CYBER RESILIENCE
Watched around the clock, at arm's length
The short answer
Cyber resilience is one of seven SafeIT services, and its security monitoring is delivered at arm's length: Cyrebro, an independent security operations centre, watches around the clock and reports to the plant as well as to SafeIT. SafeIT's team does the fixing, at any hour when it is an emergency, so the people who build your network are not the only ones watching it.
This is one of seven services we deliver. We are not a cybersecurity company and we will not sell you fear. But if something gets into your network, it stops your line just as effectively as a failed motor, and it takes longer to recover from.
What we actually see in plants: an email account gets taken over and invoices start going to a different bank account. A file server gets encrypted on a Friday night and Monday's production paperwork is gone. A supplier's compromised account sends your purchasing team something that looks entirely normal. A vendor remote-access connection nobody remembered leaving open.
And increasingly, the pressure is commercial rather than technical. Your customer sends a security questionnaire. Your insurer asks whether you have multi-factor authentication and whether you run unsupported operating systems. A large buyer asks whether you are working toward NIST, a U.S. government cybersecurity framework many manufacturers are now being asked about. Somebody in your building has to answer, and it is usually the controller at 9pm.
The safety parallel holds here better than anywhere else on this site. You do not run a safety program because you expect a serious injury this week. You run it because the cost of one is unacceptable, and because the discipline of running it makes everything else work better. Same reasoning. Same rhythm.
The people who build your network should not be the only ones watching it
Security monitoring for SafeIT members is delivered by Cyrebro, an independent security operations centre. That is deliberate, and it is the single most important design decision on this page.
Here is the argument, plainly. We build your network. We configure your firewall. We set up your access rules. If we are also the only people watching for problems in what we built, then we are marking our own homework. A mistake we made is a mistake we are unlikely to spot.
Your safety program already solved this. You have an internal safety committee doing the daily work: and an external auditor who comes in, looks at the same things with fresh eyes, and reports independently. Nobody treats the external audit as an insult to the committee. It is how you know the program is real.
Security monitoring works the same way, and it lands the same way with the two audiences who ask hard questions:
- Your insurer wants to know that detection is independent of the people who administer the systems. Separation of duties is a specific thing they look for.
- Your customer's auditor wants to know that a finding gets reported whether or not it is embarrassing to your provider.
Cyrebro watches 24/7, reports to you as well as to us, and escalates to our team when something needs hands on it. We do the fixing, at any hour when something real is happening. They do the watching. Neither of us gets to be the only voice in the room.
This is a governance decision before it is a technical one, and we've written out the reasoning in full: why we don't watch our own work.
What's included
- 24/7 security monitoring and threat detection through Cyrebro, independent of the team that administers your systems, with escalation to our 24/7 emergency line.
- Endpoint protection on servers, workstations and laptops: detection and response, not just signature-based antivirus.
- Email security through Barracuda. Email is still the most common way in. Filtering, impersonation protection, link and attachment inspection, and controls on the invoice fraud pattern that targets purchasing and accounts payable.
- Vulnerability management through Tenable. Regular scanning, findings ranked by real risk to production, and a remediation plan with owners and dates rather than a 400-page PDF.
- Multi-factor authentication and access control. MFA everywhere it makes sense, role-based access, privileged account control, and shared plant-floor accounts handled sensibly instead of pretending they do not exist.
- Identity lifecycle tied to onboarding and offboarding, so access ends when employment does. See managed IT & helpdesk.
- Security awareness training and phishing simulation through BullPhish ID: short, plain, and runnable on a shop-floor terminal. Delivered like a toolbox talk, not like a compliance course.
- Incident response. A defined process, a named escalation path, a 24/7 number, and rehearsed steps. Response is joined at the hip with business continuity and disaster recovery, because detection without recovery is just bad news delivered promptly.
- Insurance and questionnaire support. We help you complete cyber insurance applications and customer security questionnaires accurately, and we tell you what to fix before you answer rather than after.
- Policy and governance material. The 16-policy pack written for plants, free with membership, plus the portal records that evidence how incidents are handled.
- Cork coverage for every SafeIT member, warranty-backed cyber financial protection.
Production equipment, in proportion
OT means operational technology: the equipment and control systems that run the plant. ICS means industrial control systems: the PLCs, the HMIs an operator runs a machine from, and the machine controllers underneath. These get talked about a great deal in security marketing, and most of it is aimed at plants far larger than the ones we serve.
Here is the proportionate version for a mid-size manufacturer or processor.
What actually matters, in order:
- Separation. The production network should not be the same flat network as the office. This is the single highest-value control, and it is a network job, not a security-product purchase.
- Controlled vendor access. Equipment manufacturers need to dial in. That access should be requested, time-limited and logged, not permanently open.
- Isolation of unpatchable systems. The 1998 machine and its unsupported PC get wrapped, not ignored. See legacy & critical-system continuity.
