Cyber Resilience Initiative

Case Studies

Explore case studies of how our partners apply our insights to improve their processes, and get inspired by success stories of cybersecurity leaders dedicated to strengthening their resilience.

A finger pointing at a glowing node in a network of connected human figures, representing collaborative cybersecurity partnerships.
Recent cyberattacks on European electricity companies have reinforced the need for a common and collaborative effort to enhance ecosystem-wide cyber resilience, e.g. ENTSO-E,12 EDP13 and ELEXON.14 The European Commission Regulation on the Internal Market for Electricity (COM/2016/0861) provides for the adoption of technical rules (e.g. a network code) across the electricity ecosystem. In April 2019, an EU Commission recommendation on cybersecurity in the energy sector highlighted that “smart grid” digitalization increasingly exposes the energy system to cyberattacks and incidents that may jeopardize the security of energy supplies.15 Already, the European transmission system operator (TSO; ENTSO-E) and distribution system operator (DSO; E-DSO, EURELECTRIC, GEODE and CEDEC) communities are working together to develop recommendations and drive a consultation process on initial proposals for a cybersecurity network code. The initial proposals include recommendations on: – Inclusion of ISO 27001 certification using a common scope. – Identification of critical IT and OT systems and components through a common cyber-risk assessment process. – Inclusion of a common set of functional security requirements for systems and components. – Inclusion of a product assurance scheme whereby functional security requirements can be independently tested and results shared. – Introduction of an information-sharing process for the distribution of technical cyber-incident information. The selected recommendations will undergo a formal consultation process with other energy-sector stakeholders in 2021 supported by ENTSO-E. Once finalized, the cybersecurity network code recommendations will affect the European energy sector by enforcing energy stakeholders to comply and implement cybersecurity actions.
ENTSO-E: Enforcing cybersecurity in the European energy market through the electricity network codes
European Network of Transmission System Operators for Electricity (ENTSO-E)
Scenario: In 2019, Siemens Energy and the Ponemon Institute collaborated on a survey11 of industry executives and managers at global oil and gas companies to assess the companies’ cybersecurity readiness. The results of the survey showed that, across the sector, most organizations have difficulty hiring cybersecurity personnel with in-depth knowledge of OTconnected energy assets necessary to identify and address cyberattacks before they occur. Additionally, only the largest organizations were able to fully fund research and development in new technologies and procedures that would improve cyber readiness against an expanding attack environment. Siemens Energy recognized that one way to improve cybersecurity for all oil and gas companies is to ensure small and medium-sized organizations can access advanced AI-based monitoring and detection solutions, which would help strengthen the weaker links against cyberattacks in the digital ecosystem. In 2020, Siemens Energy developed an AI-based, OT-native cybersecurity solution aimed at solving the technical and economic challenges associated with expanding monitoring and security that all organizations could access. Key takeaway: By combining interoperable and manufacturer-agnostic AI technologies, and efficiently leveraging OT-native human expertise, small and medium-sized energy companies can gain access to monitoring, detection and cyberattack prevention capabilities – a level of protection only previously achieved in-house at companies with ample budgets.
Siemens Energy helps secure weak links in the value chain
Siemens Energy
The global energy transition is in full swing, and Hydro-Québec is a key player in this rapidly changing environment. The vision for Hydro-Québec 4.0 is based on three major priorities: greater customer empowerment, asset digitization and a grid of the future. Achieving this vision also requires a comprehensive cyber resilience strategy, with a particular focus on defence in depth and public-private partnerships. The government of Canada has developed a National Cyber Security Strategy that empowers both government and private sector partners to meet their goals, even as technologies and cyber threats evolve. The Strategy identifies the leadership role of the government and conveys the importance of strengthening collaboration, particularly through the establishment of services such as the Canadian Centre for Cyber Security (Centre) and the National Cybercrime Coordination Unit within the Royal Canadian Mounted Police. As an operator of critical infrastructure, Hydro-Québec actively partners with these entities, working specifically with the Centre specifically on a daily basis to improve both organizational cybersecurity and the holistic security of the power grid. For example, there have been several situations where the timely receipt of threat information allowed Hydro-Québec to proactively improve security posture before actual cyberattacks. Beyond partnership with the government, Hydro-Québec is also an active participant in the Electricity Information Sharing and Analysis Center (E-ISAC).21 The E-ISAC provides a forum for the organization to share information on cyber issues affecting the industry and best practices for managing these issues with a network of peers. Partnerships on cyber resilience are essential in protecting Canada’s critical infrastructure and provide advantages to all parties.
Hydro-Québec: Essential partnerships in critical infrastructure resilience
Hydro Québec
