Gaviota Group

The challenge: Protecting a decentralized manufacturing business

As Gaviota expanded internationally, cybersecurity became more complex. Each site operated at a different level of IT maturity, while large volumes of data moved continuously between locations, suppliers, and partners.

‍
Email quickly emerged as the most significant attack surface. Thousands of messages flowed through the business every day, exposing the organization to phishing, impersonation, and credential‑theft attempts that traditional tools struggled to detect.

‍
User awareness also varied by region. Despite training efforts, employees sometimes clicked before thinking, creating risk that required real‑time, automated intervention.

“Security has to evolve at the same speed as the business. We needed a solution capable of learning and adapting on its own.” Sergio Soriano, Head of Systems, Communications, and Cybersecurity

Why Darktrace

Gaviota selected Darktrace to gain continuous visibility and autonomous response across its environment—without adding to the security team’s workload.

The company began with a trial of Darktrace / NETWORK™, which deployed in under an hour and immediately demonstrated value. Darktrace’s ability to surgically stop abnormal behavior—such as blocking a single port while leaving the rest of the network unaffected—showed how AI‑driven response could reduce risk without disrupting operations.

Encouraged by the results, Gaviota expanded its deployment to:

• Darktrace / EMAIL™ to prevent phishing and impersonation attacks
• Darktrace / ENDPOINT™ to extend visibility and protection to user devices

Together, these capabilities form a layered AI‑driven defense that continuously learns and adapts as the business evolves.

How Darktrace helps Gaviota

1. Darktrace/ EMAIL stops phishing before users see it

With Darktrace / EMAIL™, Darktrace’s Self‑Learning AI models normal communication patterns for every user and role. This allows it to detect subtle anomalies associated with phishing, business email compromise, and impersonation—even when emails appear legitimate.

As a result:

• Spam and malicious links are blocked automatically
• Suspicious attachments are stopped before delivery
• CEO fraud and impersonation attempts are intercepted early

“In a single week we receive more than 24,000 emails and send over 13,000. Since implementing Darktrace, those messages are clean—no spam, no suspicious links.” - Sergio Soriano, Head of Systems, Communications, and Cybersecurity

Darktrace also monitors outbound communications, detecting attempts to send sensitive data externally and preventing data‑loss incidents that could impact the business financially or reputationally.

“Darktrace has stopped attempted data transfers immediately, and those events helped us refine our internal security policies.”- Sergio Soriano, Head of Systems, Communications, and Cybersecurity

2. Network resilience with Darktrace / NETWORK

At the infrastructure level, Darktrace / NETWORK™ provides continuous visibility across every connected device at Gaviota’s international sites.

Between August and November 2025, Darktrace autonomously contained 118 anomalous behaviors before they escalated—eliminating the need for urgent manual intervention and helping maintain uptime across manufacturing operations.

3. Cyber AI Analyst™ reduces manual workload

Darktrace’s Cyber AI Analyst™ automatically investigates security events end‑to‑end, replicating the work of Tier‑1 analysts at machine speed.

• 799 investigations conducted autonomously
• Only 38 incidents required human review

This automation significantly reduced alert fatigue, allowing Gaviota’s IT team to focus on strategic initiatives rather than day‑to‑day triage.

“Darktrace gives us peace of mind. We don’t have to watch every alert, because we know the system will detect, investigate, and respond in seconds.” - Sergio Soriano, Head of Systems, Communications, and Cybersecurity

Looking ahead

As Gaviota continues to expand into new markets, cybersecurity remains a key enabler of growth. The organization plans to deepen its use of Darktrace across endpoints and cloud services, ensuring consistent protection across every layer of the business.

“Cybersecurity is about balance. You can’t stop working to stay safe—you need solutions that let you do both. With Darktrace, that’s what we have.”- Sergio Soriano, Head of Systems, Communications, and Cybersecurity

‍

‍