- Removable media discipline. USB drives moving between an office PC and a machine console is a real path in, and it is a procedure problem before it is a technology problem.
- Knowing what is there. An inventory of connected production equipment, because you cannot protect what nobody has listed.
What we will not do: put agents or scanning onto live control systems that were never designed for them, or push changes to equipment mid-production. Monitoring on the production side stays passive and at the boundary. If a control system genuinely needs specialist OT security work beyond this, we will say so and bring in the right people rather than improvise.
How it works day to day
Monitoring runs continuously, and quietly. You do not hear from us most weeks. When Cyrebro sees something real, it escalates and our team acts on it, including out of hours.
Patching and vulnerability work runs on a schedule against your production calendar, ranked by what would actually hurt.
Training runs like a toolbox talk. Short, frequent, plain, and about things your crew will actually encounter: a fake invoice, a text pretending to be the plant manager, a login prompt that is not quite right. Simulations are used to find where more support is needed, never to embarrass anybody. Naming and shaming is the fastest way to make people stop reporting.
Questionnaires get answered properly. When a customer sends one, send it to us. We help you answer it accurately, flag anything that needs fixing first, and keep the answers consistent between customers.
When something happens, one call. 24/7 emergency line: (+1) 866 853 2767
What this looks like in month one, and in month six
Month 1, Find out where you actually stand. An assessment of your current position: what is exposed, what is unpatched, who has access to what, whether MFA is in place, what is running unsupported. Endpoint protection and email security get deployed. Monitoring goes live. You get a findings report ranked by production risk, in plain language, with the three or four things worth doing first clearly marked.
Month 6, The questions get easier to answer. MFA is on everything that matters. Dormant accounts are gone. Vulnerability findings are trending down with a documented remediation record behind them. Your crew has done two or three short training rounds and people are reporting suspicious emails rather than quietly deleting them. When a customer sends a questionnaire, you answer it in an afternoon with evidence attached. And Cork coverage is in place behind all of it.
Cork coverage comes standard with membership
Every SafeIT member is backed by warranty-backed cyber financial protection, included rather than sold separately, and active once onboarding brings your environment up to Cork's required security baseline.
This is the part almost no provider offers, and the reason is straightforward: a warranty means the provider is willing to stand behind the controls it puts in place. How Cork coverage works, in full →
Who this is for
- Manufacturers receiving security questionnaires from customers with nobody internally able to answer them.
- Plants renewing cyber insurance and finding the application harder every year.
- Operations with unsupported systems on the production side and no containment around them.
- Businesses that have already had an incident, or a near miss, and do not want a repeat.
- Anyone who wants monitoring that is independent of the people administering their systems, because their auditor or insurer asked.
Why not just have you monitor us? You already run everything. Because we should not be the only ones looking. If we make a configuration mistake, we are the least likely people to notice it. Independent monitoring through Cyrebro means a finding gets reported whether or not it reflects badly on us, and separation of duties is specifically what insurers and customer auditors look for. It is the same reason your safety program has an external audit as well as an internal committee.
A customer sent us a security questionnaire and we don't understand half of it. Can you help?
Yes, and this is one of the most common reasons manufacturers first call us. We go through it with you, translate what is being asked, tell you honestly which answers are currently "no," and give you a plan to change the ones worth changing. We do not help anyone answer a questionnaire inaccurately. That risk lands on you, not on us.
Can you get us NIST certified?
No, and be careful with anyone who says they can. NIST is a framework, not a certificate we issue. What we do is readiness: map where you currently stand against what your customer is actually asking for, close the gaps that matter, and produce the documentation and evidence you need for the review. See NIST readiness. If you need a formal audited certification, that comes from an accredited body, and we will prepare you for it and say plainly that we are not the ones granting it.
Our plant is small. Are we really a target?
The honest answer is that most incidents we see are not targeted at all. They are opportunistic: an exposed remote access service, a reused password, an email that got through. Nobody chose you. That is why the basics matter more than any product: multi-factor authentication, patching, separated networks, tested backups and a crew that knows what to report. Get those right and you have dealt with the large majority of realistic risk.
What this means for your plant
Independent eyes watch your network 24/7, so we are not marking our own homework. The basics come first: MFA, patching, separated networks, and a crew that knows what to report. Every member is covered by Cork, with an initial payout in under an hour.
Related
- Pairs with Business continuity & disaster recovery: detection is only useful if recovery works.
- Pairs with Network & infrastructure: segmentation is the highest-value control on this page.
- See also Legacy & critical-system continuity and Managed IT & helpdesk.
- Training and NIST readiness in Resources.
- Membership: the policy pack, training and Cork coverage come with it.
- Cork coverage
- Book a free assessment: a plain-language review of where you stand, and you keep the report.
- All services · Partners · Contact