In today's interconnected society, our data is a fundamental part of our personal and professional lives, informing everything from the way we communicate and collaborate with our colleagues to the way we do our weekly shop. Seamless, secure flows of data have transformed the way we access many critical services and helped bring a rich vein of new innovations to market, but as with any period of intensive technological evolution, these benefits have come at a price…
In a highly unpredictable geopolitical landscape, the growing volumes of data created, stored, and transferred by public sector and enterprise organisations present an extremely attractive target for bad actors, as does corporations' intellectual property and citizens' personal data. It's unsurprising that organisations across the public and private sectors are treating the continued integrity of their data as a critical priority - not only to avoid the financial and reputational consequences of a breach, but also to provide customers and prospects with assurance that their critical data will always be protected, both at rest and in transit.
Data sovereignty is a key part of this journey, by which we mean, in the broadest sense - guarantees over the geographical locations in which data may be stored. Most technology providers will already have such guarantees in place, typically involving the location of their hosting environments. However, with the now near-ubiquity of Cloud platforms and the growing complexity of security and compliance, the nature of true data sovereignty is no longer so clear.
With this in mind, consider the following questions when evaluating Cloud providers…
Is your Cloud provider fully incorporated in your desired location? While they may maintain hosting environments there, can they say the same for the Cloud platforms you will be utilising, particularly if they are operating as part of a larger umbrella company? If not, you cannot guarantee that your data will remain within the country when in transit, which may lead to compliance and security issues
Will they maintain full jurisdictional control of all data? Related to the above point, with several governments having now implemented regulations that grant them access to data stored in Cloud platforms (e.g. the US Cloud Act), providers must be able to guarantee that customer data will never be subject to such overreach. This is especially critical for any sort of public sector data, particularly Government and defence.
Can they specify which personnel have access to their Cloud platforms? Again, all engineers who will be maintaining the Cloud platform and acting on behalf of customers must be based in their sovereign nation, with the appropriate clearances and certifications in place.
Does their data sovereignty extend to their disaster recovery and business continuity practices? The sovereignty of data centres must extend to back-up environments, which must also be located in the designated geographical region, with air gapping, data encryption, and zero-trust security measures utilised as appropriate, and all of this subject to annual audit.
Will they maintain full jurisdictional control of all data? Related to the above point, with several governments having now implemented regulations that grant them access to data stored in Cloud platforms (e.g. the US Cloud Act), providers must be able to guarantee that customer data will never be subject to such overreach. This is especially critical for any sort of public sector data, particularly Government and defence.
Can they specify which personnel have access to their Cloud platforms? Again, all engineers who will be maintaining the Cloud platform and acting on behalf of customers must be based in their sovereign nation, with the appropriate clearances and certifications in place.
Does their data sovereignty extend to their disaster recovery and business continuity practices? The sovereignty of data centres must extend to back-up environments, which must also be located in the designated geographical region, with air gapping, data encryption, and zero-trust security measures utilised as appropriate, and all of this subject to annual audit.
This is why Exponential-e has continued to develop our ability to guarantee true data sovereignty, in direct response to the evolving digital and geopolitical landscapes. To this end, we were recently certified as a VMware Sovereign Partner, reflecting our ability to provide complete assurance around the sovereignty and control of digital assets. The are multiple dimensions to this, including our hosting facilities, support, management, regional jurisdictions, security clearances, and ability to deliver complementary services, such as Bring Your own Key (BYoK) and both shared and dedicated Cloud environments. As a proudly UK-based company for more than twenty years, our full range of solutions is designed with true sovereignty inherent in the design – something we continue to develop in response to the latest regulations, geopolitical shifts, and security challenges.
If you are in any way concerned about the sovereignty of your data and your key platforms, do not hesitate to reach out to our team, who will guide you through these challenges, ensuring you can continue your Cloud journey with complete peace of mind.
Expert Insights
-
- Cloud
-
- Cross Sector
-
- Thought Leadership
1435 Hits
The Customer
The customer delivers more than 100-million meals to households across the UK each year. Their unique subscription-based service provides both fresh, pre-portioned ingredients and over 200 diverse recipe cards, inspiring customers to embrace the joy of cooking at home while keeping food waste to the absolute minimum.
Challenges
The nature of the customers' business, with high volumes of perishable goods needing to be delivered to highly dispersed locations across the UK within the most precise timeframes, places considerable demands on its systems and processes.
While the customer had already embraced a Cloud-native model, it increasingly found that its legacy Warehouse Management Systems (WMSs) were far too sensitive to fluctuations in latency, leading to errors in packing and labelling and negatively impacting warehouse staff's productivity. This, in turn, led to instances of late deliveries, spoiled produce, and inevitably, unhappy customers.
As a result, costly and time-consuming on-site deployments were required, in order to ensure seamless communication between its central office and five distribution centres across the UK. This, however, led to issues around scalability, as the customer's operations evolved, with an increase in online demand requiring the opening of new distribution centres.
As a result, the decision was made to engage with a trusted technology partner who would be able to create a standardised blueprint for the customer's technology infrastructure, encompassing Cloud, network, unified communications, and cyber security - all delivered in line with its unique operational requirements and with ample room to scale in the future.
The Solution
Based on an intensive period of consultation with the customer and its third-party vendors (including its WMS provider), Exponential-e designed and delivered a Cloud platform that would not only serve the immediate needs of its existing distribution centres in terms of performance, availability, and security, but also provide an agile, scalable foundation for the establishment of new facilities in the future.
This proposed solution encompassed:
- Further optimisations of the customer's existing Cloud infrastructure, incorporating several managed solutions, Dell HCI, and Dell Storage, with the capacity to support future AI-powered initiatives.
