.
This kind of attack is especially tricky because it doesn’t always cause an immediate stoppage.
A manipulation can introduce small deviations in the process, gradually degrade production performance, or alter quality controls without triggering an obvious alarm.
That’s why concepts like trusted data, verifiable data provenance, cryptographic integrity, and machine-to-machine identity control matter more as autonomy increases.
NIST has been warning about this problem for some time. Its work on industrial control system integrity notes that the growing connection between information technology and OT systems brings production advantages, but also creates opportunities for attackers to compromise both the systems and the data a plant relies on.
In July 2026, the U.S. agency also published a report on digital twins for manufacturing that identifies cybersecurity, interoperability, and model verification among the challenges that still need to be solved to reliably scale this technology.
Knowing what equipment exists is essential to applying Zero Trust
Another problem shows up even before artificial intelligence enters the conversation.
A company can’t control access for a device it doesn’t even know exists.
In June 2026, NIST’s National Cybersecurity Center of Excellence (NCCoE) launched a new project focused on OT asset management and visibility.
The agency considers asset inventory a necessary foundation for applying risk assessment, network segmentation, vulnerability management, incident response, and Zero Trust architectures.
The situation is especially complex in factories that mix modern equipment with industrial machinery designed to last decades.
An enterprise server might get upgraded every few years. A semiconductor manufacturing tool can keep running for far longer and use operating systems, protocols, or components that aren’t easy to replace.
Nor can an IT security tool always be applied directly to OT.
NIST notes that even certain routine vulnerability scanning techniques can cause problems in industrial systems if they generate unexpected traffic or introduce delays in time-sensitive communications.
Zero Trust in manufacturing therefore has to adapt to physical processes.
The incident no longer ends once the attacker is kicked out
Automation is also forcing a rethink of recovery.
NIST published the initial draft of SP 1800-41, Responding to and Recovering from a Cyber Attack: Cybersecurity for the Manufacturing Sector in May 2026.
The document starts from a simple reality: even a solid defense-in-depth architecture doesn’t eliminate every risk.
That’s why companies need to know how to restore a facility after an incident.
In IT, restoring data or rebuilding servers can be enough in certain scenarios. In a factory, there’s also a physical state that has to be recovered.
Machines, robots, materials, and processes may have been left in different positions when the incident occurred.
Turning everything back on without first verifying that state can introduce new problems.
Recovering a dark fab will therefore need to combine backups, known-good configurations, identities, asset information, and knowledge of the plant’s actual state.
And the more autonomous the facility, the more important it becomes to be able to do that without blindly trusting the very systems that were compromised.
Cybersecurity is becoming part of semiconductor equipment itself
Taiwan is trying to bring these principles directly to market.
The Semiconductor Cybersecurity Pavilion at SEMICON Taiwan 2026 focused this year on industrial systems security, detection and response, risk management, Zero Trust, endpoint security, and managed services.
Taiwan’s Administration for Digital Industries also presented solutions at the show based on Zero Trust, identity management, threat detection, and compliance with the SEMI E187 standard, aimed at strengthening the cybersecurity of semiconductor manufacturing equipment.
Alongside those come hardware security technologies, roots of trust, and post-quantum cryptography.
This trend suggests security is starting to be treated as a feature of the industrial equipment itself, not just a layer bolted on afterward by the IT department.
That makes sense.
An autonomous factory can’t depend on an operator visually noticing that something strange is happening on a machine on the other side of the plant.
It needs to be able to continuously verify who is requesting an action, from what device, with what permissions, on what asset, and using what data.
Dark fabs could end up being one of the most advanced expressions of AI-driven manufacturing.
They could also become one of the environments where a single lapse in trust has the most immediate consequences.
Turning off the lights is relatively easy.
The hard part will be making sure that, once no one is continuously watching the machines, those machines don’t automatically trust each other either.
Frequently Asked Questions
What is a dark fab?
It’s a highly automated factory capable of operating with minimal human presence, or even none continuously in certain areas. Robots, sensors, and software coordinate much of the process, and operators can supervise it remotely.
Why does an autonomous factory need Zero Trust?
Because OT systems, robots, applications, devices, and external services exchange information and execute actions automatically. Zero Trust requires verifying identities and permissions at every interaction instead of assuming something is safe just because it’s inside the industrial network.
What risks does AI introduce into a factory?
Beyond traditional attacks, there’s the risk of manipulating the data models use to make decisions. Altered data can cause an autonomous system to incorrectly modify a process without the attacker ever having to directly control the machine.
Does fully autonomous manufacturing already exist?
Factories and production cells with very high levels of automation already exist, though a fully autonomous dark fab becomes harder to achieve as product complexity increases. In semiconductors, the trend points toward growing autonomy driven by AI, robotics, AMHS, automated inspection, and digital twins.
Sources:
- SEMI, SEMICON Taiwan 2026 Highlights AI-Driven Manufacturing Transformation, August 7, 2026.
- SEMICON Taiwan 2026, Semiconductor Cybersecurity Pavilion and Semiconductor Cybersecurity Global Summit, September 2026.
- Hiroshi Esaki, AI-Native Cybersecurity, not only for IT but also for OT, SEMICON Taiwan 2026.