In brief:
A UK energy provider evaluated building an internal OT SOC and abandoned the plan when the cost exceeded what the business could justify. Through a formal tender, e2e-assure was selected as the only respondent able to integrate with the existing technology stack, deliver from UK-only facilities, and absorb out-of-hours IT SOC coverage. Time to detect dropped 40 percent. Asset visibility reached 100 percent across all core plants.
Reduction in time to detect across IT and OT
Asset visibility across all core operational plants
Significant cost saving versus an internal OT SOC build
Out-of-hours IT SOC shifts
reducing internal operational cost
The organisation is a UK energy provider operating critical national infrastructure. The estate is SCADA and DCS-heavy, distributed across multiple operational plants. Regulatory oversight from Ofgem, obligations under NCSC CAF and NIS2, and sector-specific security requirements make OT visibility a compliance necessity, not a discretionary investment.
The provider had an internal IT SOC. The team was experienced, the tooling was established, and the operation ran effectively for the corporate IT environment. When the board asked for OT coverage, the natural instinct was to extend what already worked. Build out the internal SOC. Hire OT security specialists.
OT security specialists command salaries between £80,000 and £120,000. SC clearance processing takes six to nine months. Staffing a 24/7 OT SOC requires a minimum of eight to ten analysts. The internal team would need new tooling for industrial protocol monitoring, new detection content for ICS environments, and new operational procedures for an environment where containment decisions carry physical safety implications. The total cost of building an in-house OT SOC, even at a basic level, exceeded what the organisation could justify against its existing security budget.
The alternative was outsourcing. But the energy sector’s requirements narrowed the field quickly.
The provider had invested significantly in its existing technology stack. It did not want a managed security provider that would arrive with its own vendor preferences and insist on ripping out what was already in place. It needed a provider that would plug into the existing environment and work with the tools the organisation had already paid for and trained its people on.
It also needed UK data sovereignty. OT telemetry from energy infrastructure regulated by Ofgem cannot be processed or stored outside the UK. Every provider in the tender that operated SOC facilities or data processing outside UK borders was disqualified.
The internal SOC was doing its job. Extending it to OT was a cost and capability problem, not a performance one.
Staffing, clearance processing, specialist tooling, and 24/7 shift coverage for an internal OT SOC exceeded what the business could justify. The investment required to build matched or exceeded the cost of outsourcing, without the speed-to-coverage benefit.
Most managed security providers in the tender proposed replacing existing technology with their own preferred vendor stack. That meant additional procurement cost, retraining, and integration risk on top of the monitoring service itself.
OT telemetry from regulated energy infrastructure must remain within UK borders. Several otherwise-qualified providers were disqualified because their monitoring operations, data processing, or storage sat outside the UK.
The build cost stack
Eight to ten OT specialist analysts at £80,000 to £120,000 each. A 6 to 9 month SC clearance pipeline per analyst. Specialist tooling licences. Integration engineering. Operational management. Most UK energy operators cannot justify the total against existing security spend, and the timeline does not deliver coverage faster than outsourcing.
After a detailed tender process, the client selected e2e-assure as the only provider that met all three requirements: integration with the existing technology stack, UK-sovereign data processing, and 24/7 unified IT/OT coverage. The client reported that no other respondent was able to offer all three without requiring a vendor technology change.
The engagement was structured to cover both OT monitoring across all operational plants and out-of-hours IT SOC coverage, absorbing the night and weekend shifts that the internal team had been staffing. This gave the organisation not just OT visibility but a reduction in internal operational costs by removing the need to maintain 24/7 internal staffing for IT monitoring.
The OT Telemetry Analyser was deployed across the provider’s core operational plants, passively scanning SCADA and DCS protocols without disrupting live energy operations. Every OT asset was discovered, catalogued, and grouped by plant, process zone, and criticality.
Cumulo integrated into the client’s existing technology investments rather than replacing them. EDR, cloud, identity, and log sources from the IT environment were ingested alongside OT telemetry into the same platform. The SOC operates a single, unified view across both environments. An indicator of compromise on the corporate network that correlates with anomalous behaviour on a plant control system appears as one incident, investigated by one analyst, through one case workflow.
Detection rules mapped to MITRE ATT&CK for ICS were tuned to the client’s specific OT environment. The behavioural baseline established across all plants means new detection rules informed by threat intelligence are written against verified normal behaviour. That is what drove the 40% reduction in time to detect. Rules based on accurate baselines produce fewer false positives and catch genuine anomalies faster than generic signatures applied to an environment the detection engine does not understand.
SC-cleared analysts monitor the full IT and OT estate 24/7 from e2e-assure’s UK-based SOC. During business hours, the client’s internal IT SOC team works alongside e2e-assure’s analysts with shared visibility through Cumulo. Nights, weekends, and bank holidays are covered entirely by e2e-assure. The handover is built into the operational model, not improvised at shift change.
OT-specific playbooks were developed with the client’s plant operations teams. Energy infrastructure carries safety implications that go beyond commercial disruption. Containment actions that affect a live process must follow pre-agreed protocols, with the right approvals, in the right order, every time. The playbooks reflect that.
All telemetry, case data, and encryption keys remain within UK borders at every stage. The sovereignty requirement is met by default.
Triage follows published SLAs with a full case audit trail. The client’s internal SOC team, plant managers, and senior leadership have direct analyst contact through Cumulo’s web interface and the SOC Channel app in Microsoft Teams.
We tried to build this ourselves. The numbers did not work. Then we went to market and found that most providers either wanted to replace our existing tools or could not guarantee UK sovereignty. e2e-assure was the only one that said, 'we will work with what you have, from the UK, around the clock.' That is exactly what they have done.