- The most stringent cyber security systems and practices inherent in the design, utilising multiple best-in-class platforms.
- Highly resilient, high-performance connectivity between sites, utilising AWS Direct Connect and Meraki LAN & WiFi, with Exponential-e's teams managing the on-site installation.
- True unified communications - powered by Cisco Webex, to ensure seamless cross-site communication and collaboration.
The final deployment was complicated by the onset of COVID-19 lockdowns, which limited Exponential-e's teams' access to the customer's premises when it was necessary for specialists to self-isolate, combined with Brexit-related disruptions to global supply chains, which frequently required alternative parts to be sourced at short notice. Exponential-e's well-established partnerships with multiple leading technology vendors proved critical here, ensuring components could still be sourced without affecting the designated launch date of each facility.
This new blueprint has already proven its effectiveness several times over, allowing multiple new distribution centres to be deployed with zero downtime and zero operational disruption. The resulting efficiencies and optimisations have already made a tangible impact on the customer's ongoing growth, with turnover increasing from £23m to £308m between 2017 and 2024.
Solution Benefits
- Consistent performance across six highly dispersed locations, with a standardised blueprint streamlining the process of opening new distribution centres
- Streamlined cross-site management of perishable goods, reducing food wastage and leading to a better customer experience
- A robust foundation for future AI-based deployments, further optimising efficiency across the entire supply chain and opening the door to true data-driven decision-making
- An increase in turnover from £23m in 2017 to £308m in 2024 - achieved without any downtime
2047 Hits
It's a challenging time for numerous sectors, particularly those responsible for delivering critical services to citizens across the UK. As attacks on national infrastructure by global bad actors increase in frequency and severity, organisations must be willing to do everything it takes to ensure their data is protected against not only the latest cyber threats, but any potential 'acts of God', such as outages or environmental disasters.
In other words, a new standard of resilience is required for the hosting solutions organisations across the public and private sectors depend on to deliver their services. Fortunately, leading-edge data centres - the breed utilised for hosting Government services - have made considerable strides in this regard, but for organisations to achieve this new standard, they must be able to identify both the right data centres, and the right technology partner to support the migration process.
If you are in the process of reconsidering your own hosting services, here are the key elements to look for:
Diverse networking and connectivity
No two organisations' networking and connectivity requirements will be exactly the same, especially when it comes to the delivery of critical services across the country. Truly world-class data centres will be built with this level of diversity inherent in design, offering a range of options for securely connecting to corporate infrastructure.
The right accreditations in place
Ideally, any data centre utilised for hosting critical data should be accredited to Pan Government Assured Official or higher. This represents a clear indication that the facilities in question maintain the very highest standards of cyber security, particularly when it comes to the hosting of Cloud services.
Effective business continuity systems
Even the smallest period of downtime will likely result in serious financial and reputational consequences, which means the time between systems going down and coming back online must be kept to the absolute minimum. The use of multiple, geographically dispersed data centres is a highly attractive option here, ensuring backup infrastructure can be deployed and data secured at the earliest opportunity in the event of an incident.
World-class physical security
While cyberattacks continue to grow in sophistication and cyber security ecosystems continuously evolve to stay one step ahead of bad actors, it is important that we do not underestimate the continued importance of physical security. In spite of the advances made in cyber security, human error remains the primary cause of data breaches, which means any data centres chosen to host critical data must have first-class systems in place to mitigate this risk, including access control, integrated cameras and alarms, a single point of entry, and additional systems to secure high-risk areas.
Robust SLAs
Finally, for complete peace of mind, each of these elements should be reflected in robust SLAs, with clear standards in place regarding availability, power, and cooling. 99%+ availability should be considered the baseline and clear disaster recovery processes should be in place.
Achieving a successful migration to the right data centre
Taking all of the above into account, there's no doubt that any data centre migration will present a significant challenge - from the choice of facilities to ensuring the migration does not lead to any operational disruption or security compromises.
Vysiion have long served as a trusted technology partner for numerous organisations across the public and private sectors in this regard, planning and executing bespoke migrations into the Government-approved Crown Hosting Data Centres, providing access to the numerous these world-class facilities offer in terms of performance, security, and resilience.
To explore your own current level of resilience and establish how best to ensure that you will always be able to stay ahead in an evolving digital landscape, even in the event of the unexpected, just contact us.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
642 Hits
Across the UK, people are increasingly conscious of the environmental impact of the products and services they consume in both their personal and professional lives. More and more, organisations delivering critical services are challenged by the Government and the public alike to demonstrate robust green credentials, and tangible evidence of their efforts to operate in a more sustainable manner at all levels.
As a result, numerous organisations are seizing the opportunity to examine every area of their operations and see what optimisations can be made to reduce the consumption of resources, without compromising security or performance, bringing them in line with the Government's Net Zero objectives, and positioning themselves as responsible, ethical companies in the eyes of those who utilise their services.
With higher and higher volumes of data generated each day - all of which must be stored in full compliance with the applicable regulations - and organisations across numerous sectors accelerating their Cloud transformation journeys, data centre operations represent an ongoing financial, operational, and environmental concern that must be considered as part of this process.
Considering a new breed of data centre
The challenge here is that data centres are inherently energy intensive facilities that consume huge volumes of power each day, and this is only going to increase in the years ahead as higher and higher volumes of data must be stored in a way that guarantees its security and integrity, while ensuring it remains accessible to authorised individuals. Nonetheless, considerable strides have been made in recent years, with a new breed of data centre allowing for environmental concerns to effortlessly co-exist with business ones.
