Fortunately, outright sabotage is rare these days (but it does happen). A more insidious source of equipment damage is unintentional sabotage through wrong operator practices. Sometimes, operator error is a glaringly obvious cause.
A new plant manager decided to “save money” on annealing furnace operations by replacing $12/hr trained operators with $6/hr entry level operators, since the job mostly involved sitting and watching. The furnace had run problem-free for years. After the change, downtime incidents occurred almost daily.
Other times, it’s not so obvious because the operators were never trained to begin with. The maintenance tech, harangued by a production manager who’s upset over the apparent incompetence of maintenance, is just glad to get out of there when the repair is done. The production manager complains to the plant engineer that “maintenance can’t keep this equipment running” so the plant engineer sends maintenance people to training.
If the failure cause cannot be clearly and cleanly attributed to an exact technical problem then you should suspect operator error as at least a contributing cause. Use the same tools you’d use for discovering saboteurs (e.g., cameras and timing correlations).