Cyber Resilience Initiative

Case Studies

Explore case studies of how our partners apply our insights to improve their processes, and get inspired by success stories of cybersecurity leaders dedicated to strengthening their resilience.

A finger pointing at a glowing node in a network of connected human figures, representing collaborative cybersecurity partnerships.
As an energy organization, Siemens Energy has identified a need to grow the pool of workers who can understand both the physical and cyber aspects of operational technologies. With fewer than 10 colleges in the United States offering cybersecurity classes focused on operational technologies in 2020, Siemens Energy partnered with ICS Village, the Regional Economic Development for for Eastern Idaho (REDI), MISI Academy, Capitol Technology University, SANS Technology Institute and Idaho State University (ISU) to design and implement the Industrial Cybersecurity Apprenticeship Program (CIISAp). CIISAp is an academically rigorous programme that places apprentices in real-world job rotations designed to immediately apply their skills as they learn. It enables people with moderate computer skills to gain the hands-on experience and knowledge needed to competently fill cybersecurity vacancies that currently pay above $90,000 per year.
USA | Energy & utilities, Oil & Gas
Cybersecurity and Industrial Infrastructure Security Apprenticeship Program
Siemens Energy
Telefónica’s Campus 42 is dedicated to attracting, educating and recruiting skilled cybersecurity professionals and experts. Campus 42 – characterized by free access to education with no classes or textbooks, available 24/7 and focusing on practical, project-based learning in a collaborative environment – aims to develop highly skilled technology experts in disciplines such as cybersecurity. The programme emphasizes the development of industry-relevant skills, and admission is based on logical thinking and problemsolving abilities rather than academic prerequisites. Telefónica, a key partner of Campus 42, provides essential support, including financial assistance and resources such as Telefónica office space. The company extends further support by offering employment opportunities and internships to Campus 42 students, enabling them to gain valuable work experience in the telecommunications and technology sectors. This collaboration has helped create a talent pool of highly skilled professionals available for recruitment, and Telefónica’s internal cybersecurity unit actively filters and collaborates with these individuals on internal projects, thereby promoting and refreshing internal cyber skills.
Spain | IT and Communications (ICT)
Campus 42
Telefónica
The UK government recognizes that there need to be clear pathways into and through the cybersecurity profession. Knowledge, skills and experience in cybersecurity should be defined and acknowledged in a way that is similar to more established professions, such as law and engineering. To do this, the UK Cyber Security Council was launched in March 2021 and represents a world first for the cybersecurity profession. Its mission is to be the voice of the profession, bringing clarity and structure to the growing cyber workforce and the range of qualifications, certifications and degrees that exist across the field. It was awarded a royal charter, which enables it to bestow chartership on individuals – a national recognition of excellence and expertise – as is done in the engineering profession. This is a vital step towards bringing cohesion and consistency to the cyber workforce and, through the development of professional standards across numerous specialisms, practitioners are being recognized for their abilities as well as engaging in a more defined career pathway. The council has now awarded more than 100 cyber professionals with this accreditation across four specialist areas, including Cyber Security Governance and Risk, Secure Systems Architecture, Cyber Security Audit and Assurance and Security Testing (Penetration Testing).
United Kingdom | Government
The UK Cyber Security Council
Department for Science, Innovation and Technology of the United Kingdom
To improve the architecture and security of systems within the organization, EDP has launched the Global Black Belt Program. The programme aims to enhance employees’ technical skills and knowledge, enabling them to design and implement secure and robust systems. To meet its objectives, the programme covers topics such as security best practices, threat modelling and secure coding techniques. To participate in the programme, employees are asked to fill out a questionnaire to assess their level of expertise and provide suggestions for further development. The programme offers various expertise paths, such as Azure Cloud Architect Expert, AWS Cloud Architect Expert, Google Cloud Architect Expert, Human Behaviour Expert, Security Architect Expert, Governance, Risk and Compliance Expert and more. Each path is structured around three levels of expertise: Global White Belt, Global Green Belt and Global Black Belt. Every level has specific requirements regarding skills, experience, certifications and recommended conferences and learning paths to help participants advance their knowledge and skills.
