Security Operations Center as a Service: A Cyber Incident Response Center for DTEK Group

A Rising Wave of Cyberattacks

As Ukraine's largest private energy company, DTEK supplies electricity and heat to millions of people. Since 2022, the company has also supported war veterans in their transition to civilian life and provided free electricity to critical infrastructure facilities across the Kyiv, Dnipropetrovsk, and Donetsk regions.

Alongside relentless attacks on power plants and distribution networks, DTEK has faced a continuous wave of cyberattacks aimed at disrupting Ukraine's critical energy infrastructure. Standing on the front line of this cyber defense is MODUS X, the cybersecurity and information security partner of DTEK Group.

According to a MODUS X representative:

"We protect DTEK's business, innovation, and customer trust, so securing every system—especially those processing critical data—is our highest priority. We are committed to ensuring security at every level by following a Zero Trust approach."

As cyberattacks became more frequent and increasingly sophisticated, MODUS X recognized the urgent need to strengthen its monitoring and incident response capabilities. The company decided to build a new Security Operations Center (SOC) capable of providing 24/7 monitoring and protection of DTEK's IT infrastructure.

When designing the new SOC, the MODUS X team sought cybersecurity technologies that aligned with several strategic priorities, including faster threat detection, advanced threat analysis and containment, centralized incident management, behavioral analytics, and predictive threat detection.

A Security Operations Center Ready for Any Threat

As the foundation of its new SOC, MODUS X selected a suite of solutions from IBM® QRadar® Suite.

"We evaluated offerings from the leading vendors on the market," says a MODUS X representative. "IBM stood out by offering the best balance between functionality, reliability, and cost while fully meeting our security requirements."

Time was a critical factor. Leveraging its experience as an IBM Silver Business Partner, MODUS X capitalized on its extensive expertise with IBM technologies and completed the implementation of the new SOC in just three months.

"We built on our previous experience implementing Security Information and Event Management (SIEM) solutions and adapted those best practices to DTEK's specific needs. Particular attention was given to architecture, high availability, analyst workflows, and the optimal sizing and distribution of system components."

Today, IBM QRadar Suite forms the core of DTEK's centralized and automated cybersecurity operations.

Using IBM QRadar SIEM, security analysts collect and correlate data from multiple sources across DTEK's IT environment, creating a unified view of security events. Built-in User Behavior Analytics (UBA) enables the team to identify abnormal user activity and respond more quickly to malicious behavior.

MODUS X further strengthened its security operations by implementing IBM QRadar SOAR, adding advanced automation, orchestration, and incident response capabilities. Security analysts use the SOAR platform daily to manage incidents, track operational metrics, and coordinate investigation workflows, significantly improving the speed and consistency of security response.

Building a Stronger Line of Defense

Since 2022, MODUS X estimates that it has successfully defended DTEK against more than 150 million attempted cyberattacks.

The Security Operations Center and IBM technologies have become key components of DTEK's cybersecurity strategy, enabling a more coordinated, efficient, and accurate approach to threat detection and response.

Because IBM QRadar Suite consolidates all critical SOC capabilities into a single interface, analysts have immediate access to the tools they need to investigate and respond to incidents. Automated threat detection and response capabilities have significantly reduced response times while improving operational efficiency.

The results are already measurable:

• Mean Time to Detect (MTTD): 10 minutes
• Mean Time to Triage (MTTT): 30 minutes
• Mean Time to Respond (MTTR): 70 minutes

With centralized visibility across DTEK's entire technology landscape, MODUS X is now better equipped to manage cybersecurity incidents at scale. Combined with more accurate and automated threat detection, the new platform has increased the organization's ability to identify potential threats by five times.

"We cannot eliminate every threat, but with tools like IBM QRadar Suite, we can respond faster and more effectively. That allows us to build a resilient foundation for DTEK's operations and critical infrastructure, enabling the company to continue fulfilling its mission of delivering light and heat to the people of Ukraine."