Havrelis

The mandate

A container terminal operator running two berths, an automated crane fleet and a customs interface that talks to three national systems. Their board had signed a NIS2 readiness budget and wanted to know, before spending it, which parts of the estate an adversary would actually reach.

The constraint was absolute: the terminal does not stop. Any test that risked a crane, a gate or the customs link was off the table unless it ran in a window we agreed in writing beforehand.

What we did

We started from the outside with nothing but the company name. Two weeks of reconnaissance produced a supplier list, four exposed remote-access services and a maintenance contractor whose VPN concentrator had not been patched in three years.

The foothold came on day four, through that contractor. From there the interesting question was not whether we could reach the operational network — we could — but how far we could go before anything noticed. The answer was further than anyone was comfortable with, and we stopped at the boundary we had agreed rather than proving it by moving a crane.

What changed

Fourteen paths from an external position to an operational system, each with a reproducible proof and a fix ranked by the engineering effort it actually costs. Nine were closed within the quarter. The remaining five needed a supplier contract renegotiated, which is a slower kind of fix and was reported as such.

At ninety days we re-tested every one. All fourteen held.