How an Oil Refinery Eliminated Alert Fatigue and Created Contextualized OT Risk Insights
The company is an energy petrochemical refinery with geographically dispersed assets for petroleum refining, logistics, asphalt, renewable fuels, and retail convenience stores. Although it invested in OT cyber security solutions, the company’s security team experienced alert fatigue due to the high volume of false-positive security notifications from its existing Intrusion Detection System (IDS). It also had challenges with its OT cyber security posture because it lacked asset visibility over all of the company’s geographically scattered and unmanned environments. The sheer volume of alerts, combined with an inability to recognize real high-priority security threats with its existing resources, was a major challenge that the team needed to solve.
The company sought to find an efficient and effective solution to:
- Reduce Alert Noise – Minimize the volume of low-value or irrelevant security notifications to allow the security team to focus on actionable threats.
- Gain Unified Visibility – Establish a comprehensive, 360° view of cyber exposure and security risk across all connected assets, including OT, IT, and IoT devices.
- Enhance OT Environment Visibility – Achieve clear, real-time insight into the operational technology landscape to support informed decision-making.
- Simplify OT Security Operations – Centralize and streamline cybersecurity management across the OT environment to reduce complexity and operational overhead.
- Automate Asset Discovery – Continuously discover, classify, and inventory all assets to build a complete and accurate asset map with relevant pathways.
- Identify and Prioritize Risks – Detect vulnerabilities and assess risks in context to support efficient prioritization and mitigation efforts.
Continue reading to learn how the deployment of Armis Centrix™ delivered measurable improvements across security posture, operational efficiency, and risk readiness.
Challenges
-
A major oil & gas manufacturer faced critical limitations in its existing OT security infrastructure with false positives and ghost asset alerts, which cluttered security workflows and obscured true threats. -
The organization struggled to prioritize risk, lacking the visibility and context to focus on what truly mattered.
-
Siloed technologies and disconnected data sources made it difficult to understand the full operational environment, hampering both security efforts and compliance readiness.
Results
-
Identified over 12,000 alerts as ghost assets, external (cloud) assets, and “out-of-working hours” alerts.
-
A unified risk view of converged OT-ITIIoT network security systems within its OT environment.
-
OT security compliance and auditing processes are now automated.
