Resilience Testing and Incident Readiness for a Production Plant

The challenge

A production plant had security procedures on paper but had never tested them under pressure. No one knew for certain how long it would take to notice an attack, or who would decide to stop or keep the lines running.

The main concern was not only technical: a prolonged production halt would hit deliveries and contracts. The plant needed to know whether detection, response and business continuity would actually hold up in practice.

My approach

I designed a series of scenario exercises tailored to the plant — from ransomware climbing toward the OT to the compromise of a remote-access supplier — starting with a tabletop simulation involving management and operational leads.

The exercises measured what was actually detected, how quickly, and through which decision points. They surfaced blind spots in monitoring, ambiguity over roles and unverified assumptions about recovery times.

On the findings I rewrote the response playbooks, clarified decision chains across IT, OT and production, and set concrete business-continuity criteria: what to stop, what to isolate, what to keep running.

A second round of testing confirmed shorter detection times and a more orderly response. The plant adopted the exercises as a recurring practice rather than a one-off engagement.