Trivium Packaging

Trivium Packaging is one of the world's leading metal packaging manufacturers, producing cans and aerosols for global consumer brands, with manufacturing plants across Europe and the Americas and approximately 7,200 employees operating across 57 locations and around 50 manufacturing plants. The business runs on uptime, when a plant goes down, the cost is immediate and measurable.

For a company like Trivium, the primary risk is operational resilience rather than data theft. Metal packaging manufacturers hold little intellectual property worth stealing, yet ransomware groups pursue them precisely because production downtime generates leverage fast: disrupt output, extract a ransom. Trivium learned this directly in 2021, when the company suffered an enterprise-wide ransomware attack that shaped every security investment that followed.

"Cybersecurity investments are driven by three parameters. Compliance, risk, and an incident. In our case, it was the risk and the incident that drove us."

— Roel Schouten

The threat landscape hasn't stood still since. Geopolitical instability, AI-assisted vulnerability discovery, and increasingly sophisticated attack groups have made speed of detection, not just prevention, the metric that matters. Roel is direct about this: "I don't think we can patch our way out of the threat. You can patch within an hour and still be vulnerable."

Trivium needed a multi-layered security strategy covering network segmentation, reduced external exposure, and business continuity planning, and, critically, someone watching the environment around the clock who could act without waiting for a call to be answered.

Response times have moved from hours or days to minutes. In two and a half years of partnership, Trivium Packaging has had zero critical incidents, a result of the approach Smarttech247 has taken in extending visibility, plugging gaps, and providing proactive, fast incident response. Security posture scores across all three measures Trivium tracks as guiding indicators have hit their targets: Microsoft Secure Score, internal vulnerability exposure score, and the external UpGuard rating have all improved consistently since the partnership began.

Across 5,962 total reports, Smarttech247 identified 1,401 true positives, with just 57 reports (0.96%) escalated to P2 or P3 severity. A false positive rate of 70.1% reflects the inherent noise of a complex global environment, and the value of an MDR partner that filters it before it reaches the internal team.

Since the NoPhish programme went live, Smarttech247 has confirmed genuine phishing attacks in roughly one in four submissions reported by Trivium employees, while triaging out the vast majority as noise so the internal team never had to chase false alarms. Employee reporting volume has grown by more than 80% over the partnership without any drop in triage quality, and the confirmed threat rate has stayed consistent every quarter even as volume nearly doubled. Fewer than 1% of all reports ever escalated beyond routine priority, meaning the overwhelming majority of threats were caught and closed before they had any chance to become an incident.

Strategic capacity has grown as the internal team has shifted from reactive operations to proactive security improvement, work that previously consumed analyst hours now happens within Smarttech247's service, freeing the internal team for higher-value activity.

"At Smarttech247, we build strong partnerships with our customers, and we focus on getting measurable outcomes that help them reduce their security posture. We invest in our relationship with our clients and make it our business to support them in reducing risk and delivering an MDR capability that feels like in-house."

— Raluca Saceanu, CEO, Smarttech247

Trivium Packaging ran a formal RFP process in 2023 and evaluated three shortlisted providers. The technology capabilities across the finalists were broadly comparable, what separated Smarttech247 was the approach.

"It felt like a tailored solution. Not like a standard presentation being read from a slide. It felt like Smarttech247 had actually understood our challenges specifically, not just the challenges everyone in manufacturing faces."

— Roel Schouten

That distinction mattered because Roel's internal security team is deliberately lean. With approximately 10 people focused on advisory and analytical work rather than operational tasks, the model only works if the external partner truly functions as an extension of the team, not a separate layer.

Smarttech247 provides Trivium Packaging with round-the-clock 24/7 SOC monitoring, filling the gap that a geographically distributed team of 10 cannot maintain alone. Roel has team members in Europe and the US, but an attack at 3am does not wait for a business-hours response.

As part of the MDR solution, Smarttech247 helps Trivium build use cases, map them against the MITRE ATT&CK framework, and continually extend visibility. Smarttech247 doesn't just monitor, detect and investigate. A key element of the arrangement is a pre-authorised incident response capability: if Smarttech247 detects a high-confidence attack at any hour, analysts can isolate any system on the Trivium network without first escalating for approval, removing the delay that can turn a contained incident into a full breach.

"If they discover a high-confidence attack at 3 o'clock in the night, they can isolate the system, no matter how critical the system is. I don't have 24/7 coverage in my team. It's good to have someone there that we know is helping us around the clock."

Beyond incident response, the partnership has changed how Trivium's internal team spends its time. With operational security work handled by Smarttech247, the team has shifted from predominantly reactive work to strategic improvement. Over the past two years, that has meant working through Microsoft Secure Score metrics one by one, reducing vulnerability exposure and improving external security ratings through UpGuard.

"We can focus much more on strategic tasks. That wouldn't have been possible if we hadn't had the help from Smarttech247."

The relationship has also extended to red team and purple team exercises, where Smarttech247 analysts have participated actively and learned alongside Trivium's internal team, collaboration closer to a shared security function than a vendor relationship.

Closing Quote — What Roel Would Tell Another Security Leader

‍"I can only recommend Smarttech247, and in general the hybrid MDR model. It works very well."

When asked what he would tell a fellow CISO that they wouldn't find in a product sheet, Roel's answer was consistent with how the partnership started:

"That's how it feels. It seems like it's an internal team. They feel very much like real colleagues."

For a security leader running a lean function at a global manufacturer, this is what provides real security value and what separates Smarttech247 from other MDR providers: an external team that feels like an internal one.

See what a true MDR partnership can do for your organisation. Talk to Smarttech247 about extending your security team with 24/7 managed detection and response.