Leading the digital transformation of energy management and automation, Schneider Electric regards cybersecurity as central to its business strategy – especially at the convergence of OT and IT, where digital threats can affect people, processes and technology across an expanded digital environment. Within its holistic digital risk strategy, Schneider has adopted an end-to-end cybersecurity approach aligned to the National Institute of Standards and Technology (NIST) framework. In the digital landscape, there is no perimeter. Schneider regards cybersecurity as a continuous, always-on, proactive activity. It therefore advances a cybersecurity by design strategy as both a business process and a technology development principle. Within the context of this strategy, Schneider: − Mitigates security gaps by scrutinizing cyber risk using a register that prioritizes high-value assets/crown jewels. − Integrates security at the beginning of product development within a secure development lifecycle process, implementing cybersecurity by design capabilities and digital locks to mitigate threats at every step. − Leverages cyber partnerships to secure its factories and global supply chain. − Secures IT/OT convergence with a 360° and 24/7 monitoring lens supported by a tested fast-response plan. − Takes advantage of lessons learned from ongoing Reality Checks for faster and better emergency response and improved plans. − Strengthens its cybersecurity posture by offering cybersecurity services to customers as part of protecting its end-to-end digital environment.
Schneider Electric: Cybersecurity by design strategy
Schneider Electric
Iberdrola Group’s cybersecurity transformation started in 2015 when the board of directors approved a cybersecurity risk policy recognizing the significance of cyber risk for the group. This policy expressed the company’s commitment to promoting adequate cybersecurity and resilience mechanisms across the IT and OT environments and to strengthening capabilities to detect, prevent, defend and respond to cyberattacks and incidents. The approach established by Iberdrola focuses on embedding cyber resilience into business strategies, operational decisions, and daily activities and improving implementation of the World Economic Forum’s 2017 and 2019 board principles to improve governance and oversight of cyber risk at a global level and promote collaboration across the group (IT, OT, physical and digital) and with the relevant ecosystem agents. To set the baseline for a culture change and ensure cyber-risk awareness in risk owners, the board defined an organizational strategy that would ensure strong leadership and oversight plus the effective integration of cybersecurity and resilience into all businesses and corporate areas. The group board’s Audit and Risk Supervision Committee was designated responsible for overseeing the group’s cyber-risk and resilience capabilities and a global chief information security officer was appointed to lead its cyber-resilience strategy, governance, and oversight across the group’s IT and OT environments. The global chief information security officer provides the board with specific cyber training, including best practices and an introduction to board principles, with quarterly updates about the cybersecurity risks specific to the company and the evolution and effectiveness of the programmes defined to address them. Local chief information security officers were appointed in all countries and cybersecurity experts were assigned by all businesses and corporate areas (including but not limited to IT) responsible for ensuring implementation of cybersecurity programmes and operations in alignment with the global cybersecurity strategy. A Global Cybersecurity Committee was constituted to ensure proper coordination across the group, encourage collaboration and information exchanges and ensure a coordinated incident response. The cybersecurity committee defined a global cybersecurity strategy and framework, including roles and responsibilities and global rules and procedures, to ensure a common language and a coordinated approach to cyber resilience across the group. Additional key metrics and dashboards have been established to facilitate risk-management decision-making and communication of cyber risk between business leadership, chief information security officer, and board members and to prioritize resource allocation by focusing on protecting critical business processes and infrastructures beyond the ones designated by existing regulations. With the increasing maturity of the implementation categories, Iberdrola aims to improve not only its own cyber-resilience posture and cyber-risk oversight capabilities, but also to enhance ecosystem-wide resilience through active collaboration with important public and private stakeholders.
Iberdrola: Setting a baseline to improve global cyber resilience
Iberdrola
In India, Adani Group faces similar challenges to many other organizations in today’s environment:Need for security resources and expertiseNeed to expand investments beyond just preventionNeed to maintain compliance with cyber lawsTo address these challenges, Adani has implemented a cyber strategy consisting of six pillars. This solution delivers a 24/7, end-to-end focus on cyber resilience and encourages a security-focused culture throughout the organization.1. Organization Strategy, Alignment, and GovernanceSecurity blueprint and roadmap (IT/OT)Technical advisory board for cybersecurityManaged services approach based on business outcomes2. Systems and Architecture Principles Designed for SafetyCommon design basis for security technology platforms (IT/OT)Common security design principles at group levelBusiness unit–specific framework (IT/OT)3. Cybersecurity by Design (Procedures, Policies, Tools)Design and engineerProcure, contract, and commissionOperate and maintain4. Threat Hunting via Big Data–Enabled Analytics and KPIsReports, metrics, and change managementReal-time graphical visualization of attacks and blocksBehavior analytics (user, network)5. Enterprise Risk and Cyber Compliance ManagementContinuous risk posture assessmentProactive risk mitigationIntegration with Adani Group–level risk governance framework6. Simulated Training and Education for Response to ThreatsCybersecurity awareness and training across all organization levelsAdversary attack simulationThreat response and breach-readiness training
Adani Group: End-to-end approach to cyber resilience
Adani Group