The question then, is how organisations and their technology partners can achieve this 'best of both worlds' scenario. There are several key factors that must be considered when evaluating potential hosting facilities:
- The phasing out of fossil fuels in favour of renewable energy sources, such a solar power.
- Reducing waste, particularly water consumption, wherever possible.
- The implementation of air-cooling systems.
- Encouraging biodiversity, i.e. the range of animal and plant life in a given location.
- Achieving the lowest possible Power Usage Effectiveness (PUE) - a universally recognised measure of a data centre's energy efficiency.
Facilities such as ARK Data Centres offer a range of opportunities in this regard, with existing users having achieved reductions of as much 75% for electricity usage and 99.9% for CO2 emissions compared to legacy on-premises infrastructure - not just a triumph of sustainability, but tangible savings that can be passed on to customers and end users.
As a trusted technology partner for organisations delivering critical services across the country, Vysiion is an active supporter of this journey, and works closely with innovators such as ARK Data Centres to establish a new standard of best practice when it comes to sustainable data hosting. Whether you are planning a full-scale move to the Cloud or considering a hybrid model, we will work closely with your own teams to ensure the highest level of sustainability is inherent in the design, and can be maintained as your organisation evolves in the years ahead. Just contact us if you're ready to do your own part as an environmental superhero!
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
237 Hits
Across manufacturing operations, the physical and the digital are converging. Everywhere from factory floors to global supply networks, the growing volumes of data generated by physical hardware, the next generation of 'smart' devices - are in constant flow, allowing for micro and macro views of processes that would previously have been impossible to achieve. When it comes to developing more efficient, cost-effective, and intelligently integrated operations, the possibilities are truly immense.
Secure by Design
But as the sector explores how these new models can be used to bring new innovations to life, it is important that the ongoing challenge of security is not neglected. A recent report revealed that almost half of UK manufacturers had experienced a cyber security breach, with more than 25% of respondents experiencing financial loss as a result. As smart technologies and the IoT continue to establish themselves, a range of new attack vectors will be created across manufacturing operations - all of which bad actors will be ready and waiting to take advantage of.
While all manufacturers will already have both physical and cyber security systems in place, it is time to consider how these can evolve to best serve the new operational models emerging across the sector...
Don't discount the Purdue Model!
Introduced in 1992 by Theodore J. Williams and the Purdue University Consortium, the Purdue Model has long formed the basis of OT security ecosystems for manufacturing operations by providing a robust model for the associated digital workflows. It accomplishes this by dividing the underlying architecture in six distinct 'zones':
- Level 4 / 5: Enterprise zone
The primary network functions that help orchestrate manufacturing operations. - Level 3.5: Demilitarised zone
Firewalls, proxies, and other security systems designed to protect against lateral moving threats. - Level 3: Manufacturing Operations Systems Zone
The OT systems responsible for production workflows, i.e. day-to-day operations on the shop floor. - Level 2: Control Systems Zone
The systems that control and monitor physical processes and manage the data generated. - Level 1: Intelligent Devices Zone
The instruments that control the devices at level 0. - Level 0: Physical Process Zone
The devices that execute a range of physical actions throughout the production process, which may be connected to monitoring systems in the Cloud.
This model has proven its worth for more than thirty years now, supporting the design and delivery of security ecosystems that encompass both IT and OT. However, with the rise of the IoT and smart devices, as well as the increasing speed of Cloud transformation, the different zones can frequently become blurred, which has led some to question whether it is still applicable to modern manufacturing.
We would argue that although data may now frequently travel between several zones at once, the Purdue Model's segmentation still provides a helpful way of understanding the different ways in which data flows across manufacturing operations and -critically - the potential attack vectors that are created as it does so. The new breed of cyber security for manufacturing must build on this well-established approach, along with considering emerging standards like IEC 62443, the zero-trust model, and the NIS-Directive due to come into force in October of this year, in order to ensure the integrity of these complex dataflows.
Agile security for agile operations
Establishing this new model of cyber security will be very much a journey rather than an event - one that requires close collaboration between manufacturers and trusted technology partners who cannot just demonstrate substantial experience within the sector, but also around the successful integration of IT and OT. Vysiion has been a long-time supporter of the manufacturing sector in this regard, working closely with industry leaders to ensure their security ecosystems remain fit for purpose and support the ongoing innovation for which the sector is renowned.
To explore how to optimise the security of your own manufacturing operations, while simultaneously embracing the opportunities opened up by the convergence of IT and OT, do not hesitate to contact us.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
251 Hits
Across the UK, the security of Critical National Infrastructure (CNI) is a growing concern, as the increasingly interconnected nature of the systems we depend on create a whole new range of potential attack vectors - all of which global bad actors are already racing to take advantage of, executing a range of increasingly insidious, sophisticated strategies to compromise the systems on which we all depend.
With this in mind, it is essential that the CNI sector as a whole is ready to work closely with its technology partners to establish a new standard of security - one that encompasses both IT and OT, ensuring that their increased and ongoing convergence does not put the integrity of our critical data at risk. This presents a number of challenges when we consider the highly remote nature of most CNI environments, the inherent complexity of the resulting cross-site dataflows, and the need for a cyber security posture that ensures reliable and remote access can still be provided, when required.
What is a Demilitarised Zone (DMZ)?
A DMZ is combination of equipment (including, but not limited to, routers, firewalls, and switches) deployed when third parties require secure remote access to certain assets within the site. It accomplishes this by segmenting the on-site network, based on access rights and security policies on a per user or per team basis, so the measures taken to grant access (e.g. opening the ports on firewalls) can be automated, reducing the need for manual intervention. Dual-factor authentication is the applied to ensure only an "allow-list" of individuals can gain access. This way, it is impossible for bad actors to access the assets in question without gaining control of the designated individuals' own equipment, allowing seamless remote access to coexist with a robust security posture.
