Facilities Finder

The Best Way to Prospect Manufacturers for OT Cybersecurity Sales

MSPs and OT-cybersecurity vendors often price deals off one plant when the account runs six. Here's how to find every facility before you scope it.

By

The short version

  • You can't scope an OT asset visibility, segmentation, or IEC 62443 engagement without knowing how many plants the account actually runs, and most reps are pricing off the one site they happen to have in their CRM.
  • ZoomInfo, Shodan, BuiltWith, and LinkedIn Sales Navigator are all built around a company or a device, not a facility footprint, so none of them show you the other five plants sitting under the same parent company.
  • The fix: roll up the parent company to surface every plant, filter by headcount and facility type to find the ones worth a segmented deal, and reach each site by a domain-matched contact instead of a guessed title at corporate.

You scoped the deal for one plant. The prospect operates six. That's not a hypothetical for anyone selling into manufacturing OT, it's the default failure mode, because the discovery problem shows up before the network diagram does. Dragos' latest OT Cybersecurity Year in Review counted 3,300 industrial organizations impacted by ransomware in the reporting period, and the same report found 88% of affected organizations struggle with detection and response once an incident hits. Those numbers justify the market size on your slide deck. They don't scope your specific deal. What decides deal size is how many physical plants the account in front of you actually operates, and that's exactly the detail HQ-centric research tools don't carry. A 400-employee production plant and a 12-person distribution outpost can share a parent company name and a single CRM record; only one of them is a segmentation deal, and nothing in a standard company lookup tells you which is which. A Fortune 500 manufacturer with one CRM record and 87 real plants isn't an edge case in this business, it's the norm.

The fix

  • Roll up by parent company (includeSubsidiaries) to see every plant tied to a target's corporate family, not just the address that shows up in a press release or a Google search. Facilities Finder tracks 600,000+ plants, warehouses, and branches across all 50 states, each one geocoded and linked to its parent company, with 25 million employees tied to the specific facility they work at rather than just the company they work for.
  • Filter for accounts above a facility-count threshold (minFacilities) to build a list of manufacturers that already run enough plants to make a multi-site engagement realistic. Every facility record carries 20+ structured fields, built from satellite imagery for building size and location, company websites for products and processes, EPA and state filings, business registries and public records, and professional networks, all cross-checked by AI agents that read each source and resolve it onto one record.
  • Sort by headcount, facility type, and square footage to separate actual production floors, where OT assets live, from the administrative and distribution sites carrying the same parent name. Of the facility types in the database, Manufacturing (182K) and Industrial Services (168K) are where segmentation and asset-visibility work actually gets sold; Office/Administrative (79K) and Retail/Storefront (75K) sites carrying the same parent name usually aren't.
  • Match contacts to each facility by domain overlap, not a guessed title at corporate, so you land on the plant-level IT or operations manager who actually owns that network.

A parent company with 108 plants and one HQ record

Greif, Inc. is a real example of exactly this problem. The company operates 108 facilities across 30 states, manufacturing industrial packaging and related products. Look it up in a generic B2B database and you get one headquarters record with a handful of C-suite contacts: CEO, CFO, COO, CIO, CHRO, CMO. None of them run an individual plant, and none of them can tell you which of the 108 sites has the segmentation gap or the asset-visibility problem you're selling a fix for.

Facilities Finder shows all 108, each with its own building size, products, and on-site contacts. That's the practical difference between pricing an OT security engagement off one address and pricing it off the actual footprint: 108 separate attack surfaces, 108 separate buying conversations, and a parent-company rollup that tells you which of them are big enough to matter before you write the proposal.

The mechanics carry over directly to how you'd work an account like this. Facility search filters by territory, facility type, square footage, and headcount narrow 108 sites down to the dozen that look like real OT deals. The parent/subsidiary rollup surfaces every sister site under one search instead of a single HQ address. AI search in plain English, something like "packaging manufacturers with 100+ employees in Ohio," replaces manually cross-referencing a dozen individual lookups. And the people tab shows every employee at a specific site, searchable by role with verified contact info, so you find the plant IT manager instead of guessing at a corporate title that doesn't own the network you're proposing to segment.

The account you're pricing as one site is very often several. Roll up the parent company, filter for the plants big enough to matter, and reach the person who runs each one before the prospect corrects you. See ZoomInfo vs. Facilities Finder for how facility-level data compares to headquarters-only providers generally.