The digital world is changing everything. Billions of devices are connected through IoT. This holds great potential for everyone, but also great risk. This is exactly where the Charter of Trust (CoT) comes in. To keep pace with continuous progress in the digital economy and the threats posed by criminal activities, large industrial companies have formed the Charter of Trust to define and implement principles that can make the digital world a safer place. The power of the CoT stems not only from the fact that it is driven from the very top of the organizations, but also that the implementation is based on the principle of “leading by example”. With cybersecurity having become a top priority among boards of organizations, implementation of the principles, as well as the necessary paradigm shifts are not discussed as merely an option but are instead implemented as an essential ingredient to the future digital business. To underscore this priority, leaders (typically CEOs) from global organizations were not only present at the start of the initiative in February 2018 but are also directly involved in regular CoT board meetings and have since pushed the initiative forward with great success. By making the Charter of Trust a top priority in their companies, CEOs are driving a culture change, which is critical to the success of the initiative. They are committed to creating baseline requirements for their supply chains and are declaring these standards binding for their companies and its business partners, again following the principle of “leading by example”. As a credible and reliable voice, the CoT members collaborate with key stakeholders around the world to achieve trust in cybersecurity for global citizens. The Charter of Trust shows that, even in times of imminent trade conflicts and growing mistrust, global collaboration at the highest levels is possible.
Siemens' Charter of Trust
Siemens
Scenario: From 2014 to 2017, a malicious adversary breached the cyber defences of an oil and gas refinery using OT specific malware called Trisis or Triton to target the safety systems used for oil and gas production. After going undetected for three years by the oil and gas company’s security team, the attackers activated their malware to disrupt the refinery’s safety instrumented systems. But when the attack was deployed in the summer of 2017, an error in the malware caused the plant to shut down instead of causing significant physical damage and killing or severely injuring company workers as intended. Little did investigators know at the time that this failed attack was the first known cyberattack specifically aiming to kill people. Immediately following the attack, plant security personnel – and their third parties – did not consider the sudden shutdown to be a direct result of a cyberattack and, thus, did not investigate this possibility as a root cause in their analysis. Years of investing in IT security but without taking a specific approach to OT cyber protection left the organization unprepared to deal with the attack or conduct the investigation. Having failed to correctly recognize and block the ongoing cyber-breach threat, the plant went back into operation with the malicious actor still present. With the malware still active, a month later attackers made a second attempt to disrupt the refinery’s safety system, but this time attempted to shut down even more critical infrastructure; fortunately, the attackers again failed due to a different error. This time the plant’s security team requested support from OT specialists to investigate the shutdowns in greater depth. After the second investigation, security experts found that the plan’s OT systems were being manipulated. They discovered that attackers were maliciously manipulating OT network activity and took steps to secure the breach. Recovering from the incident and then restoring the refinery to full operation took over 70 days and cost tens of millions of dollars. This attack could have been detected with an OT-specific approach and with a rehearsed incident-response plan in place. Had these measures been deployed, the time lost and the impact of the OT-specific attack would have been significantly reduced. Key takeaways: Adversary errors prevented casualties in this incident, but board governance can – and should – make organizations more resilient against OT cyberthreats to critical safety infrastructure by taking an OT-specific approach to cybersecurity where appropriate. Attacks will happen as they cannot all be prevented, but organizations can also detect and respond, making themselves more resilient. After incidents, sharing information and lessons learned from past threats helps other organizations in the oil and gas value chain prepare.
The importance of operational technology to guard against cyberattacks (an experience from Dragos)
Dragos
In 2015, the Iberdrola S.A. board recognized that being at the forefront of digital transformation required strong cybersecurity and resilience capabilities. In this dynamic, increasingly complex and interconnected environment, ensuring compliance with all IT security, privacy and critical infrastructure protection regulations was not enough. As a result, the board approved a company-wide cybersecurity risk policy to promote a strong cybersecurity culture and established a Global Cybersecurity Committee with the mandate to lead this cultural change. The goal was to promote cybersecurity and resilience by design and by default throughout the organization. Moreover, it aimed to embed the idea that cybersecurity is everyone's responsibility, and goes beyond individual organizations How this was accomplished: − A new cyber governance framework was approved where IT and Security no longer had sole responsibility for cybersecurity. It is now a responsibility of all businesses and corporate areas. − The chief information security officers (CISOs) are responsible for ensuring overall coordination, independent oversight and adequate cyber training of their respective boards, senior management and all personnel. − A common cyber risk methodology and global rules were defined to allow risk-based identification of action plans in all areas. Cybersecurity strategy and action plans for IT, OT and IoT environments are coordinated and supported with investments in technology, processes and people. − An OT cybersecurity forum brings together Industrial control systems (ICS) and IT security experts across the company to exchange best practices, share results and coordinate initiatives. − Leadership, including the Global CISO, emphasized collaboration. These collaborative partnerships with technology providers, other companies, industry experts and government agencies now provide threat intelligence for the company and contribute to the resilience of the ecosystem as a whole.
Iberdrola: Building a strong organizational cyber culture
Iberdrola

Cyber Resilience Initiative

A World Economic Forum Initiative
© 2026 All rights reserved
Privacy Policy & Terms of Service