A DMZ is a key security tool for any challenging and remote CNI environments (e.g. offshore windfarms) where providing third parties with on-site access will not typically be an option, due to cost, safety, and compliance obligations. However, while the concept is ostensibly simple, putting it into practice is challenging…
Securing the most complex CNI environments
The process for creating an effective DMZ will naturally vary from site to site, depending on the nature of the systems and the access rights that will need to be established and implemented. This all begins with a pro-forma document, setting out the systems that need to be secured (including all IP addresses and subnets), the teams, individuals, and their roles that require access, and the tools and protocols they will be using to do so.
In other words, it is an inherently bespoke process that demands a keen understanding of the convergence of IT and OT, the new dataflows this creates, and how these can be secured without compromising operational performance. Any DMZ project must begin with a period of in-depth consultation to collate all the information required for the design and deployment phases. This will be followed by a period of intensive testing and review to ensure the pro-forma is correct and has been correctly executed.
Once the DMZ has been established, it will need to be continually monitored, audited, and updated, as policies evolve, team members join and leave, and new security vulnerabilities emerge. This will require CNI organisations to cultivate strong, long-lasting partnerships with their technology providers, entrusted to provide ongoing support and consultation as the threat landscape evolves.
If you would like to explore the security of your own CNI environments, do not hesitate to contact the team. Vysiion has served a trusted technology partner for organisations across the UK's CNI sector since 1996, delivering over £200 million of projects on an international scale. As part of this, we have designed, deployed, and continue to manage and maintain a range of leading-edge DMZs, drawing on our deep knowledge of IT / OT integration and Cloud transformation, and utilising the full range of our evolving solution portfolio. Whatever the nature of your sites, dataflows, and security requirements, we will work closely with you to deliver a tailor-made solution that optimises both data protection and operational efficiency, then work closely with you to maintain it as the threat landscape evolves.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
427 Hits
The Cloud has fundamentally changed the way organisations across a range of sectors design, manage, and scale their IT infrastructure. In many cases, this has allowed them to stay abreast of unexpected shifts in the digital landscape while retaining full control of ongoing costs and turning their growing volumes of data into a powerful source of business insights. But when it comes to digital transformation, there's no such thing as a one-size-fits-all solution. At Vysiion, we've seen this over and over again throughout our work with organisations operating in some of the harshest environments, with some of the most rigorous security and compliance requirements.
In many such cases, where critical applications and data need to be available in as close to real-time as possible, the only answer is to locate hardware at the edge, which naturally limits opportunities for Cloud transformation. However, now more than ever, technology tends to evolve to fulfil the most specific requirements, especially when organisations and their technology partners work in close collaboration to drive new innovations. In fact, we may already be seeing such solutions emerging in response to these singular requirements…
Hyperconverged Infrastructure opens the door
to next-gen hybrid Cloud
Azure Stack HCI, for example, offers a new approach to Cloud transformation that enables specific systems to be maintained at the edge, where necessary – a true hybrid approach that allows Cloud platforms to be seamlessly integrated with edge computing environments to achieve the desired functionality.
The use of containerisation and virtual machines offers a level of control and flexibility that would be difficult, if not impossible, to execute exclusively with on-premises systems, while still ensuring data sovereignty and compliance obligations can be met. For additional layers of security and resilience, integration with Azure Security Center and Azure Defender is available, along with built-in redundancy.
All of this can be manged through a centralised control panel, allowing for complete visibility of operations and data flows, even for the most remote locations.
This approach has huge implications for AI and IoT projects at the edge, allowing for real-time monitoring and analytics, combined with intelligent automation of routine processes to maximise operational efficiency.
But, once again, this is not without its limitations, as standard hardware is rarely suitable for the harshest, most challenging environments – such as military zones, highly remote energy sites (e.g. oil rigs and offshore windfarms), or industrial conditions – which may make Azure Stack HCI challenging to implement.
Is ruggedised Azure HCI the ultimate edge computing solution for Defence, CNI, and Manufacturing?
It is clear that Azure Stack HCI's potential across these sectors is enormous. We must therefore consider how it can be implemented in such a way as to access all the possible benefits, while still maintaining the security and resilience of critical infrastructure in situations when environmental conditions may lead to failures.
However, based on a range of ongoing conversations with our customers and technology partners, we would argue that such measures are already available. By combining Azure HCI's full range of capabilities with high-quality, ruggedised hardware, true 'always-on' operations can be established, with seamless, highly secure flows of critical data between edge devices and the Cloud.
Whatever environments you operate in, and whatever your digital goals are at the edge, in the Cloud, or both, do not hesitate to contact us. Drawing on our deep experience designing bespoke digital transformation solutions to the most rigorous specifications, our teams will work closely with you to achieve your long-term goals, and so help establish a new standard of digital best practice across the most challenging sectors.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
567 Hits
With the new UK Network and Information Systems (NIS) regulations launching in October 2024, intended to boost the whole CNI sector's operational resilience and ability to manage cyber risk, Operators of Essential Services (OES) must be ready to take a proactive, structured, and auditable approach to security in order to achieve and maintain full compliance with the new legislation.
However, the resilience of CNI systems presents a number of singular challenges, all of which must be given careful consideration as we prepare for the new legislation's official launch. Central to this, any downtime not only costs millions but can leave citizens without critical services and - in extreme cases - damage assets and put people at risk of injury.
