Security in a small distillery
Oct 9th, 2026 by Jesper Kråkhede
As I wrote at New Year, I am building a small gin distillery. I promised to keep security in it, and I have. Here is what security looks like when the whole IT department is me and three dachshunds.
The production side is OT. The still has sensors for temperature and flow that log the distillation. I keep them on their own network segment, separated from the office network and the guest Wi-Fi that visitors use. The sensors don´t need internet, so they don´t get it. If someone hacks my kettle, they should at least have to work for it.
The business side is cloud. Production records, batches, raw materials and the alcohol accounting live in a model driven app in the cloud. Every account has MFA. There are no shared accounts, not even for the dogs, despite their protests.
The interesting part is the input. The people who work in production aren´t IT people, so the goal is that they can talk to the system instead of typing. An agent asks for what is missing and checks for errors. Which means everything I have written about agents applies to my own distillery: own identity, least privilege, and a human approving anything important.
And then there is compliance. A distillery answers to the tax authority, the food safety authority and the retail monopoly. Every litre of alcohol must be accounted for. Records must be complete, correct and kept for years. Losing them isn´t an IT problem, it is a legal one. So the backups are tested, and the logs can´t be changed afterwards.
The quality control department, all three of them, has approved the security model. Mostly because they were promised treats.
Small business, same principles. Just more juniper.