Cyber Resilience Initiative

Case Studies

Explore case studies of how our partners apply our insights to improve their processes, and get inspired by success stories of cybersecurity leaders dedicated to strengthening their resilience.

A finger pointing at a glowing node in a network of connected human figures, representing collaborative cybersecurity partnerships.
In 2024, a widespread IT outage disrupted more than 8.5 million devices globally, bringing essential services to a standstill, including healthcare providers, government agencies, financial services and critical infrastructure operators. Minimizing operational downtime and business impact became the top priority, requiring organizations to urgently access threat intelligence, implement remediation strategies and execute a coordinated incident response.The Business Resilience Council (BRC), a non-profit, all-sector collective defence community, quickly activated its resilience framework to facilitate a multiorganization response. With more than 2,000 engaged organizations, the BRC leveraged its network to rapidly analyse, collaborate and implement mitigation efforts:By 03.00 Eastern time (ET), cross-sector analysts in the BRC chat had identified the root cause of the issue.By 09.00 ET, rough solutions had been formulated.By 13.00 ET, more than 150 global organizations had joined a BRC-hosted call to refine mitigation strategies and share intelligence.Within two business days, BRC had hosted a joint ISAC briefing with more than 1,500 participants, providing exclusive, legally protected insights before public disclosures.This coordinated, intelligence-driven response enabled organizations to reduce downtime by: accelerating root-cause analysis and remediation; minimizing uncertainty by sharing real-time, actionable intelligence; enhancing cross-sector collaboration, thus reinforcing collective cyber resilience; and strengthening future mitigation strategies, integrating lessons learned.By fostering pre-established relationships and engaging vendors, suppliers and security teams ahead of incidents, the BRC demonstrated how collective defence can mitigate widespread cyber disruptions. The incident serves as a model for how rapid, coordinated response efforts can enhance organizational and national cyber resilience.
Coordinating the response to a global IT outage
Bangladesh has faced a surge in phishing attacks targeting government agencies, law enforcement and educational institutions. Attackers impersonate official entities using spoofed domains, malicious attachments and fraudulent links to steal credentials and sensitive information. Traditional security measures often focus on reactive threat responses, struggling to keep pace with attackers’ evolving tactics. The challenge lies in shifting from a tool-centric, detection-based approach to an intelligence-driven, proactive security strategy that prioritizes outcomes – minimizing successful attacks and strengthening long-term cyber resilience.The BGD e-GOV CIRT plays a key role in advancing this collaborative, intelligence-driven resilience model through three key elements:Threat identification: Continuous monitoring and investigation of malicious domains, fraudulent email campaigns and attack patterns to uncover evolving phishing tactics.Detection and prevention support: Development of intelligence-driven detection rules to enhance cybersecurity defences.Stakeholder alerts and risk mitigation: Delivery of timely alerts and actionable insights to government agencies and security teams, enabling pre-emptive actions to block phishing attempts.Through cybersecurity threat intelligence and early-warning capabilities, BGD e-GOV CIRT strengthened threat detection, improved incident response coordination and promoted a proactive security culture across critical sectors in the country, contributing to stronger national cyber resilience.
The power of information sharing: Combating phishing attacks in Bangladesh
With a mission to secure the connected enterprise for its customers and its own operations, Rockwell took steps to reduce OT technical debt, address outdated technology, remediated high-risk assets and solidified security controls across its manufacturing ecosystems. Rockwell’s ultimate goal was to become a world-class leader in OT cybersecurity by meeting the very extensive 62443-3-3 set of industrial automation and control systems (IACS) security requirements, following the 62443-2-1 processes and controls. Rockwell’s next goal was to help customers achieve the same results for their own plant operations. Rockwell created a dedicated enterprise OT cybersecurity team focused on securing Rockwell’s manufacturing facilities. After an extensive site analysis, a structured cyber framework was outlined that could continually mature the company’s security posture by following industry standards including IEC 62443. The team achieved the certification goal using their own products, services and partner network and demonstrated to customers that they can help them on their own journey. The creation of Rockwell’s dedicated team and security framework has resulted in a manufacturing programme that instils a continuous improvement culture for maturing cyber security in OT environments resulting in manufacturing that’s resilient, scalable, maintainable, secure and certifiable.