As will become clear, this process is very much a journey rather than a one-off project, but with the support of trusted technology partners, it will help to ensure the critical services that citizens depend on remain secure and available, able to weather the most sophisticated attacks.
The following should be considered the first steps of this journey, not only in terms of achieving full NIS 2 compliance, but also for establishing a whole new standard of operational resilience across the UK's entire CNI sector…
Identifying the hidden assets within CNI infrastructure
The OES must be able to provide details of what essential services, functions, systems, and sites, are within the scope of the NIS regulations.
Managing, monitoring, and updating legacy infrastructure, remains a vital element of cyber security best practice. However, CNI systems frequently include legacy OT assets that are deeply embedded and difficult to replace without unacceptable risk or disruption to critical operations. Unfortunately, this may only become apparent when the asset in question needs to be remediated and/or fails to restore after an update.
A proactive approach to the management and support of CNI OT systems is an essential component of NIS compliance. This should include monitoring tools that provide visibility of all assets and dataflows, and the ability to detect and alert security threats.
Fortunately, there are three references that support the journey:
- The Purdue Model. A well-established model for the segmentation of assets within ICS networks and the hierarchy of dataflows between them, based on four/five distinct 'zones'.
- Cyber Assessment Framework. A structure and collection of outcome-based resources for organisations to follow, providing a reference guide to help build robust cyber resilience plans.
- IEC 62443. An internationally recognised standard for the security of control systems, and the cyber security lifecycle. There are numerous elements to this, but of particular importance is planning end-of-life support for any new assets introduced into a system.
A full audit of all assets, based on these three models, is therefore the first step towards secure CNI, ensuring all legacy infrastructure has been accounted for and factored into the design of the security ecosystem. This should not only cover the assets themselves, but also the data they generate, how the data is processed, stored, and disseminated, what data needs to flow through the iDMZ, and what data needs to be accessed through a secure gateway.
The increasing convergence of IT and OT means that physical security systems (i.e. cameras and locks) must also be factored into the auditing process, something that we will explore in depth in a future article.
Know your infrastructure, understand the threat landscape
The OES must take appropriate and proportionate measures to prevent and minimise the impact of a cyber incident.
The next step is the implementation of an Intrusion Detection System (IDS), which can then normalise dataflows across the entire infrastructure and establish a baseline, so any anomalies can be automatically detected. This doesn't just mean security issues – it could also means planned maintenance, the deployment of new hardware, or elements of a specific project. Regardless of the cause, as soon as a deviation from the established baseline has been detected, the CSOC should receive an automatic alert.
This can then be expanded to draw on wider threat feeds, ensuring security teams are able to proactively secure against the very latest threats, and conduct rigorous post-mortem procedures after a validated cyber incident. Likewise, if the alert is a consequence of new assets being added or a network re-configuration, the IDS toolset can be used to establish a new baseline.
A systematic approach to testing and patching
In a heightened threat landscape, effective testing and patching is critical, but the OES must balance this against critical IT/OT systems' unique operating models.
Once full visibility of all assets and dataflows has been established, it is time to prepare for the worst. With cyberattacks against CNI systems now a near-certainty, it is unfortunately a question of 'when' not 'if' a breach occurs, which means a proactive approach to maintaining the security of all physical and digital assets is essential.
While most organisations will already have some form of regular cyber security testing in place, default IT methodologies are not suitable for integrated IT/OT systems. For example, it is common to automate patching for IT systems, ensuring the latest security updates are implemented as soon as they become available. However, this represents a significant risk for critical, high-availability OT systems and an alternative approach must therefore be taken, with testing and patching carefully controlled and co-ordinated.
Threats and vulnerabilities must be categorised and prioritised on a 'now', 'next', and 'never' basis, supported by a rigorous bi-annual maintenance schedule, undertaken by a trusted third-party. Any partner undertaking such a role must be able to demonstrate proven experience in the convergence of IT and OT and the three methodologies discussed earlier, as well as the ability to supply UK NSV-cleared staff.
NIS 2 compliance and beyond – a unique model of operational resilience
Failure to comply with these obligations could result in enforcement action and penalties, including fines of up to £17 million, depending on the severity and duration of the non-compliance and the harm caused.
As the new NIS 2 fast approaches, CNI's critical IT and OT systems need to evolve at pace. But as they do so, they must accommodate the operational complexity of high-availability systems and sector-specific constraints. When we give this deeper consideration, it becomes clear that the new NIS 2 is very much the latest step of a much longer journey. The decision-making involved – both now and in the years ahead – will be inherently complex, making the support of the right technology partner essential.
Contact us if you'd like to discuss anything we've covered here, and any other aspects of the new NIS 2 regulations before they come into effect. Our highly consultative approach and edge-to-core knowledge of OT and IT technology means that Vysiion are perfectly placed to support you on the journey to compliance and beyond.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
631 Hits
The Customer
A well-established leader in British hospitality & leisure, operating numerous world-class pubs and hotels across the country.
The Challenge
With the ongoing move towards a truly cashless, interconnected society, the customer's legacy connectivity was increasingly showing its limitations, unable to handle the growing volume of card payments made on a daily basis, or guests' growing expectations around interconnected systems and amenities – all of which place considerable demands on network infrastructure.
The growing need for a new network foundation was exacerbated by the impending PSTN switch-off, which would render numerous legacy connections unavailable. As a result, the decision was made to execute a full refresh of the network, ensuring it would continue to deliver the required resilience, availability, and security across 350 sites.