Portugal | Energy & utilities
Global Black Belt Program
EDP
Schneider Electric (SE) sees employees as vital to the safe and secure delivery of its products and services, strengthening critical global infrastructure and fuelling the digital economy. SE’s Cybersecurity Talent Development initiative is a comprehensive programme that defines the cybersecurity talent needs of the company, then identifies, attracts and upskills cybersecurity talent in an inclusive way. In preparation for the future, SE implemented a people-centric approach and completed the following milestones: – Community identification: Through careful assessment and mapping, SE has successfully identified cyber employees within the organization. – Key roles definition: SE outlined the current and future top cybersecurity mandates and domains from digital practices and functions to business and operational units. Following this exercise, SE completed career path mapping to common roles. – Career path development: To support the growth of cyber roles, SE established individual role descriptions and recommended training programmes and certifications to facilitate professional development. Learning and rotation are central to developing the company’s talent pool. – Community meetings: These monthly calls are designed to create synergies and networking opportunities by sharing initiatives from different teams. The benefits for employees have been equal career development opportunities and diversity of career paths. The SE benefits are a stronger pipeline of cyber talent and a future-ready cybersecurity community.
France | IT and Communications (ICT)
Cybersecurity Talent Development
Schneider Electric
The European Investment Bank (EIB), in efforts to enhance its professional development, implemented a job shadowing programme in cybersecurity. This initiative, aimed at employees with a keen interest in cybersecurity, provides a unique opportunity for cross-departmental collaboration and skills enhancement. The programme serves as a platform for mutual learning where cybersecurity experts share their expertise while gaining insights into the operational challenges faced by other departments. Programme participants, upon agreement with their respective managers and the CISO, are allocated one day per week throughout a quarter to work alongside the information security team. This immersive experience enables participating employees to gain first-hand experience in cybersecurity and equips them with the skills required to perform work functions in cybersecurity such as risk assessment, audit exercises, information security alignment with other international financial institutions and so forth. Ultimately, the programme allows for the creation of an internal talent pool.
Europe | Financial services
Job Shadowing Programme in Cybersecurity
European Investment Bank
Talent features prominently in Repsol’s 2024–2026 cybersecurity strategy. The strategy recognizes that the risk of data breaches and deployment of new technologies, including AI, as well as the evolution of operational technology (OT) security, cannot be successfully managed without strengthening the cybersecurity team. To that end, Repsol aims to: 1. Gain support from the board to strengthen the team and achieve the defined strategy. 2. Enhance talent across key areas, including incident response, identity management, the operational technology security operations centre, network security and cloud security. 3. Draft hiring proposals with the necessary technical and soft skills while promoting diversity, especially female talent. 4. Retain hired talent with an interesting long-term value proposition focused on the physical and mental health of teams, including the possibility of fully remote working and monetary incentives.
Spain | Energy, Oil & Gas
Strengthening cybersecurity team
Repsol
With best people as one of our strategic priorities, we are committed to creating a purpose-based globally connected culture with local interactions united by our mission to secure the world. A complex, post-pandemic, global workforce with virtual teams and flexible work arrangements proves challenging to build an exceptional culture and career experience for our people.Security Connect Events offers a range of networking and team building in person and virtual events to bolster the sense of pride and belonging through meaningful personal interactions.​ Local teams are enabled to customize experiences to meet the needs and interests of the group. Example of Connects include fun social events and team building activities, shared learning experiences, panel discussions, community meals, etc…The value of Security Connects is best summed by a leader who attended a Connect in Europe: “We had 300 of the team together for a community evening followed by a day of learning, meetings, panels, partner meetings and discussions. I personally met a couple of hundred people and the impact of getting the team together was electric. I have no doubt that this will have a positive impact on everyone who attended and ultimately our business and clients.”
Europe | IT and Communications (ICT)
Strengthening Talent Culture Through Security Connect Events
Accenture
The Consortium of Cybersecurity Clinics is a collaborative network of higher education-based cybersecurity clinics. A cybersecurity clinic provides cybersecurity services to under-resourced organizations, including small businesses, nonprofits, cities and towns, rural school districts, small utilities and more, while giving students real-world cybersecurity experience. Modeled after legal and medical school clinics, cybersecurity clinics are typically housed at colleges and universities under the direction of clinical professors. Students from diverse backgrounds and degree paths train to provide free cybersecurity assistance to clients who could not otherwise afford these services. Clinics serve as a skills-based learning environment for students and as a vital local resource for improving the cybersecurity resilience of communities. Since its inception, the Consortium has grown to over 30 clinics across 25 U.S. states, and has seen recent expansion in various regions around the world. Each year, cybersecurity clinics train hundreds of students, equipping them with the experience and competencies needed to enter cybersecurity careers. Clinics contribute to a diverse pipeline of talent prepared to protect and serve communities, while providing essential, no-cost cybersecurity services to communities that need them most.
