If we have selected the wrong experience for you, please change it above.
From strategy to operations: How Deloitte supported in transforming Hiab’s security posture
A case of building enterprise cybersecurity culture and managed security services
In the rapidly evolving landscape of industrial cybersecurity, few collaborations demonstrate the full spectrum of digital transformation – from cultural change to operational excellence – as comprehensively as the partnership between Deloitte’s Cyber practice and Hiab, a global leader in load handling solutions. What began as a strategic initiative in 2024 has evolved into a multi-phase engagement that fundamentally reshaped how Hiab approaches cybersecurity across its organisation.
The strategic foundation: from challenge to roadmap
In 2024, Hiab faced a critical juncture. As a global manufacturing company with operations spanning multiple continents, the organisation recognized that its cybersecurity capabilities were not aligned with the scale and complexity of modern threats. Internal resources were stretched thin, and there was no coordinated, enterprise-wide approach to cyber risk management.
The turning point came with the appointment of Mikko Jylhä as Chief Information Security Officer. Jylhä brought a mandate to transform Hiab’s cyber posture from reactive to proactive. Hiab had a view of the direction it needed to take, but with limited resources and multiple areas requiring attention, prioritisation was critical: where would focused investment make the greatest difference?
Rather than moving directly into tactical implementation, Juha Kolehmainen, Cyber Partner from Deloitte, proposed the CISO Transition Lab as a strategic exercise to challenge and validate Hiab’s priorities, identify the most important capability gaps, and translate the overall direction into a focused roadmap.
The engagement brought together Deloitte expertise across cyber risk, technology strategy, organisational change and business transformation to assess Hiab’s current state, challenge its thinking and jointly refine the target state and priorities. The output was not a prescriptive solution, but a structured framework for prioritising and sequencing the transformation. The Lab provided an assessment of cybersecurity maturity, identified key capability gaps and helped shape a phased roadmap for developing Hiab’s cybersecurity capabilities. The resulting roadmap gave Hiab a common reference point for prioritising initiatives and allocating limited resources.
For us, its not about implementing security capabilities – it is about becoming a genuine partner in Hiab's security transformation. We had already worked together on strategy and culture, so when we moved into operational delivery, there was already a foundation of trust and shared understanding.
- Juha Kolehmainen | Cyber Partner, Deloitte
Building a security culture: people as the priority
With the strategic roadmap taking shape, security culture was identified as one of the areas requiring focused attention. Hiab and Deloitte began developing a Security Culture Change Program based on a simple principle: technology and security processes alone are not enough. Employees need to be able to recognise security risks, know how to respond and feel confident reporting something suspicious.
Early in the programme, Hiab ran a series of internally developed phishing simulations designed to demonstrate how convincing targeted social engineering can be. The simulations were unannounced and deliberately used knowledge of Hiab and the organisational changes taking place at the time to make the messages realistic. The results showed that many employees interacted with the messages, while relatively few reported them as suspicious. The purpose was not simply to test employees, but to create a tangible starting point for the awareness programme.
Rather than relying on one-off training, Hiab and Deloitte developed a multi-phase programme designed to build awareness over time and reinforce practical security behaviours. Deloitte brought change-management and security-awareness expertise to help structure the programme, while Hiab provided the organisational context and internal knowledge needed to make the activities relevant to employees.
The first phase focused on understanding stakeholders, defining the desired security culture and establishing the foundations for the programme. The next phase moved into broader activation and reinforcement, combining global campaigns, security communities, phishing simulations, Cybersecurity Month activities and short, recurring learning content across different internal channels.
The SANS Security Awareness Maturity Model was used as a framework for assessing the programme’s maturity and setting longer-term development goals. Together, these elements established a more structured approach to security awareness, moving from individual activities towards a continuous programme focused on practical behaviour and reinforcement.
From design to delivery: The SOC selection
While the security culture programme was underway, Hiab and Deloitte initiated a parallel workstream focused on the future Security Operations Center. Deloitte organised and facilitated a SOC Lab, bringing together Hiab’s technical teams and business stakeholders with Deloitte’s SOC experts.
The discussion deliberately moved beyond “what tools do we need?” to more fundamental questions: What outcomes should the SOC deliver? How should Hiab organise to achieve them? What kind of operating and partnership model would best support those objectives?
Following the SOC Lab, Hiab translated the defined objectives and operating requirements into a formal Request for Proposal for a managed SOC provider. The requirements emphasised 24/7 detection and response, proactive threat hunting, technology flexibility, transparency and an operating model that could evolve with Hiab’s needs.
In June 2025, following the RFP process, Hiab selected Deloitte as its managed SOC provider. The decision extended the existing collaboration from strategic and advisory work into operational security services. Important considerations in the selection included understanding of Hiab’s operating environment, global service capability with local support, flexibility in the underlying technology model, and the ability to develop the service as Hiab’s security needs evolve. The resulting service model combines Deloitte’s EMEA Cyber Center in Madrid with dedicated resources supporting Hiab locally in Helsinki.
The visit to Deloitte EMEA Cyber Center deepened our partnership and transformed the SOC into a genuine collaboration – not a transactional vendor-client relationship. Deloitte and Hiab teams will continue to meet regularly, breaking down silos and working as one integrated unit toward our shared security objectives.
- Mikko Jylhä | CISO, Hiab
Lessons for cyber transformation
The Hiab-Deloitte collaboration offers several important lessons for organisations seeking to transform their cyber posture.
First, strategy must precede tactics
The CISO Transition Lab established a strategic foundation before tactical implementations, enabling more effective resource allocation and better business alignment. Too many organisations pursue disconnected security projects without coherent strategy.
Second, technology and human behaviour – culture – need to develop together
The Early phishing simulations at Hiab demonstrated how effectively social engineering can exploit organisational context and periods of change. The experience reinforced the need for awareness activities that go beyond one-off training and continuously help employees recognise, respond to and report security threats.
Third, operational excellence requires continuous improvement
Deloitte’s approach systematically reduces false positives in the SOC, refines detection rules, and optimises playbooks. This reflects a maturity model where security operations continuously evolve rather than remaining static.
Fourth, a strong security partnership goes beyond technology and commercial considerations
Hiab’s selection of Deloitte was based on the wide support of leading technologies and strong global support, with the value of an existing relationship, diverse expertise, and demonstrated understanding of business context.
In cybersecurity, technology and service capabilities are only part of the equation. Trust matters too – not only between organisations, but between the people who need to work together when it matters most. A strong security partnership depends on confidence in the people, their judgement, and their ability to operate as an extension of your own team.
As of mid-2025, the Hiab-Deloitte partnership has moved from strategic planning and cultural transformation into operational delivery, with a phased implementation roadmap extending through 2027.
Most importantly, the partnership demonstrates that cybersecurity transformation is not a project with a defined end date – it is a continuous journey of learning, adaptation, and improvement. For other organisations contemplating their own cyber transformation, the Hiab case offers a valuable blueprint: start with strategy, engage the entire organisation in cultural change, implement operational excellence, and build partnerships that can grow and adapt with your needs.
Deloitte’s cybersecurity solutions help you to operate securely and grow successfully.
Deloitte’s cybersecurity solutions help you to operate securely and grow successfully.
