Downstream Oil and Gas Operator Secures the Boundary Between Depots and Business Systems With Ollandi

Summary

A downstream oil and gas operator with storage depots, a loading terminal and a retail network deployed Ollandi to map and monitor every path between its business systems and operational technology. Unneeded connections have been closed, and suspicious activity toward operations is identified in time to be stopped on the corporate side.

Before Ollandi

• Historian replication, vendor remote access and regulatory reporting links had accumulated over years.
• No single, current inventory of connections into depot and terminal environments existed.
• Commercial teams discovered stale depot data only at month end.

After Ollandi

• Every connection between business systems and operations is inventoried: what initiates it, what it reaches and how often it is used.
• New paths, or existing paths used in new ways, are raised for review by security and the responsible control room.
• Movement toward boundary systems is correlated into a threat sequence with the affected depot, terminal function and control room stated.
• When depot data stops reaching business systems, the dependent loading schedules, stock positions and invoices are identified.

Deployment

• Product: Ollandi, modelling corporate network, identity, business systems and boundary paths.
• Operating control: Observe & Notify. Ollandi does not send commands to operational technology.
• Decisions affecting operations remain with control rooms and engineering leadership.

By the numbers

Measured across Glemad's production deployments and published in the the earlier model research research paper:

• Mean time to detect: 0.8 minutes, against an industry average of 287 minutes.
• Intent classification accuracy: 97% in separating legitimate machine-speed execution from attacker behaviour.

These figures come from environments with mature telemetry and defined policy baselines. Results depend on the quality of the telemetry available.