Cogne Acciai Speciali

The Challenge: Securing Converging IT and OT Environments

‍
Operating in highly regulated and mission-critical environments, Cogne Acciai Speciali’s materials are used in components such as aircraft engines and landing gear—where reliability, uptime, and operational continuity are essential.

‍
With its main manufacturing site in Aosta, Italy, alongside an international industrial and commercial footprint, the organization manages a complex ecosystem spanning traditional IT infrastructure and interconnected industrial control systems.

‍
As manufacturing systems increasingly integrated with ERP platforms and monitoring environments, visibility across the network became a critical requirement.

“Today, an industrial plant is not just a set of machines,” explains Andrea Gasperin, Network and Cyber Security Specialist. “It’s part of an ecosystem connected to ERP systems and monitoring platforms. That integration is essential—but it also requires greater awareness of what’s happening across the network.”

Before adopting Darktrace, Cogne Acciai Speciali relied on legacy antivirus solutions, perimeter firewalls, and rule-based email security. While effective against known threats, these tools offered limited insight into east–west traffic, industrial protocols, and subtle anomalies across IT and OT.

‍
This lack of deep visibility made it difficult to monitor machine-to-machine communications, detect lateral movement, or quickly investigate suspicious behavior—particularly as IT and OT environments continued to converge.

‍
Email security presented an additional challenge. False positives disrupted commercial processes and invoice approvals, while sophisticated impersonation attempts demanded time-consuming manual investigation.

The Solution: Self-Learning AI Across IT, OT, and Email

‍
Cogne Acciai Speciali deployed Darktrace / NETWORK and Darktrace / OT to establish comprehensive visibility across its corporate and industrial environments.

‍
Powered by Self-Learning AI, Darktrace continuously analyzes network activity to learn the organization’s unique “pattern of life”—including industrial protocols, machine communications, and normal operational behavior—without relying on static rules or signatures.
‍

Visibility and Investigation Highlights

‍
During a recent reporting period, Darktrace:

• Processed 335 TB of network traffic
• Monitored activity across nearly 3,000 internal IP addresses
• Conducted 17,558 autonomous investigations via Cyber AI Analyst™
• Saved the equivalent of 1,712 hours of manual analysis

For the security team, the impact was immediate.

“The main difference has been visibility,” says Gasperin. “We now understand how our industrial plants communicate, which protocols are running, and where potential blind spots may exist.”

This shared visibility enables faster detection of anomalies, unusual lateral movement, and misconfigurations—without increasing alert fatigue.
‍

Crucially, Darktrace provides a common operational picture for internal IT teams, plant engineers, and Cogne Acciai Speciali’s external SOC provider, improving collaboration and accelerating incident response.

“We work hand in hand with the SOC,” Gasperin adds. “Having a shared view of both IT and industrial networks allows us to intervene more quickly and with greater confidence.”

Stronger Email Security, Fewer False Positives

‍
To address persistent email security challenges, Cogne Acciai Speciali also implemented Darktrace / EMAIL.

‍
Traditional email filters struggled to distinguish between legitimate technical language and malicious content, while impersonation attacks without links or attachments required detailed manual review.

‍
Darktrace’s AI-driven email security analyzes messages using behavioral context, not just static indicators. Cyber AI Analyst™ autonomously triages and investigates suspicious emails, significantly reducing the manual burden on the IT team.

‍
Employees now receive clearer, more contextual information about potential threats—supporting informed decision-making without disrupting business-critical communications.

Why Darktrace

‍
For Cogne Acciai Speciali, Darktrace stood out for its ability to deliver unified, AI-driven visibility across converging IT and OT environments.
Instead of adding yet another security layer, Darktrace provides a behavioral understanding of the entire digital and industrial ecosystem—enabling the detection of subtle anomalies that traditional tools often miss.

‍
Cyber AI Analyst™ further reduces operational strain by automatically investigating alerts and correlating activity across email, network, and industrial environments.
‍

By combining Darktrace / NETWORK, Darktrace / OT, and Darktrace / EMAIL, Cogne Acciai Speciali has established a proactive security model that protects 24/7 manufacturing operations while supporting business continuity.

Looking Ahead: Toward Integrated Cyber Governance

‍
As regulatory frameworks continue to evolve—including requirements linked to the NIS2 Directive—the convergence of IT and OT security is becoming increasingly strategic.
With measurable visibility across its digital and industrial infrastructure, Cogne Acciai Speciali is well positioned to formalize governance structures and strengthen collaboration between IT teams, plant engineers, and external security partners.

‍
For the organization, improving cybersecurity has not meant slowing production. Instead, it has delivered greater awareness, reduced investigative overhead, and a resilient foundation for secure industrial growth.

‍