Achieving OT security certification for manufacturing facilities
Rockwell Automation
Schneider Electric’s cybersecurity strategy is multifaceted, covering the cybersecurity posture from IT to OT and from product design through installed base security. This strategy includes robust training and education of all its employees, both connected to and on the shop floor. This companywide, end-to-end, risk-informed approach has significant preventative measures (breach readiness) while being able to respond and recover in case of an incident (breach resilience). Schneider Electric achieves these programmatic objectives with: Employee training and awareness: The company aims to raise employee cybersecurity awareness, provide relevant training and create a culture to empower employees across both IT and OT to act in a secure manner. The training includes an annual baseline awareness course for all employees and role-based trainings for specialized populations including shop-floor personnel. All training is created with people at the centre and used to support a culture of shared ownership of the cybersecurity posture by all employees. An enterprise risk management (ERM) framework: Using a company-wide cyber risk register to categorize risk, the company translates cybersecurity risks into business and operational scenarios and exposure. This exposure is communicated with the C-suite to drive investments in risk-mitigation initiatives. This framework is aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and increases the company’s overall level of cyber resilience.Secure development lifecycle (SDL) management: The SDL journey began over 10 years ago and its mature programme encompasses defined and implemented security requirements, product testing, vulnerability management capabilities and a formal cybersecurity review before release(s). The company’s SDL programme is aligned to IEC 62443-4-1 and externally certified.Incident response capabilities: Schneider Electric is constantly testing and improving its capacity to respond to operational disruption, damage to customers, compliance issues and theft of intellectual property. Its incident response plans are defined and stress-tested routinely to ensure preparedness. A “Security Operations Center” operates 24x7x365 and is staffed with security analysts leveraging security incident and event management (SIEM) capabilities with OT scenario-based playbooks and responders.  The combination of these programmes ensures that cybersecurity risk is not an afterthought but part of the manufacturing management system.
Integrating cyber resilience processes
Schneider Electric
An ecosystem of stakeholder includes customers, suppliers, cross-industry organizations, authorities and national agencies. While all stakeholders are important and intertwined, recently, a focus on collaborating in the areas of supply chain and installed base security represented a unique and impactful output for Schneider Electric. The company’s supply-chain security programme addresses risks stemming from third-party suppliers, by building a holistic approach to value-chain security by implementing security controls at every level (R&D, design, manufacturing, distribution, staging, commissioning and operations). To achieve this objective, Schneider Electric takes both internal and external measures through policies and guidelines as well as external checks with audit and scoring agencies. Going beyond the internal posture by discussing with customers and authorities, it initiates shared responsibility and strives to adopt a common cyber posture. Schneider Electric launched its installed base security initiative in order to reduce OT exposure risks in the customer’s environment by chasing down outstanding vulnerabilities. The resulting OT threat intelligence capability provides its customers with visibility to enriched, contextualized and actionable exposure information to better secure their installations. This effort helps to foster trust with stakeholders within the ecosystem, sharing information in a manner that improves security along the value chain. 
Partnering with the ecosystem to build a more resilient security posture
Schneider Electric
In pursuit of excellence in its digital transformation, Engro faced the challenge of securing its OT-IT convergence where the potential interconnection of isolated plant systems with the outside world poses vulnerability to cyberattacks capable of disrupting production. Engro institutionalized cyber governance by adopting global frameworks such as IEC62443, ISO27001 and NIST; conducted comprehensive consultant-led risk assessments of infrastructure; developed a three-tier strategy to improve cyber resilience; and cascaded these in the enterprise risk register for board-level visibility. Further, it reinforced the “Human Firewall” concept into the organizational culture by frequent cyber awareness campaigns and phishing simulations, and partnered with ISA (International Society for Automation) for human skill development. Active engagement from the shop floor to top management led to the development of comprehensive OT security policies to integrate cyber resilience in the organization’s DNA, promising “security-by-design” in the production life cycle. Ongoing integration of its IT and OT security operation centres will further enhance threat detection, investigation and incident response. By implementing these measures, Engro has embarked on the journey of creating a secure digital environment for its people, process and products to boost the confidence of stakeholders to launch and further transform their business services while maintaining cyber resilience.
