MAIRE Group cut high-severity incident response times by 40% with Cyberbit
MAIRE Group is a publicly listed technology and engineering company advancing the global energy transition. With operations in 45 countries, 9,300 employees, and a network of 20,000 project partners, the group delivers integrated engineering solutions for the downstream market alongside sustainable technology offerings spanning sustainable fertilizers, low-carbon energy vectors, and circular solutions.
Operating at this scale in critical infrastructure makes MAIRE’s threat profile unforgiving. A successful intrusion does not just disrupt corporate systems, it threatens projects, partners, and the operational continuity of energy transition programs across dozens of jurisdictions.
The challenge
Skills without readiness
Before partnering with Cyberbit, MAIRE invested heavily in cybersecurity training. The team had access to learning content, certifications, and traditional exercises. On paper, the program looked complete.
In practice, the program revealed three persistent gaps that any SOC leader will recognize.
- Effort
Building a relevant cyber exercise meant designing a scenario, configuring infrastructure, and coordinating people. The work consumed weeks for a single exercise, and the result was good for one rehearsal, not a program. - Scalability
Every new threat, tool change, or team rotation reset the work. The cycle could not keep pace with how quickly the threat landscape evolved. - Consistency
Different analysts received different experiences, and there was no shared baseline of how the team performed together under pressure. Individuals were getting sharper. The team was not necessarily getting more ready.
MAIRE needed a different model: one that respected the time of a busy SOC, built team capability rather than isolated skills, and produced evidence of readiness that the security leadership could put in front of the board.
Why MAIRE chose Cyberbit
MAIRE evaluated several platforms in the skills and readiness space, including Immersive Labs and Hack The Box. Each platform brought strengths, but none combined what MAIRE needed in a single environment: realistic full-attack exercises in a cloud-based range, granular skills labs to close specific gaps, and the ability to run both as part of one program.
Three capabilities tipped the decision.
- Real attacks on real environments
Cyberbit’s cloud-based range hosts full networks with real security tools, real data flows, and adaptive adversaries. MAIRE’s analysts practice in environments that look and behave like the ones they defend, not stripped-down snapshots of an attack. - A complete catalog mapped to MAIRE’s risks
From foundational Hands-on Labs to advanced Team Live-Fire Exercises, the content covers the range of threats MAIRE prioritizes. The team can pick a threat, an environment, and a toolset, then run the exercise that matches. - A program, not a portal
Cyberbit operationalizes readiness through Readiness Cycles: run an exercise, surface the skills gaps, close them in targeted labs, then move to the next risk. The structure removes the planning burden that traditional exercising places on the SOC.
"When we began searching for a cybersecurity readiness solution, we evaluated several other vendors alongside Cyberbit, including Immersive Labs, Hack The Box, and others. Despite the merits of these platforms, none matched the complete and granular approach that Cyberbit provided."
The solution in practice
MAIRE rolled out the Cyberbit Team Readiness platform across the cybersecurity function, anchored by three components.
Team Live-Fire Exercises put the SOC into a full simulated attack on a realistic network, with adversary actions that adapt to the team’s response. These exercises surface the things classroom training cannot reach: how the team communicates under pressure, how decisions get made, how processes hold up when an alert turns out to be the second stage of something larger.
Skills Labs give individual analysts targeted, hands-on practice on the specific techniques, tools, and procedures the Skills Gap Report identifies after each exercise. Practice is tied to evidence of need, not assigned arbitrarily.
Readiness Cycles stitch the two together. Each cycle starts with an exercise relevant to a prioritized risk, surfaces the gaps demonstrated by the team, assigns targeted labs to close those gaps, and ends with a measurable improvement in capability against that threat. MAIRE then moves to the next risk and repeats.
The result is a program that runs, rather than a project that has to be rebuilt every quarter.
The outcome
Measurable readiness, validated under pressure
The MAIRE program produced operational improvements that the security leadership can put in front of the board.
40% faster response to high-severity (Type I) incidents
The hours and minutes that matter most, when an attacker is actively progressing toward critical assets, have shrunk significantly.
36% faster response to low and medium-severity incidents
The day-to-day workload of the SOC moves through the queue faster, freeing analyst capacity for the threats that warrant deeper investigation.
60% reduction in post-incident report preparation time
A workflow that previously consumed days now resolves in hours, accelerating the feedback loop into lessons learned, governance, and regulatory reporting.
4th place out of more than 100 teams in a global SOC and CERT competition, in the team’s first participation.
An external, adversarial benchmark of how MAIRE’s analysts perform under pressure against peers from around the world.
Beyond the numbers, the program changed how the team operates. Analysts bring sharper triage, stronger communication, and clearer decision-making to live incidents. Leadership reports increased trust in the intelligence and recommendations coming out of the SOC. And as new threats and techniques emerge, MAIRE’s team practices against current attacker behavior, not last year’s, because the Cyberbit content team builds them into the catalog.
"Thanks to Cyberbit, we reduced response times for low and medium-severity incidents by around 36%, response times for high-severity incidents by around 40%, and the preparation of incident reports by around 60%. We keep our team sharp through unexpected Team Live-Fire Exercises. The hyper-realistic scenarios let us assess readiness and response strategies under real pressure, ensuring our team is not just trained but ready when an incident hits"
Why this matters beyond MAIRE
MAIRE’s experience reflects a broader shift in how mature security organizations think about defensive capability. Investing in individual skills produces individual learners. Investing in readiness, exercising the full team across real attacks, on real tools, in real environments, produces something different: a defensive capability that performs under pressure and a measurable record of doing so.
For organizations facing the same combination of complex risk, regulatory scrutiny, and finite SOC time, MAIRE’s story is a useful proof point. Readiness is achievable, it is measurable, and it does not require building an in-house cyber range or a dedicated exercise team. It requires a platform built to make readiness repeatable.
"If an organization wants to become resilient, we believe Cyberbit is the ideal solution."
