Clarios is the world’s largest battery manufacturing company, with more than 50 facilities around the globe and approximately 155 million batteries manufactured each year. To help keep the automotive industry moving, Clarios is strengthening its ability to detect, respond to, and recover from identity threats.
How Clarios is building cyber resilience from the inside out
Clarios’ Chief Information Security Officer explains why identity resilience is essential to business continuity and how Semperis helps the organization protect its Active Directory environment and broader identity ecosystem.
My role at Clarios is Chief Information Security Officer. I'm also in charge of the IT infrastructure. I've been with Clarios for about six years now. Clarios is the world's largest battery manufacturing company—and when I say battery, it's the low-voltage battery that goes into every automobile. We are a global company. We have about 50+ facilities across the globe manufacturing these batteries, and we manufacture about 155 million batteries a year. So we have this core company that does manufacturing of the batteries. The basic fundamental thing is we have to protect that business. We have to ensure that continuity of operations and manufacturing happens because the entire automotive industry is dependent on the batteries that come in. Otherwise, you know, big automotive companies cannot roll their cars out of their assembly lines. We are getting into battery management system, which is a software that can go into these batteries and make the batteries smarter, right? Those demands or asks are coming from these same car manufacturing companies. So, we are going from manufacturing to being a software company, and that could result in us having services too. Think about it as we manage the ecosystem of all the batteries in fleets and stuff like that, and that's a major service business. So my challenge is balancing this, protecting the core company—which still is 80 percent of our revenue today—and also preparing the organization, preparing the infrastructure and security for these new areas that are coming up. And that's my ongoing challenge every day. What is the impact if Clarios is down? The cars don't roll off the assembly lines. Because every car that rolls off the assembly line—cars, trucks, you know, big trucks and stuff—they need to have their low-voltage battery to make it function. So, if we are down, they are down, and that's not good. Why Semperis? When we were doing our initiatives for our cyber program and stuff, we had this tagline that said, “We want to be good and protect,” following the NIST model. But then we said, “We want to be good and protect but we want to be excellent in detect, respond, and recover.” The logic behind that is we can only protect so much. And I think the smarter organizations are organizations that have good respond and recover capabilities. So, as we were looking at some of those things, it became very quickly clear that most of that effort was focused on applications, and the redundancy and other SaaS providers and others how do you do backups and stuff like that were all discussed. But then when we did an exercise, as we went through the step-by-step process during an actual rehearsal, we realized that we are assuming a lot of stuff when it comes to Active Directory, right? My boss said, “What do you do when Active Directory is down?” The narrative changed when attackers get hold of your Active Directory and render that useless or you cannot trust any of the identities. So, that's where the conversation started, and we started to look for solutions. And Semperis came from our research, and we started the discussion. Today we use Semperis for our forest recovery, for our DSP tool that does our detection, and also DRET. I don't know if we use the full-fledged portfolio of Semperis, but we have a major portion, we have a majority of their products. We also are interested in the Ready1 product mainly because, as I said, resiliency is big. We are making some investments in crisis management and business continuity, so we don't want to be inventing the wheel during a crisis. So, how do we make sure that we have a set of procedures that people know how to follow and do testing on a periodic basis? So, we are very interested in that capability also. I cannot say enough about the technical capability that the Semperis team brings to the table. You know, we think AD is a small piece of a broader recovery strategy, but I think we often forget it's a very, very critical piece of it, and if we can make that easy, it is that. So, whether it is attending their events, whether it is bringing somebody from Semperis to our organization to do a workshop-style discussion or a product demo, I have been very impressed with their capabilities. My team has been very happy with not only the technical acumen, but also the broader knowledge they bring to the table, right? As much as we say Active Directory, it is the broader identity ecosystem that needs to be taken into account. So many organizations have not only Active Directory, but also other IGA tools and privileged access management tools and so on. So the breadth that the Semperis team brings to the table on a critical piece of identity security is very much appreciated, and we have always had a good experience with them.
The resilience challenge
The stakes are high: If Clarios operations go down, automotive assembly lines can be affected. Identity security and recovery are therefore critical to maintaining continuity across a global, highly connected business.
We want to be good in protect, but we want to be excellent in detect, respond, and recover.
Prasanna Ramakrishnan, VP-Global CISO at Clarios
During a recovery exercise, the team recognized a critical gap in its assumptions. Application recovery and SaaS redundancy were well understood, but the organization had to ask a more fundamental question: What happens when Active Directory is down or when attackers have compromised the identities the business depends on?
That realization shifted the conversation from application recovery to identity resilience. Clarios began looking for solutions that could help the team recover when its identity environment could no longer be trusted.
The Semperis approach
Today, the organization uses Semperis Directory Services Protector (DSP), Active Directory Forest Recovery (ADFR), and Disaster Recovery for Entra Tenant (DRET) to power a well-rounded identity threat detection and response (ITDR) strategy. The team is also evaluating Ready1 as it continues to invest in crisis management, business continuity, and repeatable recovery procedures.
Together, these capabilities support Clarios’ identity resilience objectives:
- Prepare to recover the identity environment after a compromise.
- Detect threats and security issues affecting Active Directory.
- Build confidence through repeatable procedures and periodic testing.
- Protect the broader identity ecosystem, including Active Directory and Entra ID.
Why identity resilience matters
Active Directory may be one part of a broader recovery strategy, but it is a critical part. If identities cannot be trusted, business-critical systems and operations can be affected—even when other recovery plans are in place.
For Clarios, Semperis provides more than technical capabilities. The team values the technical acumen, breadth of knowledge, workshops, demonstrations, and partnership that help it address identity security as part of a wider cyber resilience program.
Identity resilience is business resilience. By preparing to detect, respond to, and recover from identity compromise, Clarios is helping protect the continuity of the manufacturing operations that keep the automotive industry moving while preparing its identity infrastructure for what comes next.
Ready to drive resilience at your organization? Request a demo.