Securing OT-IT convergence against cyberthreats
Engro Corporation
Around 2020, Siemens recognized the escalating threat of cybersecurity attacks on corporate supply chains and observed a rising frequency, severity and sophistication of attacks in its supply chain. It was obvious that no single player would be able to establish broader supply-chain security standards. On the contrary, collaboration and partnering were necessary. Siemens embarked on a proactive journey to fortify its global cybersecurity posture by following the third principle of the “Charter of Trust”: manage the ecosystem. Founded in 2018 at the Munich Security Conference, the Charter of Trust (CoT) was initiated by Siemens to join forces with partner companies safeguarding society and businesses against the increasing exposure to malicious cyberattacks. Together with CoT partners and service providers such as TÜV SÜD, OneTrust and Panorays, Siemens tested various approaches to ensure adherence to a set of baseline requirements for supply-chain security. After a global announcement, more partners joined the test phase from November 2021. This initiative identified external service providers and laid the groundwork for enhanced transparency and scalability within Siemens’ supply chain. Challenges in stakeholder identification and in convincing providers to tailor solutions were overcome with a gradual approach, starting with pilot assessments. The key takeaway emphasizes the pivotal role of partnering with an extended partner ecosystem for ensuring sustained success in cybersecurity resilience across the supply chain. 
Establishing a supply-chain partner ecosystem
Siemens
Providing remote access to suppliers in a manufacturing environment can be challenging due to the presence of multiple vendors and the diverse operational landscape. Ensuring that security solutions do not disrupt daily operations or production further adds to the challenge. Arçelik implemented a new method for secure third-party remote access. This method uses a single file that eliminates the need for additional VPN (virtual private network) connections or organizational user accounts, which enhances operational efficiency. Each unique file is created with onetime access authorization and can be shared through a f ile-sharing channel. This solution offers several security benefits. It allows Arçelik to record remote access logs, which provides a clear record of activity. Additionally, it restricts manoeuvres that could escalate privileges, further protecting the system. Overall, this approach prevents security problems that can arise from traditional third-party remote access applications used for stakeholders’ remote access. Arçelik took a proactive step towards securing supplier access across its 22 factories while prioritizing production continuity. More than 50 third-party remote access applications out of 58 have been blocked from the Arcelik environment that has more than 25,000 devices.
Balancing security with operational efficiency
ARCELIK
Dragos observed 50 ransomware groups impacting industrial organizations in 2023 (up 28% in 2022) and 905 ransomware incidents impacting industrial organizations (a 49.5% increase). Manufacturing was impacted the most, in 71% of ransomware incidents. Trend Micro’s “What Decision-Makers Need to Know About Ransomware Risk” found 69% of ransomware attacks by the cybercriminal group Conti and 80% by the threat actor Lockbit impacted organizations with under 500 employees. Ransomware risk is high for small and medium manufacturing organizations. This impacts customers: multiple large manufacturers shut down plants when a critical supplier is hit with ransomware. After multiple small and medium suppliers informed Rockwell Automation they were impacted by ransomware and couldn’t deliver products for at least a month, Rockwell launched a new initiative. They assessed cybersecurity in their top 50 critical suppliers, finding small suppliers had little cybersecurity and medium suppliers had some in IT but not OT. They started a multi-year initiative to educate suppliers on cybersecurity and made cybersecurity contractually required. They are extending this initiative to OT cybersecurity using free resources from Dragos OT-CERT.The result has been a dramatic improvement in Rockwell’s end to end supply-chain operations resiliency, customer protection, delivery times, company revenue and reputation. Significant improvement in cyber culture and awareness of the need to protect digital systems with proper security hygiene is a new standard for Rockwell suppliers and is now part of doing business with the company.