North America, Africa | Education
Consortium of Cybersecurity Clinics
UC Berkeley
Repsol has embraced zero trust with two different approaches – as a mindset and as a programme. As a mindset: Every initiative and security requirement is thought through with the zero trust principles in mind as part of a security-by-design process. As a programme: To reach maturity in this architecture and truly change the paradigm, Repsol recognizes that some transformational projects and a dedicated multidisciplinary team are needed. The key piece for succeeding in the programme is adequate sponsorship to drive the transformation. Senior management have to be briefed about the concept and must support the programme, while key teams from areas such as architecture, applications and infrastructure have to be highly engaged. The organization is aware that this is a continuous journey on which it needs to adjust its action plan to the readiness of the environment and the always evolving nature of the threats.
Repsol embraces two approaches to zero trust
Repsol
Given the constraints of the OT environment, Schneider Electric is pursuing an approach that focuses on aligning ongoing and future OT security efforts towards a set of core principles, rooted in zero trust best practices. The current and future efforts include improving authentication in the factory environment through: – Identity-based authentication across industrial personal computers (PCs) and humanmachine interface software (HMIS). – Role-based access control for key systems. – Replacement of obsolete, legacy or insecure-by-design equipment where possible. – Increased security oversight of third-party suppliers and manufacturing partners. – Certification of control systems against IEC 62443 standards that secure the development and maintenance of industrial automation and control systems. – Instating of systematic backup, restoration and management of all OT devices such as PCs, programmable logic controllers (PLCs) and printers. – Education of OT actors on this upcoming change. Over time, efforts will convert into impact since the organization is just launching this initiative.
Schneider Electric takes a principles-driven approach on zero trust and OT
Schneider Electric
Companies must walk the tightrope in ensuring that everyone has access to the tools and data they need, but no more than that. For IT organizations around the world, particularly, managing these access controls is a real challenge, which is exacerbated when each employee has multiple accounts across different tools in disparate environments. Cloudflare, a company that builds security products, was in a unique position to solve this problem for both itself and its customers. It built Cloudflare Access to secure its software-asa-service (SaaS) and internal applications with a zero-trust approach. Securing its internal applications made employee and contractor on- and off-boarding much smoother. Now, each new employee and contractor is quickly granted rights to the applications they need. By authenticating every packet, Access makes it possible to assign granular permissions to employees and contractors, and enables the security team to detect unusual activity on any applications. Together, more granular control and enhanced visibility enable more comprehensive management of attack surfaces.
Cloudflare manages zero-trust access controls
Cloudflare
The fast-evolving cyber threat scenario requires a rapid mindset change. To this end, Eni is focusing on building the consciousness and sensibility that zero trust needs. The foundation of its zero-trust strategy is the existing infrastructure, whose core functionality will be expanded by capitalizing on the investments already in place. The thrust will be on identity, of both users and devices, to be able to build security around this new organizational perimeter. Eni is evolving its access methodologies with modern and flexible technologies that allow for continuous risk assessment. Since cybersecurity objectives can only be met with the broader engagement of all IT functions, brief workshops have been held to create awareness and share how this new way of thinking about security can bring less complexity and more adaptative security. In Eni’s “IT Strategic 4Y Plan”, zero trust will feature as a fundamental pillar to increase the security posture, enable new business and lead technology improvements. At the same time, it is expected to increase scalability and visibility, while facilitating easier compliance with standards. The relevance of the zero-trust approach will be shared with Eni’s top management to ensure effective risk mitigation amid constantly changing threat scenarios.
