Multi-Plant Manufacturer Connects Plant Networks and Business Systems With Ollandi

Summary

A consumer goods manufacturer with several plants deployed Ollandi to monitor the connections between its production networks, ERP and corporate network. Changes that would stop production are identified before they take effect, and suspicious access toward the plants is contained on the IT side.

Before Ollandi

• Corporate network changes broke plant connections to ERP and halted production.
• Paths used by business systems and vendors to reach the plants were also available to intruders.
• Plant engineering and IT security reviewed the boundary separately.

After Ollandi

• Plant processes are mapped to the business systems and network paths they depend on.
• Changes to links, firewall rules or ERP interfaces are shown with the production lines they affect, before they take effect.
• Movement toward plant networks, new remote sessions and changes to plant-access accounts are correlated into threat sequences.
• Containment on the IT side, such as disabling an account or closing a session, is executed after operator approval.
• Plant engineering and IT security work from the same evidence.

Deployment

• Product: Ollandi, modelling plant networks, corporate network, identity and business systems.
• Operating control: Assisted Response. Ollandi does not send commands to production equipment.
• Decisions on production equipment remain with plant engineering.

By the numbers

Measured across Glemad's production deployments and published in the the earlier model research research paper:

• Mean time to detect: 0.8 minutes, against an industry average of 287 minutes.
• Mean time to respond: 2.1 minutes, against an industry average of 420 minutes.
• Intent classification accuracy: 97% in separating legitimate machine-speed execution from attacker behaviour.

These figures come from environments with mature telemetry and defined policy baselines. Results depend on the quality of the telemetry available.