The operator had recently expanded its onshore support infrastructure and was running a hybrid environment that connected operational technology (OT) systems at extraction sites to its corporate IT network. A routine security assessment had identified twelve critical vulnerabilities across the OT-IT boundary — none of which the existing IT team had the specialist skills to address. The business had six weeks before a scheduled regulatory audit.