Sector experience where the stakes are highest.
Adversaries specialise by sector, and so do we. Each practice brings knowledge of the systems, suppliers, regulators and failure modes that define an industry, so that response and advice fit the business rather than a template.
Financial Services & Insurance
Banks, insurers, asset managers, payment institutions and fintechs operate under the most demanding resilience regimes in EMEA: DORA, PCI DSS, Central Bank rules in the UAE and the Gulf, and the expectations of their own customers.
Threats we see
- Business email compromise and payment diversion
- Ransomware against core banking and insurance platforms
- Credential and session theft against customer portals
- Third-party and cloud provider compromise
- Insider misuse of privileged access
Typical engagements
- DORA ICT risk framework, incident classification and TLPT planning
- Threat-led penetration testing aligned with TIBER-EU
- Panel incident response for cyber insurers and brokers
- Fraud investigations and evidence for recovery actions
- 24/7 managed detection with regulatory reporting support
Regimes and standards
Energy, Utilities & Critical Infrastructure
Operators of essential services face adversaries that target availability as much as data. Resilience here means protecting operational technology without disrupting it, and meeting NIS2 and national critical infrastructure obligations.
Threats we see
- Ransomware spreading from IT into OT networks
- Compromise of remote access used by vendors and engineers
- Exploitation of exposed industrial and edge devices
- State-aligned pre-positioning in control networks
- Supply-chain compromise through integrators
Typical engagements
- OT and ICS security assessments with passive-first methods
- Incident response in mixed IT and OT environments
- NIS2 risk management and incident reporting programmes
- Segmentation and remote access hardening
- Detection engineering for industrial protocols and jump hosts
Regimes and standards
Manufacturing & Industrial OT
Manufacturers are among the most frequent ransomware victims in Europe because downtime is immediately expensive. We help plants keep running, investigate incidents without halting production and harden the links between enterprise IT and the shop floor.
Threats we see
- Production-halting ransomware
- Theft of design data and intellectual property
- Compromise of ERP, MES and engineering workstations
- Legacy systems that cannot be patched
- Supplier portals and EDI connections as entry points
Typical engagements
- Ransomware response with production-first recovery sequencing
- Plant network assessments and segmentation design
- Supplier and connectivity risk reviews
- Cyber Resilience Act readiness for connected products
- Tabletop exercises for plant and executive teams
Regimes and standards
Government & Public Sector
Public bodies hold sensitive citizen data, operate services that cannot fail and are frequent targets for both criminal and state-aligned actors. We support ministries, municipalities, agencies and public enterprises with discreet, evidence-grade work.
Threats we see
- Ransomware and data publication by extortion groups
- Espionage and credential harvesting campaigns
- Compromise of shared service providers
- Hacktivist denial of service and defacement
- Insider threats and data leakage
Typical engagements
- Incident response with public communication and regulatory support
- Security assessments of citizen-facing platforms
- NIS2 and national framework alignment
- Threat intelligence on actors targeting public bodies
- Crisis exercises for leadership
Regimes and standards
Healthcare & Life Sciences
Hospitals, clinics, laboratories and pharmaceutical companies combine life-critical systems with highly sensitive data and complex supplier ecosystems. Incidents here demand speed, care and precise regulatory handling.
Threats we see
- Ransomware disrupting clinical operations
- Theft and publication of patient data
- Compromise of medical devices and clinical networks
- Supplier and SaaS platform breaches
- Research and trial data theft
Typical engagements
- Clinical-aware incident response and recovery sequencing
- Data exposure assessments and notification support
- Medical device and clinical network assessments
- ADHICS, GDPR and PDPL compliance programmes
- Managed detection for distributed healthcare estates
Regimes and standards
Technology, SaaS & Telecom
Technology providers are the supply chain of everyone else. A single compromise of a platform, a CI/CD pipeline or a support tool can propagate to thousands of customers, which is why adversaries invest in them.
Threats we see
- Exploitation of internet-facing products and admin panels
- CI/CD and build pipeline compromise
- Cloud credential and token theft
- Customer-data breaches through support and ticketing tools
- Extortion campaigns against platform providers
Typical engagements
- Product and platform penetration testing
- Cloud and pipeline security assessments
- Incident response with multi-customer impact management
- Cyber Resilience Act and vulnerability handling programmes
- Threat intelligence on actors targeting SaaS and telecom
Regimes and standards
Retail, Hospitality & Travel
High transaction volumes, loyalty data, distributed sites and seasonal peaks make retail, hospitality and travel attractive targets. Downtime is measured in lost revenue per minute.
Threats we see
- Payment and loyalty data theft
- Ransomware against point-of-sale and booking platforms
- Credential stuffing and account takeover
- Brand impersonation and phishing of customers
- Third-party platform outages caused by cyber attacks
Typical engagements
- PCI DSS scoping and assessment support
- Incident response for distributed estates
- Brand protection and takedown services
- Web and API security testing of commerce platforms
- Managed detection across stores, hotels and head office
Regimes and standards
Transport & Logistics
Airports, ports, airlines, rail and logistics operators depend on shared systems and tightly coupled suppliers. The sector has learned that a single supplier outage can ground operations across a continent.
Threats we see
- Ransomware against shared operational platforms
- Supplier and ground-handling system compromise
- GPS, telematics and fleet system interference
- Data theft from passenger and customs systems
- Operational technology exposure in ports and rail
Typical engagements
- Supplier concentration and resilience reviews
- Incident response with operational continuity planning
- OT and IT assessments across terminals and depots
- NIS2 compliance for essential and important entities
- Crisis exercises simulating supplier outages
Regimes and standards
Your sector, our experience.
Tell us about your environment and the risks that keep your board awake. We will respond with a practical view, not a pitch.