A key priority was achieving sufficient capacity to accommodate the most data-intensive applications – including cashless payments, online bookings, app-based ordering, and Sky TV in all rooms. This would need to be fully consistent across all sites, in all rooms, including in proposed future sites where the incumbent provider could not provide the necessary connections. The entire project would need to be completed in advance of the PSTN switch-off, taking into account the specific regulations around the wide range of heritage sites in which the customer operated – a fundamental part of its brand identity and guest experience.
Solution
Exponential-e provided the required connection between all sites in which the customer is active, adopting an altnet vendor-agnostic approach that utilised the optimal provider for each of the customer's locations, including its own enterprise-class network. Working closely with internal teams, a comprehensive roadmap was established, with priority given to key sites in order to minimise any operational disruption and ensure the entire migration could be completed in advance of the PSTN switch-off.
Exponential-e's teams also worked on-location at the customer's 150 heritage sites across the country, ensuring that all work was conducted in full compliance with the applicable regulations, helping maintain the unique beauty of each building.
With this new foundation in place, the customer was able to achieve its goal of minimising the day-to-day handling of cash, resulting in more than £1m of savings through risk and labour reductions, while simultaneously providing the resilience and scalability needed to drive further service optimisations and innovations, in line with its long-term strategy of focusing on premium experiences. In the months since, the customer has enjoyed ample opportunities to scale up operations, enter new locations, and seize new opportunities to further enhance the overall guest experience.
Solution benefits
- Sustainable cost saving in excess of £1m, all of which can be reinvested in further service enhancements
- A seamless migration from legacy infrastructure to a scalable, highly available, futureproof network
- Sufficient network capacity to deliver the interconnected experiences guests expect across 350 sites, even in the most remote locations
- An altnet vendor-agnostic approach, delivering the optimal connections to each site, regardless of location
- Network upgrades executed in 150 heritage sites, maintaining their beauty in line with all applicable regulations
- Minimised handling of cash in daily operations, reducing risk and labour costs
- Ample scope to implement further improvements to the guest experience, such as digital signage, app-based access to amenities, and smart-tech equipped rooms
We benefit very highly of the network redundancy we have in place with Exponential-e, it allows our business to remain connected so that all of our managed pubs and hotels can trade and take payments
Server & Network Supervisor
1147 Hits
The ongoing evolution of our nation's Critical National Infrastructure (CNI) requires large-scale CAPEX investment in core infrastructure, along with the introduction of digital initiatives that support the convergence of physical and digital systems, enhancing performance, efficiency, and availability. This presents a multi-dimensional challenge for CNI organisations, who are often forced to accelerate or adapt their long-term transformation roadmaps, whether this means scaling, restructuring, preparing for an exit or investment, or a combination of all three.
In parallel, the increasing deployment of digital technology amongst Operators of Essential Services (OESs) has led to a range of new security and compliance challenges. When shareholders are made aware of these risks, they - correctly, demand reassurance that their high-value investments will be protected.
For this reason, technology partners supporting CNI verticals must be alert to the requirements of a diverse stakeholder community, offering informed advice throughout the investment process, providing an accurate assessment of risk and compliance challenges, and translating often conflicting priorities into deliverable actions that will drive business growth.
Let's consider how this should work in practice...
Enabling data-driven decision-making throughout mergers and acquisitions
When physical and digital assets are seamlessly and securely interconnected, operators enjoy access to rich veins of real-time data around the status of key platforms. This data can be used to accurately benchmark all security and operational risks against technical and regulatory compliance, establishing their potential impact on service availability and, in turn - the predicted ROI.
When this level of visibility has been achieved, improvements in both efficiency and profitability are unlocked, benefiting the wider stakeholder community and enabling more informed decision-making throughout every stage of mergers and acquisitions, including:
- Pre-acquisition due diligence: Identifying technical debt and flaws, establishing security and compliance risks with a concrete value for their remediation.
- Post-acquisition investment: Establishing OPEX costs needed to support effective systems and processes to ensure the continued security and compliance of critical infrastructure.
- Exit readiness: Creating a definitive, auditable log of critical assets, reflecting full regulatory compliance and the ability to meet investor scrutiny.
Specialist IT / OT advisory and support to protect investments
This role can be taken further, with technology partners serving as advisors to PE firms and mid-cap boards, providing them with the technical and operational oversight they need to protect and validate their investments. This should begin with rigorous technical (i.e. the IEC62443 standard) and regulatory (i.e. NIS-2018 / CAF) assessments, conducted in line with the overall risk appetite and corporate strategy. Once these information streams have been established, they can be used to augment CIO and CISOs' capabilities, bridging the knowledge gap between enterprise IT and OT systems and optimising governance and risk management.
When it comes to making informed investments in critical infrastructure, the value of objective, strategic guidance from experienced specialists cannot be overstated. Technology partners who are able to support IT leadership in this way will evolve from pure providers to true enablers of business growth, providing tangible value to investors while optimising the performance, security, and availability of critical services.
If you require guidance around any planned or existing investments in CNI infrastructure, contact us to arrange a consultation of potential risks and a detailed assessment of how they can be mitigated, based on globally recognised standards and our deep experience across multiple CNI verticals, including Energy, Utilities, Transport, Defence, and Industry.
Cyber-Secured Engineering
This brochure sets out the Exponential-e Group's pedigree across the CNI sector, and our full range of capabilities, with real-life case studies of our ongoing work with leaders and innovators across the sector.
800 Hits
Across the Hospitality & Leisure sector, more and more data is generated and stored than ever before, throughout every stage of the guest experience. From the initial check-in, to accessing amenities, and post-visit engagement, the modern guest experience is truly interconnected, offering hospitality professionals numerous opportunities to build brand loyalty and develop powerful USPs. It's a transformative time for the sector as a whole, but these growing volumes of data present an extremely attractive target for bad actors. We just have to look at the growing number of high-profile breaches in recent years - where the targets have been left unable to trade and forced to contend with operational disruption, financial penalties, and reputational damage – to see the potentially irreparable effects of such attacks.