The organisation now has 24/7 unified IT/OT monitoring at a fraction of the cost of the internal build it originally planned. The internal IT SOC team has been refocused on daytime operations, threat hunting, and strategic security work, with out-of-hours coverage absorbed by e2e-assure. The OT estate that was previously invisible to the security operation is now fully monitored with a verified behavioural baseline and environment-specific detection rules.
40%
OT-specific detection rules tuned to verified behavioural baselines catch threats faster than the generic IT detection the internal SOC would have had to adapt. Anomalies in plant control systems are identified and escalated in minutes.
100%
Every OT device across the energy provider’s operational sites is identified, catalogued, and monitored. The initial discovery found assets that had never appeared in any previous inventory, including legacy controllers communicating on undocumented protocols.
Saved
The combined cost of Cumulo Enterprise for OT monitoring plus out-of-hours IT coverage came in well below the projected cost of hiring, clearing, and training an internal OT SOC team to deliver equivalent 24/7 coverage.
Reduced
Night and weekend IT monitoring shifts transitioned to e2e-assure, freeing the internal team to focus on higher-value work during business hours. The internal SOC did not shrink. It was redirected.
The engagement is ongoing with quarterly detection surface validation built into the service. The client is evaluating the extension of OT Telemetry Analyser coverage to additional operational sites as its infrastructure portfolio evolves.
Three patterns from this engagement transfer to other UK energy operators and adjacent CNI organisations evaluating OT SOC.
For energy organisations evaluating 24/7 SOC coverage, Unified IT/OT Threat Detection covers how e2e-assure structures detection and response for environments like this one.
e2e-assure operates a UK-based SOC with SC-cleared analysts across every role. Cumulo Enterprise unifies IT and OT detection inside one case workflow without requiring replacement of the operator’s existing technology investment. All telemetry, case data, and encryption keys remain within UK borders at every stage of processing.
The engagement model is built around integration, not replacement. Compliance dashboards are mapped to the NCSC Cyber Assessment Framework, NIS2, and IEC 62443 by default, producing audit evidence from the same telemetry that runs operational detection.
For energy operators under Ofgem oversight and approaching the commencement of the UK Cyber Security and Resilience Bill, this is the structural answer to the build-versus-buy question.
Schedule a discovery call to understand how e2e-assure integrates with your existing tools without displacing them.
Unified IT/OT Threat Detection – integration-first, UK sovereign, 24/7 coverage from a single platform.
For most UK energy providers, the build calculation rarely favours the internal option. OT specialist analysts earn £80,000 to £120,000, SC clearance takes 6 to 9 months per candidate, and continuous 24/7 coverage requires 8 to 10 analysts to maintain across rotation, holiday, sickness, and training. The total cost typically exceeds outsourcing to a UK-sovereign managed provider without delivering coverage any faster. Outsourcing is the structural answer for operators at most scales.
The cost stack typically includes 8 to 10 OT specialist analysts at £80,000 to £120,000 each, a 6 to 9 month SC clearance pipeline per analyst, specialist tooling licences, integration engineering, and operational management overhead. The total varies by operator scale but consistently exceeds the cost of outsourcing to a UK-sovereign managed provider at equivalent coverage. Add the opportunity cost of clearance pipeline delay and the build is also slower to deliver than the outsourced equivalent.
The integration-first approach keeps the existing IT tooling in place and adds OT-specific telemetry through on-site appliances. Cumulo Enterprise ingests telemetry from the operator’s existing EDR, identity, cloud, and log sources alongside OT protocol data, producing one case workflow across both estates. No working tool is removed, no working integration is rebuilt, and the operator’s existing security investment is preserved.
No. Cumulo Enterprise integrates with the operator’s existing IT tooling rather than replacing it. The platform ingests telemetry from existing endpoint, identity, cloud, and log sources alongside OT protocol telemetry, producing a unified case workflow. The operator’s existing security investment is preserved. This is what makes the integration-first procurement criterion satisfiable in practice rather than just in promise.
The handover model is operationalised, not improvised at shift change. Internal analysts and the outsource provider’s analysts work alongside each other during business hours, with formal escalation paths and case ownership rules. Nights, weekends, and bank holidays are covered entirely by the outsource provider under the same procedures. The internal team no longer absorbs out-of-hours coverage, which contributes to the engagement’s economic case.
Ofgem operates within the broader UK NIS framework alongside the NCSC Cyber Assessment Framework. Operators are expected to demonstrate continuous monitoring of OT estates, alignment to recognised technical frameworks (NCSC CAF, IEC 62443), and appropriate data residency for sensitive telemetry. The forthcoming UK Cyber Security and Resilience Bill is expected to tighten incident notification timelines and supplier obligations across the sector. Most operators are reviewing existing SOC arrangements ahead of commencement.
Deployment timing depends on plant count, network segmentation, and existing documentation. The discovery and baselining phases are typically the longer activities; the platform integration with existing IT tooling is the faster activity in most engagements. For most UK energy operators, full coverage across core operational plants can be achieved within a single quarter once the procurement and clearance gating is complete.
Both engagements address UK CNI operators with regulatory obligations and UK data residency requirements. The utilities operator was consolidating dual SOCs (IT in the UK, OT offshore) into one UK-sovereign operation. The energy provider was choosing between an internal SOC build and an outsource, with integration of existing tooling as a hard constraint. The platform and operating model are consistent across both engagements; the procurement triggers differ. Both are linked in the related resources section.
Schedule a discovery call with our expert team to understand how e2e-assure integrates with your existing stack and delivers UK-sovereign 24/7 coverage.