Evaluating supply-chain cybersecurity measures
Dragos, Rockwell Automation
With industrial digitalization and the increasing interaction between the IT and OT environments, Siemens saw its products and solutions open to new attack vectors in operational environments, particularly due to a lack of security controls. As a foundation for establishing security controls (authentication, signing, encryption, etc.) in operational environments, Siemens needed an infrastructure to securely issue certificates to its production facilities and the products being manufactured.Siemens addressed the need to securely issue certificates to manufactured products with a “product PKI” (public key infrastructure). The Siemens Product PKI provides and manages certificates that are stored on and used by Siemens products and solutions. The certificates might be used in bootstrapping or other operational scenarios for authentication purposes. Or the certificates might be used to prove that a device is a genuine Siemens device.Siemens integrated cybersecurity in product design and manufacturing engineering to foster a cyber resilient environment in its own facilities as well as in the industrial facilities of its customers.
Integrating cyber resilience into product design
Siemens
In the realm of industrial cybersecurity, Volkswagen Group’s industrial control systems and production planning departments have jointly developed two applicable documents (also knowns as MgUs – mitgeltende Unterlagen), outlining cybersecurity requirements for suppliers in procurement and production phases. The first document focuses on IT security requirements for systems and components within production environments. It defines essential standards on information and IT security for the release of components and systems.The second document addresses IT security within production plants, delineating requirements for information security during the procurement and integration of new manufacturing plants, machinery and related infrastructure, including necessary tools like IT equipment. Compliance with both documents is mandatory and the requirements are also enshrined in Volkswagen’s industrial cybersecurity guidelines, which stipulate that Volkswagen’s information security requirements must be adhered to during planning and construction phases of plants and systems as well as during component selection and procurement.These requirements are aligned with current IT security best practices, and manufacturers are required to incorporate IT security considerations into their development processes.
Leveraging cybersecurity requirements for production
Volkswagen Group
Meeting the needs of a diverse set of customers can present challenges when balancing cybersecurity measures and demand for zero operational downtime. Flex, a global, diversified manufacturer, tackled this challenge by developing and introducing a comprehensive technical programme, encompassing redesign of engineering equipment and policies, processes and procedures for cybersecurity mitigation and threat response. Piloted at 25 manufacturing facilities, the new programme addresses critical aspects such as micro-segmentation, asset and threat visibility, and response and recovery protocols to help reduce the risk of downtime caused by cyber-attacks. Engineers with expertise in non-cybersecurity domains joined the cybersecurity team, fostering closer collaboration with the operations and design teams. Additionally, Flex’s engagement with OT vendors has helped enhance recovery capabilities, facilitate asset identification and deploy robust threat-monitoring mechanisms.Through this programme, Flex continues to align cybersecurity awareness and safety with the specific needs of engineering teams, helping to mitigate risks and bolster operational resilience. This collaborative approach enables rapid, swift threat detection and response, reducing manufacturing and design operation interruptions and enhancing engineering asset security.
Bolstering operational cyber resilience
Flex
In response to the evolving landscape of cyberthreats, Unilever embarked on a transformative programme to fortify its cyber defences across its factories worldwide. Central to this initiative was the establishment of a robust “Factory Cyber Security” organization. At its helm stands a “Global Factory Cyber Security Leader”, orchestrating a cohesive programme to protect Unilever’s manufacturing operations – made up of “work packages” that cover four deliverables: identify, protect, detect and response. Complementing this global leadership are eight “Regional Cyber Security Champions” stationed strategically across the globe. These champions serve as linchpins between the global strategy and local execution, fostering a network of resilience spanning over 200 factories. Collaborating closely with these regional champions are local “Factory Cyber Security Champions”, embedded within each facility, ensuring tailored and responsive protection at the grassroots level. For the sake of transparency, the global and regional roles are funded by cyber security, while the local factory roles are funded by each individual factory.Integral to this framework is the continuous education and training provided by the global and regional champions. Armed with cutting-edge cyber tooling knowledge and a keen eye for identifying and mitigating risks, they empower local champions to proactively defend against emerging threats, thereby fortifying Unilever’s cyber defence posture at every level of operation.