It's no surprise that guests expect concrete reassurance that their data will remain secure throughout the duration of their stay and beyond. As a result, organisations across the sector are investing in their cyber security ecosystems, phasing out legacy systems in favour of Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms that provide fully centralised control and visibility of highly dispersed sites.
The challenge here is that the right digital investments are just the first step towards developing a robust cyber security posture. As seasoned hospitality professionals will already be very much aware, when people and technology come together, great things happen. And it's the same with cyber security.
SIEM and SOAR platforms provide rich veins of actionable, real-time security data in the form of logs, alerts, and analytics. However, far too many organisations investing in such platforms fail to consider how this data will be acted upon, and how a real security alert will be managed. Indeed, in many cases, their internal IT teams simply lack the time and resources to do so - a situation compounded by the growing diversity of cyber security portfolios, where multiple platforms from different providers have been integrated.
This is where a Security Operations Centre (SOC) becomes essential. A world-class SOC combines skilled analysts, defined processes, and supporting technologies to monitor, investigate, and respond to potential threats in real time. Without this operational layer, the expected ROI of digital platforms all-too-often fails to materialise, and in a worst-case scenario, the lack of defined processes may even lead to a security breach going undetected.
However, for many hospitality providers, building and maintaining an effective SOC in-house can be prohibitively challenging, and so there is a strong case to be made for implementing managed SOC services, as many across the sector have already found. Here, trusted partners' own specialists provide round-the-clock monitoring and response, acting as an extension of internal teams. This approach allows organisations to develop a stronger, more agile security posture, while simultaneously enabling internal resources to remain focused on delivering exceptional guest experiences.
So, if you're in any doubt about your overall security posture - whether that's systems, processes, or both - don't hesitate to contact us. Based on a thorough evaluation of your existing systems and processes, we will work closely with you to design, deploy, and maintain a cyber ecosystem that fully supports your day-to-day operations, freeing you to focus on delivering seamless, exceptional experiences for every guest, every time.
A comprehensive overview of digital transformation for the entire Hospitality & Leisure sector.
- Building your guest experience on the right digital foundation.
- Ensuring your infrastructure continues to evolve with your business.
- Turning one-off guests into loyal, repeat customers.
1212 Hits
An AI-powered Approach to Delivering Local Government Services
The UK's local councils are challenged on a growing range of fronts. Budgets and resources are shrinking, but citizens' expectations around the quality and availability of the full range critical services must still be fulfilled, whether this involves making sure the bins are always collected on time, or ensuring the most vulnerable are able to access the support they need. Indeed, at the time of writing, one local council's list of services runs to seventeen pages, with over four-hundred individuals involved in their delivery.
Put simply, councils' frontline staff are being forced to do more with less, making these highly complex service environments prime candidates for intelligent automation. But, as is often the case when it comes to the deployment of agentic AI technologies - there's a lot to consider if the initial investment is to deliver the desired outcomes. Consider the following:
- 66% of councils have trouble understanding where AI can deliver the greatest value.1
- 43% of local councils saying the lack of clear use cases is a barrier to AI adoption.2
While many councils have already realised agentic AI's applications for purely transactional services (e.g. the payment of parking fines or council tax), it is clear that a deeper understanding of its potential applications is still needed.
One common misunderstanding around AI is that it is best used to replace human agents wherever possible, but this is a fatal misconception. This technology's full potential is as an enabler and enhancer of human expertise and experience, allowing frontline staff to consistently deliver their best while simultaneously ensuring their wellbeing is protected.
Consider a list of services like the one we touched on at the beginning of this article - a quite typical service wrap for local Government organisations. No human agent could sensibly be expected to be able to deliver that many services, but at the same time, hiring individual specialists for every area is not going to be practical when doing more with less is the order of the day.
Agentic AI offers a third way, automatically putting the information and resources agents need to deliver successful resolutions right at their fingertips, without requiring them to manually parse complex knowledge libraries.
AI's ability to translate high volumes of data into an actionable form in real-time is unprecedented. Critically, this does not just have to mean formal knowledge bases that Government departments maintain themselves - it can also browse relevant websites, PDFs, and other sources of information, collating their findings in agents' dashboards in response to the most specific queries, including providing practical steps towards a resolution. This not only significantly eases the pressure on frontline staff, but can also reduce the time and expense involved in training new agents or broadening the capabilities of existing ones.
AI's ability to translate high volumes of data into an actionable form in real-time is unprecedented. Critically, this does not just have to mean formal knowledge bases that Government departments maintain themselves - it can also browse relevant websites, PDFs, and other sources of information, collating their findings in agents' dashboards in response to the most specific queries, including providing practical steps towards a resolution. This not only significantly eases the pressure on frontline staff, but can also reduce the time and expense involved in training new agents or broadening the capabilities of existing ones.
At Exponential-e, we're already working closely with a number of Government organisations (and numerous others from across the public and enterprise sectors) to bring these concepts to life and establish a clear standard of best practice around where and how agentic AI is implemented. These "cyber advisors", as they are increasingly called, are transforming the way local Government's contact centre environments operate, ensuring citizens enjoy the fastest possible resolutions, while simultaneously freeing up time and resources that can be reinvested in other public services.
Of course, this must all begin with the right foundation - specifically, a thorough assessment of an organisation's current customer journey, which will reveal where the implementation of agentic AI will bring the greatest possible benefits, and how the necessary changes can best be executed. Contact us today to arrange your own consultation and take the first step towards building your own team of world-class cyber advisors.
