Case Study

Gridline Energy Proves OT Network Segmentation on a Continuous Basis

How a regional grid operator replaced an annual segmentation penetration test with continuous boundary verification, and can now evidence isolation on the day a regulator asks.

312

Segmentation Boundaries Verified Continuously

Zero

Unauthorised IT-to-OT Paths Since Deployment

4 Hours

From Regulator Request to Evidence Pack

Live

Assurance Cadence, Formerly Annual

Client Profile

Company: Gridline Energy
Industry: Energy & Infrastructure
Company Size: 3,100+ Employees
Location: Calgary, Canada
Engine Deployed: Zelar Trust AI Engine V4

The Challenge

An isolation guarantee that was only ever tested once a year.

Gridline's regulatory position rested on segmentation: grid control systems are isolated from corporate IT, and every crossing between them is brokered. That claim was substantiated by an annual penetration test — one contractor, two weeks, a report describing the boundary as it stood during the engagement.

For the remaining fifty weeks the claim was an assumption. Firewall rules changed, vendor remote access was granted for maintenance and not always revoked, and each individual change was reasonable in isolation. Whether they still composed into the isolation the regulator had been shown was a question nobody could answer without commissioning the test again.

Evidence was the practical bottleneck. A regulator asking for proof of segmentation received the most recent report, which meant the honest answer was always a date rather than a state — and the further from the engagement, the weaker the answer.

The Solution

Zelar Trust models Gridline's intended segmentation as an enforceable specification rather than a diagram, then verifies it continuously against what the network actually does. Every one of the three hundred and twelve boundaries is proven from both sides, so an isolation guarantee is a current measurement instead of a historical finding.

Change is caught where it happens. A firewall rule or a vendor access grant that would open an unbrokered path between corporate IT and the control estate is flagged against the boundary it affects at the moment it is proposed, and temporary maintenance access is tracked to its expiry rather than to whoever remembers it.

Segmentation Assurance Effort

Before Zelar (Annual Two-Week Penetration Test)

With Zelar (Continuous Boundary Verification)

* The annual engagement is retained as an independent check rather than as the sole source of assurance. What changed is the fifty weeks between engagements.

The Results

Gridline has recorded no unauthorised path between corporate IT and the control estate since deployment, and can say so about today rather than about last spring. Nine boundaries sit under active change control at any given time, each with the change that opened it and the approval that governs it attached.

Regulatory response changed shape entirely. A request for proof of segmentation is answered in about four hours with a pack generated from current state, instead of being deferred to the most recent annual engagement or answered by commissioning a new one.

“Our segmentation was genuinely good. What we could not do was prove it on a Tuesday. Every answer we gave a regulator was really a statement about a fortnight last March, and everyone in the room knew it. Now the proof is generated the day it is asked for.”

Dale Whitfield

Director of OT Cybersecurity, Gridline Energy

Implementation Timeline

Gridline moved from an annual segmentation test to continuous boundary verification across five phases.

Phase 1
Boundary Specification
The intended segmentation between the control estate and corporate IT is captured as an enforceable specification rather than a network diagram.
Phase 2
Two-Sided Verification
Each of the 312 boundaries is proven from both sides, so isolation is measured rather than inferred from the firewall configuration alone.
Phase 3
Change Interception
Firewall rules and vendor access grants are evaluated against the boundaries they affect at the moment they are proposed, not at the next audit.
Phase 4
Temporary Access Expiry
Maintenance access is issued against an expiry the engine enforces, closing the gap where a legitimate grant quietly becomes a standing path.
Phase 5
On-Demand Evidence
Regulatory evidence packs are generated from current boundary state, so proof of segmentation describes today rather than the last engagement.

Bring Continuous Audit Readiness to Your Organization

Understand where your governance, risk and compliance obligations stand today, and what continuous oversight would change. Our advisors will walk you through it.

Assess Your Cyber Governance Talk to a CISOaaS Advisor

Managed cyber governance for organizations that need continuous CISO leadership, Cyber GRC expertise and operational governance — without building the entire capability in-house.

CISO Governance Brief — practical insights on cyber governance, regulatory developments, risk, compliance and CISO leadership.