Leveraging factory cybersecurity champions
Unilever Netherlands
Industrial cyber security takes care of securing the production process with the equipment and systems used against cyberthreats. Specifications, processes, practices and technologies are used to detect, defend against and deal with cyberattacks and other unwanted activities. This includes the protection of components, networks and data as well as the establishment and compliance with processes and organizational requirements. team, consisting of nine people, is giving support by providing advice, ensuring transparency about risks in the group, developing blueprints and solutions for the shop floor and promoting the transfer of knowledge between all stakeholders on information security issues in production. A “group regulation” implemented in 2022 demonstrates Volkswagen’s cybersecurity governance mandate at the corporate level. All brands and locations of the Volkswagen Group are supported by an “Industrial Cyber Security Group Information Security Team” by defining and maintaining information security requirements on the shop floor. By conducting cybersecurity assessments in various plants all over the world, the maturity level is evaluated, to be continuously improved and reported to the top management in the information technology and production department. The “Production Information Security Officer”, as the person responsible for cybersecurity in each plant, is a key interface to the cybersecurity team. This role is constantly evolving through learning paths and mandates with competencies and responsibilities.
Establishing industrial cybersecurity governance from leadership to shop floor
Volkswagen Group
Henkel has more than 150 manufacturing sites globally across two business divisions. To improve OT security, it was important to make this a joint priority between supply chain organizations and the cybersecurity team. The cybersecurity risks had to be put into a business context, as well as in the light of staff safety, supply continuity and product quality.In addition to general awareness measures, tangible, eye opening interventions were identified to drive home the significance of OT security: an internal red team conducted. an actual compromise of a manufacturing site, compromising programmable logic controllers (PLCs), human-machine interfaces (HMIs), etc. – and capturing it on video. This exercise made the risks tangible not only for personnel at the manufacturing site but through the video, to counterparts at other sites too. It demonstrated the resulting impact clearly and transparently, not only in abstract risk or cyber terms but tangibly from a supply-chain perspective.  
Making manufacturing cyber resilience a priority by showcasing cyber risks
Henkel
With the digitization of supply chain operations and interconnectivity of IT and OT, Johnson & Johnson realized the need to strengthen cyber resilience in manufacturing by establishing a strong cybersecurity culture.  As a large healthcare company with multiple sites globally, Johnson & Johnson has on-the-ground cybersecurity advocates to educate everyone at the site and coordinate site-level actions and responses. Inconsistent or reactive responsibility for security awareness and actions across more than 60 sites is a challenge for the security programme.The following are some of the key actions the company took:Created a core team of IT and business leadership to lead the effort and define the roles and responsibilities of a “cybersecurity champion”.  Partnered with industry experts to build a plan with change management, training material, website, videos and an OT cybersecurity lab to incubate solutions. Connected with “make” and “deliver” leadership to nominate points of contact for each site to establish a network of cybersecurity champions. Successfully mobilized the cybersecurity champions network at each site.The cybersecurity champion role has been instrumental as the liaison between site, business teams and cybersecurity. The champions collaborate with the cybersecurity team for risk assessments, remediation actions and any urgent needs to strengthen cybersecurity and resiliency.
Cybersecurity culture as a fundamental imperative from shop floor to leadership
Johnson & Johnson
A “Factory Cyber Security Programme” launched by Unilever in 2019 encompasses a comprehensive approach to cyber securing operational technology (OT) assets. After engaging factory teams to carefully identify and catalogue all connected OT systems and associated high-level cyber issues, robust network segmentation was implemented, leveraging next generation firewalls, to isolate OT assets from corporate IT infrastructure, ensuring a heightened security posture.To enhance threat detection and response capabilities, endpoint detection and response (EDR) solutions were deployed across all factory environments. This allows for rapid identification and mitigation of potential cyberthreats, bolstering overall resilience. Concurrently, a proactive programme of patching and upgrading OT technology was instituted to eliminate exploitable vulnerabilities, further fortifying defences.To provide ongoing visibility and oversight, each factory now benefits from a dedicated dashboard displaying vulnerability scores and performance metrics. This holistic approach not only ensures the integrity and security of OT assets but also underscores the company’s commitment to proactive cyber defence within its manufacturing ecosystem.
