ACEA S.p.A. is a Rome-headquartered multiutility operating critical infrastructure across Italy since 1909. The attack surface is broad by design: water treatment and distribution networks (aqueduct, sewerage, purification) serving roughly 10 million people across Lazio, Tuscany, Umbria, Molise, and Campania; electricity distribution delivering approximately 9 TWh annually; waste processing at 2.2 million tons per year; and public lighting systems. That's the full stack of operational technology that nation-state actors and ransomware groups have been targeting across European critical infrastructure - not hypothetically, but actively.
The company is listed on the Italian Stock Exchange (FTSE Italia Mid Cap) and operates under Italy's critical infrastructure regulatory frameworks, which means compliance obligations stack on top of genuine OT/IT security requirements. ACEA's stated technical direction includes robotics, AI integration, and digital transformation across its operational assets - each of which expands the convergence layer between IT and OT environments and introduces new exposure to manage.
The threat model here is squarely in the ICS/SCADA and OT security space: industrial control systems governing water treatment chemistry, grid distribution switching, and waste facility operations - all networked, all increasingly digitized. Defenders working here are operating on infrastructure where availability is non-negotiable and where a segmentation failure or misconfigured remote access point has direct physical-world consequences for millions of people.
Security roles at ACEA sit at the intersection of traditional enterprise security (the company runs a large corporate IT estate supporting a major listed group) and the harder, less forgiving domain of operational technology. The scale and sector diversity - water, energy, waste, lighting - means the work spans multiple regulatory regimes and distinct industrial environments under one organization.