Eni: Zero trust as a fundamental security pillar for Eni
Eni
Being able to quickly understand threats is critical to security and resilience. Information sharing helps energy-sector organizations blunt the potency of known attack methods and identify new threats. ISACs have been built to serve subsectors and industry verticals. As the energy sector is transformed by digitization and the energy transition, information-sharing efforts in the energy sector also need to evolve to embrace new classes of energy companies that are more distributed and interconnected. To secure digitized and digitally native operational technologies (OT) and cyber-physical systems, organizations need the capability to share OT threat data – not only with their peer organizations and asset operators, but also with equipment manufacturers and other supply-chain partners across the full spectrum of energy companies. To share information at speeds that keep pace with threats, organizations must build stronger capabilities to identify anomalous activity and automate information sharing. With that need in mind, Siemens Energy and the Global Resilience Federation are launching a new initiative aimed at developing next-generation information-sharing capabilities that bridge industry silos and emphasize automated threat detection. This initiative will work towards the goal of sharing IT and OT threat information at machine-like speeds – fast enough to be relevant for the early detection of novel threats. Using advanced capabilities and built-for-purpose industrial cybersecurity technologies, the initiative addresses cybersecurity challenges exacerbated by the energy transition. The aim of the initiative is to build greater awareness of threats and create collaboration to address new risks to the rapidly evolving energy ecosystem.
Siemens Energy and the Global Resilience Federation cooperate on information sharing
Siemens Energy
Operational technology (OT) security professionals are increasingly moving towards a containerized architecture of the supervisory parts of industrial control systems (ICS), with sensors and other legacy equipment remaining in the field. This emerging architectural trend is gaining adoption in renewables, distributed energy and smaller-scale projects in onshore oil and gas. The architecture enables asset operators to scale common automation architecture and data governance across the enterprise, supports detection, response and recovery activities at scale, and can support more centralized maintenance and operation among geographically distributed assets. In contrast to traditional automation, assets can be patched in real time without it affecting operations and new vendor features can be pushed after being tested in a containerized test bed. Containerized ICS enables unified security services for monitoring, discovery and protection in a way that traditional on-premises proprietary control systems have not supported at scale. The adoption of containerized ICS can be a significant accelerator in moving real-time and asset data into a common industrial data operations layer. With this data in the cloud, it is much easier to support the identity management and access control needed for off-premise energy value chain data consumers, such as the operational and maintenance experts, trading, compliance, safety and data scientists that need granular and secured data access to perform their roles. While containerizing ICS has a number of security and operational benefits, adopting containerized ICS requires: investment in architecture to support data persistence; developing OT security teams with container experience; staffing up centralized oversight management and orchestration; site-to-cloud connectivity improvements; and implementing virtualized test beds to support this constant update cycle.
Cognite observes containerization of supervisory parts in industrial control systems
Cognite
In a period of true transformation and transition for the energy sector, cybersecurity issues become a driver that influences this evolution. To improve, modernize and innovate business services, ensuring the trust and security of the service becomes paramount. The evolution and growth of electric vehicle (EV) charging stations essentially using IoT components is a prime example. With the introduction of these stations and to ensure their secure use, the EDP cybersecurity team invested in a security assessment of previously installed charging stations. While the results of the security assessment did not identify any highly critical issues, some of the models evaluated presented a set of vulnerabilities of medium severity. These results were decisive in educating and increasing the awareness of the key people responsible for managing the charging station services. Moreover, it led to the involvement of the cybersecurity team in the production of technical specifications and necessary security requirements for the renovation and acquisition process for new electric vehicle charging stations. These exercises contributed to the creation of two checklists of security controls: one for IoT components in general, and the other a technically specific list for EV charging stations.
EDP - Energias de Portugal raises cyber awareness for long-term business investments
EDP
The constant onslaught of cyberattacks has forced governments throughout the world to introduce new approaches to the shoring up of their digital defences and economies. In many cases, key players such as the European Union, the US and China have introduced new regulatory measures to ensure improved cybersecurity for citizens and businesses. That said, Schneider Electric views this ever-evolving regulatory landscape as an opportunity to continuously improve its posture and raise its defence levels across its value chain. The company promotes the use of internationally accepted cybersecurity standards and information-sharing frameworks in every region in which it operates to enhance the level of trust between industries and governments. Schneider Electric also plays an active part in the evolution of cybersecurity policies, by participating in over 30 globally recognized external organizations focused on advancing the regulatory environment from standards development organizations, trade associations and non-governmental organizations globally to advance the interests of customers and industry. In this complex regulatory environment, processes and products need to evolve as quickly as possible in order to stay ahead of governmental expectations and continue the improvement of security posture for the organization’s customers and partners. 
