Case Study

How Sentinel Networks Resolved 40,000 Vulnerabilities with Autonomous Response

How a national infrastructure operator cleared decades of accumulated vulnerability debt across operational technology and corporate networks — without taking a single control system offline.

40,127

Vulnerabilities Triaged and Closed

Zero

Maintenance Windows Required

214d → 9d

Mean Time to Remediate

94%

Findings Resolved Without Manual Triage

Client Profile

Company: Sentinel Networks
Industry: Energy & Infrastructure
Company Size: 6,800+ Employees
Location: Rotterdam, Netherlands
Engine Deployed: Zelar Trust AI Engine V4

The Challenge

Decades of vulnerability debt spread across networks that cannot simply be switched off.

Sentinel Networks carried a backlog of just over forty thousand open findings, accumulated across substation controllers, corporate endpoints, and the engineering workstations that sit between them. The list had grown faster than any team could work it, and each quarterly scan added more rows than the previous quarter had closed.

The operational technology estate made the usual answer unavailable. A control system cannot be patched on a Tuesday afternoon because a scanner flagged it, and the maintenance windows that could carry that work were booked eighteen months out against grid availability commitments rather than security priorities.

Triage itself was the deeper cost. Analysts spent their weeks deciding which findings mattered on which segment, re-deriving the same context by hand every cycle, and the answers expired the moment a device was reconfigured. Sentinel needed the estate's own topology to drive remediation instead of a spreadsheet ranking severity in the abstract.

The Solution

Zelar Trust connected directly to Sentinel's asset inventory, network segmentation policy, and change management system, then mapped every open finding onto the segment it actually sits in. Exposure, not raw severity, became the ordering: a medium-severity flaw reachable from a corporate subnet outranked a critical one sealed behind two enforced boundaries.

Autonomous response handled everything the segmentation model proved safe to touch, staging the remainder against real maintenance calendars rather than a wish list. Engineers stopped receiving lists to work through and started receiving the exceptions — the small share of findings where the automated path was genuinely blocked.

Remediation Cycle Comparison

Before Zelar (214-Day Mean Time to Remediate)

With Zelar (9-Day Mean Time to Remediate)

* Backlog cleared across eleven weeks with no scheduled outage. Field engineering hours redirected from triage to grid modernisation work.

The Results

The backlog cleared in eleven weeks without a single unplanned outage on the operational estate. Ninety-four percent of findings closed on the automated path, and the four hundred that escalated reached an OT engineer with the segment, the dependency chain, and the safe change window already attached.

Mean time to remediate fell from two hundred and fourteen days to nine. More usefully, the number stopped drifting: because assessment now runs continuously against live topology, a newly exposed device is ranked the day its segmentation changes rather than at the next quarterly scan.

“We had spent years being told the backlog was unworkable, and the honest answer was that it was — by hand. Zelar did not make the list shorter, it made the list ordered by what could actually reach us. The first week it ran, it told us which four hundred of forty thousand findings deserved an engineer.”

Anneke de Vries

Director of Operational Security, Sentinel Networks

Implementation Timeline

Sentinel moved from a four-decade backlog to continuous autonomous response across five phases.

Phase 1
Asset & Segment Discovery
Zelar Trust inventories substation controllers, engineering workstations, and corporate endpoints, then reconciles them against the documented segmentation model.
Phase 2
Exposure Mapping
Every open finding is mapped onto the segment it occupies, so reachability rather than raw severity drives the remediation order.
Phase 3
Autonomous Response Enablement
The engine takes ownership of the remediation paths segmentation proves safe to automate, staging the remainder against real maintenance calendars.
Phase 4
OT Escalation Routing
Blocked findings route to named operational engineers with segment context, dependency chains, and the next safe change window attached.
Phase 5
Continuous Assessment
Scanning becomes constant rather than quarterly, so a newly exposed device is re-ranked the day its configuration changes.

Bring Continuous Audit Readiness to Your Organization

Understand where your governance, risk and compliance obligations stand today, and what continuous oversight would change. Our advisors will walk you through it.

Assess Your Cyber Governance Talk to a CISOaaS Advisor

Managed cyber governance for organizations that need continuous CISO leadership, Cyber GRC expertise and operational governance — without building the entire capability in-house.

CISO Governance Brief — practical insights on cyber governance, regulatory developments, risk, compliance and CISO leadership.