EnBW Cyber Security expands with new business model for security from the cloud

IT professional working on an open server rack in a server room illuminated with blue and orange light. The shirt reads “Wir schützen das Gute!”. — EnBW security experts in the SOC

In this article, you will learn,

how EnBW Cyber Security migrated its Managed SIEM offering from on-premises to the cloud,
why T Cloud Public prevailed in a market analysis against other providers,
and how a new usage-based pricing model unlocks new customer groups operating critical infrastructure.

The case at a glance

Challenge: EnBW Cyber Security wanted to scale its Managed SIEM offering and reach new customer groups. However, many customers from critical infrastructures and the public sector reject international hyperscalers and require a European cloud solution.
Solution: After analysing five European cloud providers and conducting Proofs of Concept with three platforms, EnBW Cyber Security selected T Cloud Public and transferred its SIEM to a cloud-native architecture.
Result: Today, approximately 70 percent of customers use the cloud variant. The new usage-based pricing model lowers the barrier to entry for smaller customers and simplifies operations, maintenance, and scaling.

Key project facts

Kunde Customer	EnBW Cyber Security GmbH
Branche Industry	Managed Security Services
Customer Base Kundenbasis	75 customers from critical infrastructure sectors 75 Kunden aus dem KRITIS-Umfeld
Live Produktiv	seit 2025 auf der T Cloud Public – vom erfolgreichen PoC bis zum Produktivbetrieb in nur sechs Monaten Since 2025 on T Cloud Public – from successful PoC to production in just six months
Cloud-Nutzung Cloud Usage	70 percent of customersEnBW Cyber Security GmbH 70 Prozent der Kunden
Services Used Genutzte Services	Elastic Cloud Server (s9 reserved), Object Storage Service, VPN-Gateway, Managed Kubernetes (Cloud Container Engine), Load Balancer, Object Storage, Web Application Firewall EnBW Cyber Security GmbH
Compliance	BSI C5 Typ II, ISO 27001/17/18
Hosting	Ausschließlich in deutschen Rechenzentren Exclusively in German data centers

Key results

70 % of customers now use the cloud variant.
5 cloud providers were evaluated.
3 PoCs were conducted.
T Cloud Public best meets ECS's compliance and technical requirements.
Minutes instead of days for provisioning new customer environments.
Minimal upfront planning thanks to easy scaling.
No downtime during regular updates.

About EnBW Cyber Security

EnBW Cyber Security (ECS) is a German Managed Security Services Provider for integrated IT and OT security. The company was spun off from energy supplier EnBW in 2022 and is therefore deeply familiar with the requirements of critical infrastructures. Since then, the company has grown significantly and now serves around 75 customers, including municipal utilities, industrial companies, and public institutions.

As IT and OT systems become increasingly interconnected through digital transformation, new attack vectors are opening up. With its Cyber Defence Centre (CDC), ECS monitors its customers' IT and OT systems around the clock. Its service portfolio includes Security Information and Event Management (SIEM), Network Detection and Response (NDR), and Incident Response Services.

Technically mature, fully certified, and secure – T Cloud Public is the best cloud option for us as an IT security provider.
Frank Brech · CEO EnBW Cyber Security

How can an IT security provider reach new customer groups and grow without compromising on security and sovereignty?

EnBW Cyber Security serves customers in critical infrastructure sectors with security services. The classic on-premises model ensures a high level of security and trust. The cloud, however, would lead to faster deployment and lower costs – but what about the security level?

The challenges for EnBW Cyber Security

Limited scalability: The existing on-premises model made growth and standardisation difficult.
High entry costs: Smaller customers in particular were deterred by the required infrastructure investments.
Sovereignty requirements: Security data must not fall under the US CLOUD Act.
Trust barrier: Critical infrastructure operators and public institutions demand European cloud solutions.
Complex capacity planning: Resources were frequently over- or under-dimensioned.
Operational overhead: Maintenance and updates regularly caused downtime.

Why did EnBW Cyber Security choose T Cloud Public?

Under the leadership of Marco Fischer, Head of SOC, EnBW Cyber Security analysed the European cloud provider market. "In total, we evaluated and assessed five cloud platforms and tested three of them in Proofs of Concept."

