Acquisitive industrial company learns its biggest security gap is that no one owns security
A fast-growing, multi-site industrial equipment repair services company. Outcome verified
The problem
A multi-site industrial equipment repair services company had grown by acquisition to more than forty locations. It had solid technical people and a capable IT partner, but nobody owned security as a whole, and leadership could not say where it stood or what to fix first.
Why it mattered
Technology was the engine for absorbing acquisitions, so an outage or ransomware event would hit operations directly. A first phishing test showed 19 percent of staff clicked, well above typical first-time results.
What we did
Vizius combined interviews, penetration testing and phishing, then organized findings by business risk and fix order rather than a framework scorecard. The top finding was the absence of a program itself. Vizius recommended outsourcing that oversight, then ran it as a fractional CISO about a day a week: a written security program tracking targets against actuals, each control run as a small project, and monthly phishing tests.
What changed
The 19 prioritized findings became the roadmap for a multi-year program. By mid-2024 an independent owner-level review credited monthly phishing awareness, consistent SSO/MFA for acquired sites and segregated admin accounts, with recovery and incident-response planning still open.
- Manufacturing
- Large company
- CIS Controls