Schneider Electric plays an active role in the evolution of cybersecurity policies
Schneider Electric
Repsol has followed a flexible yet robust third-party cybersecurity management approach. Different supply-chain cybersecurity risk scenarios are treated according to their third-party type, including: – IT and digital providers – OT providers with remote or physical access to ICS – Business providers receiving and keeping sensitive information from Repsol – Business providers that are critical for maintaining normal business operations In the search for security and agility, Repsol has also defined clear processes for each scenario. These include: – A specific internal triage questionnaire, which helps qualify the risk potential of the contract (independent of provider), assigning a risk tier level – If the tier is medium or high, providers are assessed through security rating tools and questionnaires, according to the type of service – If the tier is high, certifications are required, additional evidence may be requested, and penetration testing could be undertaken – Depending on the tier level and type of contract, specific clauses are included by default into the final contract with security requirements – Ensuring that different cases are treated differently is vital to making the process scalable and helps contract holders accept an additional step in the procurement process.
Repsol develops a flexible yet robust approach to third-party cybersecurity
Repsol
Supply-chain cyberattacks have become more prevalent in 2021. With the ever-growing sophistication of attacks combined with the wide variety of new techniques in use, third-party risk management needs to be addressed as a top priority, at the same level as other enterprise strategic risks. The conventional third-party risk management approach is no longer effective in enabling a proactive response to emerging supplychain risks. Supply-chain risk requires a new, multifaceted approach. Third-party risk management at Shell is fully integrated across sourcing, assurance and IT. Sourcing plays a pivotal role in robust supplychain management. The initial screening of third parties is considered equally as important as imposing strong contractual obligations and managing a contract after it has been awarded. Shell’s assurance process aims to validate the ability of third parties to adhere to contractually agreed terms in ensuring security across the business environment. Shell uses data analytics across its vendor risk-management platform, security ratings and sourcing engine. This integrated approach to supply-chain risk management helps Shell to ensure a robust and comprehensive view of constantly changing supply-chain risk vectors. In case these evolving risks are not within Shell’s risk appetite, preventive measures can be implemented to safeguard information assets. When coordinated action is required across the business environment, an established communication protocol enables timely cooperation with individual service organizations. Only when acting in a fully aligned manner with suppliers can Shell successfully tackle the ever-growing challenge of keeping its business systems healthy and resilient against emerging supply-chain attacks
Shell: Tackling third-party risk management at Shell
Shell
Galp has implemented a third-party cyber-risk management process based on questionnaires aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework and using a risk-based approach through three service tiers based on the potential cyber risks. These questionnaires are evaluated in parallel with a technical assessment of the proposals, considering both the answers given and the risk vectors observed using a cybersecurity-rating tool. In addition, awareness sessions are conducted regularly to ensure that internal stakeholders have a clear understanding of the process and of service-level agreements (SLAs), by providing access to a dashboard that presents the cyber-risk evaluation stage in near real time. Awareness materials are also developed and distributed to the suppliers. As a result of the evaluation, when relevant risks are identified following the standard enterprise risk management process, the business unit can accept the risks and endorse the service if its benefits outweigh the potential impacts. However, it is also possible to reduce the identified risks through the mitigation and remediation plans developed between Galp’s cyber-risk team and suppliers. Despite some expected initial internal resistance, Galp’s business units have quickly understood the value of this approach. The key to this success has been to follow a risk-based approach and not be compliance-driven – working side-by-side with businesses both to give them visibility on supplier risks and to help them work with the supplier they want. The real surprise of this programme has been the buy-in from suppliers, which perceived the process as a means of improvement and provided little resistance to implementing the agreed mitigation measures. This has also led to an improvement in Galp’s overall portfolio cybersecurity rating."
Galp: Adopting a third-party risk management programme - Galp Energia
Galp

Cyber Resilience Initiative

A World Economic Forum Initiative
© 2026 All rights reserved
Privacy Policy & Terms of Service