T Cloud Public convinced through:

The highest platform maturity
Available cloud-native services
German data centres

High security and compliance standards
Fast implementation and scalability
Personal support from technical experts

In our analysis of European sovereign cloud alternatives, T Cloud Public ranked as one of the leading offerings. A Proof of Concept confirmed the high level of maturity. The decision was easy.
Marco Fischer · Head of SOC, EnBW Cyber Security

The new platform enables a novel, usage-based pricing model for ECS customers. They pay "transactionally" based on the actual log volume processed. Deployment from the cloud also eliminates discussions about required hardware capacity. "In the past, our customers planned too large or too small," says Brech. "Now we can adjust capacities precisely to the customer's needs within minutes – this significantly accelerates the rollout of our Managed SIEM." At the same time, the cloud platform enables EnBW Cyber Security to continue growing as a security provider – including in the European market.

The cloud benefits are also convincing ECS's own customers: the majority have now opted for the cloud version.

From idea to operation

PoC completed after 3 months

Go-live after 9 months

Stable in production for over one year

Before / After

Before (On-Premises) 🔴	After (T Cloud Public) 🟢
On-premises operation	Cloud-native deployment
Static infrastructure	Dynamic scaling
High entry costs	Usage-based costs
Customer-managed capacity planning	Automatic resource adjustment
Service interruptions during maintenance windows	Updates with zero downtime
Focus on larger customers	Attractive for SMEs too

T Cloud Public doesn't just simplify operations. It's also a strong sales argument and builds trust with security-sensitive customers.
Frank Brech · CEO EnBW Cyber Security

T Cloud Public services used

Managed Kubernetes (Cloud Container Engine) – Container orchestration for scalable SIEM workloads

Elastic Cloud Server – Virtual Machines (s9 Reserved) – Predictable compute capacity in reserved mode

Virtual Private Network (VPN Gateway) – Secure connectivity between customer environments and the SOC

Object Storage Service (OBS) – Sovereign storage for large volumes of log data

Web Application Firewall (WAF) – Protection of cloud-native applications against attacks

FAQ – Frequently asked questions

Why were hyperscalers not an option?

Many of EnBW Cyber Security's customers come from KRITIS industries or the public sector. These sectors have high requirements for data sovereignty and protection against non-European legal access.

Why was T Cloud Public selected?

After evaluating five European cloud providers and conducting multiple Proofs of Concept, T Cloud Public convinced with its platform maturity, security standards, and available managed services.

How do smaller companies benefit?

The new usage-based pricing model eliminates the need to provision infrastructure capacity in advance. This significantly reduces costs – not just for entry.

What role does BSI C5 play?

The BSI C5 attestation helps build trust with customers from regulated and security-critical sectors, particularly in the externally audited Type 2 version.

How does the cloud support company growth?

Unlike static on-premises offerings, cloud services can be deployed, scaled, and maintained more easily. International availability also increases.

Are cloud offerings cheaper than on-premises?

Not always – but the EnBW Cyber Security case shows that the cloud enables new hardware-independent pricing models that reduce usage costs.

Why can companies deploy cloud offerings quickly?

Initial dimensioning and hardware procurement are eliminated. Starting from a standard configuration, users can simply scale up or down to dial in the perfect capacity.

Does T Cloud Public fit your use case?

Speak with a cloud expert – free of charge and without obligation.

Request a Consultation now

This content might also interest you

Screenshot of the d.velop dashboard showing modules for import, search, scanning, favourites and document management – displayed on laptop and smartphone against a digital background

Sovereign Cloud Foundation for Content Services Applications

How d.velop AG delivers its SaaS offering for more than three million users with data sovereignty from T Cloud Public – and why compliance requirements from regulated markets were the deciding factor.

Discover sovereign cloud for content services

BaFin Compliance with the Cloud

Creditreform operates core systems with more than 88 million corporate data records in BaFin-compliant fashion on T Cloud Public – backed by a Financial Addendum and Enterprise Agreement with dedicated personal support.

Explore BaFin-compliant cloud usage in detail