How TDM Group helped Sonnedix Build
a 24/7 Cyber Security Operations Centre
As Sonnedix’s renewable energy footprint continues to expand, so does its exposure to increasingly targeted cyber threats. Partnering with TDM Group, Sonnedix has transformed cybersecurity into a 24/7, business-aligned Cyber Security Operations Centre that protects operations and supports growth.
Company profile
Sonnedix is a global renewable energy company delivering 100% clean electricity through a diversified portfolio of solar, wind, and storage assets. With nearly two decades of sustainable growth, Sonnedix is committed to powering a bright future as they continue acquiring, developing, building, and operating renewable energy projects for the long-term – delivering innovative and tailored solutions to their customers.
The Challenge
Expanding Attack Surface and Targeted Attacks
As Sonnedix continues to expand across multiple regions and technologies, its growing digital footprint has made it an increasingly attractive target for cybercriminals. The company’s position as a next-gen IPP (next generation independent power producer) backed by major investors and long-term partnerships, focused on delivering 100% renewable energy products that adjust to their customers’ needs has heightened its cyber profile.
As the organisation rapidly scaled from fewer than 100 employees to 700, its attack surface expanded dramatically. Threat activity surged in parallel, including:
20,000
Phishing emails each month
100,000+
Suspicious messages
7,000
Impersonation attempts
A single successful cyber-attack could have led to a data breach, regulatory exposure, or operational downtime.
Despite deploying robust security tools, Sonnedix recognised the need for a more dedicated, proactive capability to continuously monitor, analyse, and respond to an evolving threat landscape. While the existing setup provided valuable insights, introducing a unified layer of visibility and coordination would help ensure consistent oversight across its IT and operational technology environments.
The Solution
24/7 Security Operations Centre (CyberSOC)
To strengthen its cyber resilience and support its global expansion plans, Sonnedix partnered with TDM Group to design and implement a centralised 24/7 Security Operations Centre (CyberSOC): a unified team that continuously monitors, analyses, and responds to cybersecurity threats across its global IT, cloud, and power plant environment – all of which is managed centrally by TDM Group.
TDM Group’s existing insight into their infrastructure and operations made them the natural choice to design and implement the CyberSOC. This proven IT experience, combined with their Managed Business IT Services (M-BiTS) – a holistic approach that recognises technology’s strategic value across the organisation – ensured alignment with Sonnedix’s business goals.
This partnership marked a strategic evolution in Sonnedix’s cybersecurity posture. Key elements of the CyberSOCs deployment and ongoing effectiveness include:
Seamless Security System Integration
TDM Group configured and integrated Microsoft Sentinel with Sonnedix’s key environments, enabling advanced analytics and automated correlation of cybersecurity events. This centralized approach allows the CyberSOC team to quickly identify suspicious activity, while ensuring that alerts are triaged and addressed before they escalate.
Collaborating on Cybersecurity
The Cybersecurity Working Group – co-led by Sonnedix and TDM Group – meets weekly to review incidents, track actions, and refine processes. Frequent tactical meetings and strategic session ensure both teams remain aligned, with shared visibility into evolving threats and ongoing initiatives.
Expanding Coverage Beyond IT
The CyberSOC project initially focused on Sonnedix’s corporate IT infrastructure, before expanding to include cloud environments and operational power plants, reinforcing protection for critical business assets. This includes TDM Group supporting Sonnedix to extend vulnerability management capabilities into its energy production sites, ensuring a consistent, enterprise-wide approach to cyber risk management.
Fostering a Culture of Cyber Awareness
Essential technical support is augmented by regular phishing campaigns and training to strengthen employee vigilance. These initiatives complement the CyberSOC’s technical defences by fostering a culture of shared responsibility and cybersecurity awareness.
A Foundation of Trust and Collaboration
The partnership between Sonnedix and TDM Group extends beyond traditional vendor support. It’s built on trust, transparency, and collaboration, underpinned by shared goals and a long-term vision for growth. This relationship has expanded beyond the CyberSOC to include additional infrastructure and cybersecurity projects across Sonnedix’s global operations.
For me, trust was the key factor, Since working with TDM Group, I’ve seen their ability to understand our business, to align the right people, and to deliver business-focused projects. Central to this is the responsive approach and personal rapport fostered from the top down by Tarek [TDM Group’s Director] and our dedicated business manager, Chris.
Lida Rragami, Head of Cybersecurity at Sonnedix
Business Benefits
Enhanced Operations Through Continuous, Scalable Protection
The creation of a CyberSOC that’s aligned with the business’s goals has transformed cybersecurity into a strategic asset – enabling Sonnedix to focus on its core mission of delivering tailored, 100% renewable energy solutions to its customers. Key benefits include:
Access to Specialised
Support
Partnering with TDM Group allows Sonnedix to benefit from specialist cybersecurity and technical expertise, without the complexity, cost, or time required to build and maintain an in-house function.
Continuous, Proactive
Protection
Continuous monitoring and automated response capabilities enable the CyberSOC to proactively identify, analyse, and mitigate cyber threats before they can impact business operations. Automated actions significantly reduce the time taken to detect and respond, preventing risks from escalating into costly incidents.
Enhanced Operational Availability
& Data Security
The CyberSOC proactively safeguards Sonnedix’s data, systems, and critical energy infrastructure across its global footprint. By reinforcing operational availability and protecting sensitive information, the CyberSOC helps to secure the company’s ongoing business growth and reputation.
Cost Efficiency
& Scalability
Sonnedix benefits from a scalable managed security services model. This flexible approach adapts to peaks and troughs in project demand, ensuring predictable costs and faster delivery while maintaining consistent security coverage across all regions and environments.
Business
Alignment
Regular collaboration ensures continuous alignment between cybersecurity operations and business priorities. The CyberSOC team doesn’t just monitor systems; they understand Sonnedix’s evolving operations, risks, and culture, ensuring cybersecurity decisions enhance, rather than hinder, productivity.
Securing Operations and Supporting Growth Through Trusted Partnership
With trusted collaboration leveraged, advanced security technology consolidated, and intelligent automation harnessed, the result has been transformative: a CyberSOC that provides unified visibility, real-time alerting, response, continuous protection, and scalable support across Sonnedix’s global operations.
Key to establishing a good CyberSOC is finding a company you can trust, TDM Group understands our environment, our priorities, and our people – and that makes all the difference
Lida Rragami, Head of Cybersecurity at Sonnedix