Energy · Polish private sector

The challenge

The group had security tooling but could not staff it: a three-person team monitored alerts during working hours, leaving most of the week uncovered. The operational technology environment was monitored separately and inconsistently, and the group fell under the NIS2 regime.

What we did

We stood up 24/7 monitoring from Katowice, integrating existing tools instead of replacing them. We focused the first 90 days on tuning rules, extended coverage to the OT boundary with an engineering team, and tested the runbooks in two exercises involving the board.

Results

• Coverage from working hours to continuous, including the OT boundary for the first time
• False-alarm volume about 64 percent lower after tuning
• Three real incidents detected and contained in the first year, all outside working hours
• Regulatory readiness from a documented gap to a documented control

Why it worked

The problem was never tooling; it was coverage, tuning and the ability to evidence both to a regulator.