Marc Engel, CEO, Agileo Automation

New Cybersecurity Challenges for Fab Equipment Manufacturers in 2025

With increased tool and system connectivity, the risk of cyber threats has never been higher. As GEM300 standards get deployed for wafer sizes smaller than 300mm, cybersecurity will become a critical focus for semiconductor fabs and equipment manufacturers in 2025.

Historically, GEM300 was predominantly associated with 300mm tools, but its relevance is now expanding across retrofitted fabs, those introducing automated guided vehicles (AGV) and overhead hoist transport (OHT) systems for wafer delivery, as well as 200mm greenfield wafer fabs prioritizing state-of-the-art automation. A crucial requirement – E84 (automated material hand-off) in combination with E87 (carrier management), a key part of the GEM300 suite – is becoming necessary, even in fabs handling smaller wafers.

Semiconductor manufacturing facilities are advised to implement more tailored security measures to protect their intellectual property, production data, and operational continuity within the Cybersecurity Framework 2.0 with the help of SEMI's Semiconductor Manufacturing Cybersecurity Consortium (SMCC) and the National Institute of Standards and Technology (NIST).

The Cyber Resilience Act (CRA) also helps manufacturing companies evaluate and mitigate outdated operating systems and unpatched software risks. Fabs will need to prioritize regular updates to ensure compliance with industry standards and avoid potential disruptions caused by security breaches.

In 2025, the convergence of expanded GEM300 standard usage and enhanced cybersecurity measures will be pivotal for enabling fabs and equipment manufacturers to achieve both operational efficiency and security in an increasingly automated and interconnected landscape.