Deploying a comprehensive OT cybersecurity strategy
Unilever
Establishing controlled network access to The Kuwaiti Danish Dairy Company’s OT environments is crucial for protecting critical infrastructure while ensuring operational continuity and safety. The key challenges that the company has identified include dependency on IT network for user authentication, network broadcast storms and single points of failure.To address these, network segmentation and access security controls have been implemented, including introduction of a dedicated domain controller for OT network authentication, controlled network segments between IT and OT networks, and site redundancy through storage virtualization. These measures have minimized downtime, increased system availability for operations and allowed OT users to work seamlessly within the OT network. Broadcast storms have been reduced, leading to fewer disruptions and increased productivity. Failure at one data centre does not affect operations due to seamless operation from alternative data centres.Proactive measures and collaboration have strengthened KDD’s OT systems, prioritizing cyber resilience and improving system availability. Tailored cyber resilience strategies have protected critical infrastructure and enhanced operational reliability.
Implementing controlled OT network access to enhance operational reliability
Kuwaiti Danish Dairy (KDD)
Schneider Electric integrates cybersecurity risk management into its manufacturing digitalization agenda. Committed to implementing cybersecurity controls on all industrial sites, the company has set itself the ambition of making all new manufacturing lines compliant with the IEC 62443 Security Level 2 (SL2). This ambition is set by the supply chain executive team, the effort is monitored and governed, and incentives are put in place to drive the right leadership and employee behaviour to achieve this goal. The elements of this systematic approach include: Executive support and joint governance from the global cybersecurity and supply chain functions: The cybersecurity objectives are defined by the global CISO  and the implementation strategy for those requirements is carried out by global supply chain executives. Having the global CISO and supply chain executives co-lead this effort ensures that the effort is “led from the top” and places cyber security as a business imperative. Together, they secure and prioritize resources for a robust cyber posture and to drive the compliance with IEC 62332 SL2 for new manufacturing lines. Employee incentives: Employees play a critical role in achieving cybersecurity ambitions, since human errors are often the weakest link. It is important for leadership to encourage the right behaviour among all employees, including those on the manufacturing floor, for whom cybersecurity is not a core responsibility. The executive management team has added cybersecurity targets into the annual performance review of manufacturing employees. Adherence to the defined cybersecurity objectives is therefore tied to the performance of industrial sites in the internal performance management system called the “Schneider Performance System”.
Raising cybersecurity awareness for an inclusive cybersecurity culture
Schneider Electric
The Data Security Council of India (DSCI), which was set up by the National Association of Software and Service Companies (NASSCOM), launched CyberShikshaa in 2018 in partnership with Microsoft to equip young female engineers across India with essential cybersecurity skills. Operating through classroom, blended and fully virtual modes in multiple cities and states, CyberShikshaa not only facilitates successful job placements but also narrows the diversity gap in the cybersecurity workforce. During the COVID-19 pandemic, CyberShikshaa seamlessly transitioned to an online format, expanding its reach to aspiring cybersecurity professionals even in smaller cities. Moreover, the programme has evolved to cater to diverse needs, introducing initiatives such as the “Women on Break” programme, providing training to women professionals re-entering the data-privacy workforce after career breaks. Additionally, CyberShikshaa has extended its impact through specialized modules such as CyberShikshaa for BFSI (banking, financial services and insurance) and CyberShikshaa for AI/ML (artificial intelligence/ machine learning), catering to different segments of learners and addressing the specific cybersecurity challenges faced by particular sectors.
India | IT and Communications (ICT)
CyberShikshaa
DSCI, Microsoft

Cyber Resilience Initiative

A World Economic Forum Initiative
© 2026 All rights reserved
Privacy Policy & Terms of Service