A secure digital foundation for better citizen outcomes, operational resilience, and long-term value.
Public sector organisations are under pressure to deliver more with less while meeting rising expectations for secure, always-available services. This guide shows how an integrated approach to connectivity, cloud, cyber security, and communications creates the resilience, scalability, and compliance government demands – turning digital strategy into real community impact.
1423 Hits
An exceptional customer journey extends far beyond the initial point of sale. And nowhere is this truer than for subscription-based businesses, whose continued success is based on delivering consistently seamless, high-quality experiences throughout each customer's time as a subscriber - from the initial sign-up through to the point where they decide to terminate their subscription for whatever reason.
Indeed, these new models have transformed the way many businesses interact with their customers, applying lessons learned from established subscription-based services, such as gyms and streaming services. From both traditional retailers and ecommerce specialists offering scheduled deliveries of household essentials, groceries, and entertainment products, to the now-ubiquitous software-as-a-service model and premium subscriber options on popular social media platforms, there are numerous channels for forward-thinking businesses to establish 'sticky' streams of income, with more still to reveal themselves.
However, the rules around offering and managing subscriptions and memberships of any sort are about to change, particularly with regards to cancellations…
Throughout 2026, the Competition and Markets Authority (CMA)'s regulations around buyer protection and autorenewals are going to evolve, as part of the existing Digital Markets, Competition and Consumers Act 2024 (DMCC Act), in order to help consumers avoid getting trapped in unwanted subscriptions. Organisations found to be in violation of these new regulations can expect to face fines of as much as 10% of their annual revenue.
As a result, any retailer that offers subscriptions or memberships of any kind must be aware of how these changes will impact them in the months ahead and, adapt their systems and processes to ensure they remain fully compliant with all applicable regulations, and - most importantly - ensure that they are still able to offer a world-class experience for their subscribers.
So, what's about to change and how can we best prepare?
- Specific pre-contract information must be provided. The DMCC Act distinguishes between key pre-contract information and full pre-contract information. Both must be provided in full at the initiation of the contract, or the customer will not be bound by the stated terms. Compulsory elements include:
- Full details of payments, include frequency and amounts.
- Minimum total liability.
- Schedule of reminder notices.
- Full cancellation rights.
- Reminder notices will be compulsory. It is no longer enough to assume a customer will automatically want to renew their subscription. Reminder notices must be sent in advance of the renewal date.
- Cooling-off periods will also be compulsory. This applies to both new subscriptions and renewals. Customers must have 14-day window to cancel their subscriptions without penalty.
- Cancellations must be as simple as possible. Cancellation instructions must be provided, and the process must not include any unnecessary steps. This also applies to online subscriptions. Confirmation must be provided within 24 hours.
There's certainly a lot to consider here, but rather than treating these changes as onerous compliance obligations, why don't we treat them as an opportunity to reconsider the overall subscriber journey, and look for new opportunities to enhance it?
Traditionally, when a customer wishes to cancel a subscription or membership, they've done so by speaking to an agent, who will then have the opportunity to discuss their reasons for cancelling and potentially offer some perks to change their mind. In light of the changes mandated by the new DMCC, this is unlikely to be practical in the majority of cases, when customers are able to unsubscribe with a single click. This has the potential to create a serious loss leader for subscription-based businesses whose customer engagement strategy is based on an initial discount or free gift (e.g. the first month's delivery is free, after which the subscriber pays the usual rate), as there is nothing to stop customers hitting 'unsubscribe' right before their first payment is due.
However, with agentic AI and intelligent automation currently transforming both the contact centre environment and the wider customer journey, numerous opportunities have presented themselves to ensure full compliance can seamlessly co-exist with personalised experiences that maximise long-term retention and build brand loyalty.
For example, if someone is looking to cancel via a page on your website and you have already implemented a chatbot function that they use to request a cancellation, the bot can automatically engage a real customer service agent, who can discuss the reasons for their cancellation, provide any hands-on support they need, and (ideally!) offer any perks or resolutions that will entice them to stay.
If your contact centre environment and chatbot functions have been intelligently integrated (as they should be!), these interactions can then be utilised to drive further optimisations, such as ensuring cancellation requests are routed to agents who have the best records of retaining customers, or ensuring agents don't invest their time and effort on accounts that have no realistic chance to renewing their subscriptions. For example, AI-based analytics can identify trends in customer data, such as individual addresses that have signed up for multiple trials but never made a purchase, which will allow agents to focus their attention where it will prove most effective.
And of course, the best approach to minimising cancellations is ensuring customers never want to cancel to begin with! All the data gather through customer interactions - whether it's with an agent or chatbot - can help build up more accurate, comprehensive customer personas that support highly personalised offers, helping to maximise the number of subscription renewals.
Above all, while regulations evolve and customer expectations naturally shift, the value of a personalised experience, delivered by an attentive, knowledgeable professional is a constant for the Retail sector. If we keep this in mind while making full use of the possibilities AI-powered automation offers us, the opportunities will be tremendous.
If you'd like to take a deep dive into your own customer journey and identify where the intelligent application of new technologies could make that all-important difference, just get in touch.
Exponential-e & Retail
Our Retail brochure offers a comprehensive overview of how we draw on a deep understanding of the sector's singular challenges, an evolving technology ecosystem, and a highly consultative approach to offer bespoke solutions that help staff deliver their best for every customer - both online and in person.
1553 Hits
© 2026 Exponential-e Ltd. Reg. No. 04499567, Reg. Address:100 Leman Street, London E1 8EU