Repsol: Establishing Continuous Cyber Resilience Through Relationship-Led Delivery

Cybersecurity isn’t just about tools and frameworks; it’s about trust. Here’s how one small engagement grew into a multi-year program that transformed delivery.

From First Project to Trusted Partnership: How Relationships Drive Delivery

In cybersecurity, projects often begin with a technical focus – an assessment, an exercise, or a remediation plan. But experience has shown that the real driver of success isn’t just technology or methodology. Shai Mizrachi, Sygnia Sr. Cyber Security Consulting Manager and Program Director for Repsol engagements, shared that “it’s the relationship you build with the client.”

The First Step: A Small Engagement that Opened the Door

Sygnia’s partnership with Repsol began in September 2021 with a cybersecurity posture assessment focused on IT and OT at one site.

This initial project showcased our expertise and the value we bring as a trusted cybersecurity partner. Just months later, in February 2022, Repsol engaged Sygnia again – this time to enhance SOC visibility.

The success of these projects wasn’t just about strong execution. It was about how we worked: listening, adapting, and ensuring the client felt supported at every step. That early collaboration laid the foundation for something bigger.

Ramon Sanchez-Cantalejo Gamino, Repsol’s Cyber Security PMO: “This kind of trusted relationship helps us move projects forward on time and with great cooperation while also managing the whole program with flexibility. It’s not just about delivery it’s about working as one team.”

Scaling Up: From Projects to Program

What began as a small initiative evolved into a 2.5-year program – Journey to Excellence – focused on advancing security maturity through an average of eight projects per year. As the scope expanded, so did the partnership.

To strengthen collaboration, Sygnia delivered most projects onsite. Physical presence fostered personal relationships and day-to-day trust that remote work rarely achieves. Over time, this trust led to something invaluable: full transparency across all teams.

Sygnia built deep connections throughout Repsol – from technical teams to mid-level managers and C-suite executives. This multi-layered trust ensured alignment, accelerated decisions, and created a shared commitment to elevating cybersecurity maturity.

Sygnia engagement at every level:

• Technical Leads: Plan engagements, approve agendas, and share documentation.
• Technical Teams: Collaborate on technology and processes during sessions.
• Mid-Level Management: Participate in technical sessions and reviews.
• Senior Management: Receive reports and discuss key findings and risks.
• Business Units: Join kickoff sessions and review reports for relevant engagements.

Transparency changed everything. Challenges surfaced faster, feedback became direct, and collaboration turned seamless. That’s when work shifts from “completing projects” to driving real transformation – taking Repsol’s cybersecurity posture from good to great.

The Next Chapter: A Deeper Partnership

By the end of 2024, the results spoke for themselves: dozens of successful projects and a partnership built on trust. That trust led Repsol to commit to a new three-year program designed to go deeper and strengthen critical areas.

Program Highlights:

• Threat Hunts: Proactively uncover hidden risks
• Purple Team Exercises: Sharpen offensive and defensive readiness
• Posture Reviews: Deep dives across IT and OT environments
• War Games: Prepare for real-world crisis scenarios
• Re-Assessments: Validate and reinforce earlier improvements

This continuity does more than improve delivery. It builds long-term resilience.