Sector: critical infrastructure and OT
For the systems a country can't switch off.
Energy, water, transport, health and digital infrastructure operators. Under NIS2 and the NCSC CAF, with IT and OT converging and the room for error narrowing.
On a plant floor, the priorities are inverted.
In IT, confidentiality tends to lead. In OT, availability and safety come first: a process has to keep running, and it has to run safely. A control that’s routine in a corporate environment, an aggressive patch cycle or an active vulnerability scan, can trip a controller or halt a line on the plant floor.
Much of the estate is long-lived by design. Kit installed fifteen or twenty years ago wasn’t built to be rebooted on a Tuesday, and often can’t simply be patched. So the honest job is segmentation, monitoring and disciplined change (IEC 62443 zones and conduits, a pragmatic reading of the Purdue model), not bolting corporate IT tooling onto a substation and calling it hardened.
The measure of resilience is a service that stays on.
Where the pressure shows
- Flat networks where the corporate IT and the OT environments share the same wire, with little between them.
- Remote-access paths from vendors and integrators that nobody has fully mapped.
- A NIS2 or CAF assessment on the horizon, and thin evidence to put in front of it.
- Safety and security owned by different teams who rarely sit in the same room.
- Legacy systems that still run the process, and that no one wants to be the one to touch.
How we help
Clean IT/OT boundaries designed to IEC 62443 zones and conduits, with segmentation and monitoring that suit the process rather than fight it.
TransformationNIS2 and CAF readiness delivered as operating change: new ways of working that hold up under assessment, not a folder of policies.
Board and NED advisoryThe accountability that now sits with the boards and directors of operators of essential services, translated into decisions they can own.