Sourcéo Secures Drinking Water for One Million Residents with Full Visibility Over Its OT Networks

Introduction and context :

A key player in public water services within the Métropole Européenne de Lille, Sourcéo ensures the production of drinking water for over one million residents. The public utility oversees the entire process, from groundwater abstraction to treatment at its facilities, through to distribution to network operators.

On a daily basis, its teams operate and monitor multiple production and treatment sites to ensure water compliance with health standards and a reliable supply across the entire metropolitan area. The complexity of these operations requires precise and continuous supervision, as well as immediate responsiveness in the event of an incident, to safeguard a vital resource.

Sourcéo at a glance :

• 60 million m³ of drinking water produced annually

• 1.1 million residents supplied

• Over 4,000 km of drinking water network

• Multiple production and treatment sites in operation

Sourcéo’s Challenges in Securing Its Industrial Networks:

Securing Sourcéo’s industrial networks and critical infrastructure represents a significant technical and organizational challenge. Teams faced several key obstacles:

• OT (Operational Technology) networks were complex and only partially documented, making supervision and anomaly detection difficult.

• OT teams required full operational autonomy to manage and secure their networks independently from IT teams.

• Compliance with the NIS2 European Directive imposed stricter cybersecurity standards, mandating comprehensive traffic mapping and vulnerability identification.

• The solution had to be sovereign, in order to meet internal requirements and regulatory constraints.

The objective was clear: to provide OT teams with the means to visualize the entire network, analyze traffic flows, anticipate risks, and detect vulnerabilities, while maintaining full operational control.

A Phased Approach with Seclab and AGILiCOM:

To address this challenge, Sourcéo chose to partner with Seclab, for its sovereign and innovative OT cybersecurity solutions, and our partner AGILiCOM, for its expertise in deployment and on-site support.

The project was structured in two complementary phases, enabling Sourcéo to test, validate, and roll out the solution with full confidence.

Phase 1 – Proof of Concept (POC) 

Prior to deployment across all sites, Seclab Xplore (a visibility and detection solution purpose-built for OT environments) was installed at a first facility to test the solution under real operating conditions:

• 2 Seclab sensors deployed
• 500 network-connected devices analyzed
• Duration: 1 month, with direct support from Seclab and AGILiCOM teams

This phase made it possible to :

• Validate the relevance and reliability of the solution

• Map the industrial network in real time

• Test the tool’s ability to detect vulnerabilities and generate actionable reports for OT teams

The POC also served as a training opportunity for teams on data collection and analysis, ensuring knowledge transfer from the very first stages.

Phase 2 – Full-Scale Deployment

Building on the success of the POC, Sourcéo decided to extend deployment to three facilities, covering all of its industrial sites:

• 3 Seclab probes monitoring all sites
• 1 Seclab Xplore licence, managing up to 1,000 devices over 4 years
• In-depth training of OT teams by Seclab experts, enabling them to analyze traffic flows, identify risks, and operate the network autonomously

The deployment was carried out by Sourcéo’s teams, supported by AGILiCOM and Seclab, ensuring full knowledge transfer and immediate operational use of the solution.

Results and Customer Benefits : 

Today, as a result of this project, Sourcéo benefits from:

• A comprehensive and dynamic mapping of all its industrial networks

• Real-time visibility into network traffic and interactions

• Proactive vulnerability detection, enabling teams to anticipate and prevent incidents

• Full operational autonomy for OT teams, capable of managing and securing their infrastructure independently from IT

• A sovereign solution, fully compliant with NIS2 requirements, perfectly suited to industrial needs

• Improved mutual understanding and seamless collaboration between IT and OT teams

Within just a few months, a complex and critical industrial network became manageable, secure, and operational on a day-to-day basis, giving Sourcéo complete control over the security of its infrastructure and the reliability of its drinking water production.

Testimony of Maxence Halluin, CISO, Sourcéo

What does the solution concretely bring to your day-to-day operations?

«On a daily basis, the solution allows us to maintain permanent visibility over our network activity and to quickly identify unusual behaviors. It is also a genuine asset in building and enriching the detailed mapping of our industrial infrastructure. Thanks to this visibility, we are able to diagnose the root cause of certain alarms triggered by our SCADA system more rapidly. Its visual approach also facilitates team buy-in and encourages greater involvement in the project. As part of our network segmentation approach, the insights provided by the tool help us make informed decisions and carry out certain technical trade-offs with greater confidence.»

What made the difference compared to other approaches or solutions?

«The first differentiating factor is that the solution is French-made. This is an important criterion for us, as it facilitates communication between the vendor and our teams. We particularly value the availability, responsiveness, and level of expertise demonstrated by Seclab and AGILiCOM.

In terms of industrial device detection, the solution clearly stands out from the other tools we had the opportunity to evaluate. It delivers a higher level of performance while remaining more competitive from an economic standpoint.

The user interface and the underlying technology choices were also decisive factors. Having a developer background myself, I pay close attention to interface quality, tool ergonomics, and the robustness of the technical stack. On all these aspects, the solution fully meets our expectations.»

What concrete benefits have you observed since implementing the solution?

«Without this solution, we would probably not have completed the network mapping work in such a comprehensive and structured way. Beyond the technical benefits, the tool facilitates dialogue between IT and OT teams by improving their shared understanding of the network and industrial environments. This collective upskilling has a positive impact on both operational efficiency and team dynamics, with staff feeling more confident and better aligned around common challenges.»

Download complete use case by clicking here.