About SoterICS
SoterICS is a leading Managed Security Services Provider (MSSP) specializing in operational technology (OT) systems. These environments typically involve on-premises infrastructure and industrial machinery which often lack connectivity and pose complex security challenges. SoterICS’s unique approach is to offer autonomic MDR for continuous detection and response, backed by a high degree of orchestration, automation, and human expertise.
Executive summary
OT security specialist SoterICS aimed to shift from a consulting-based business model to offering managed security services but faced scalability challenges due to high analyst wage costs. To address this, the team set out to develop a market-leading managed detection and response (MDR) solution, leveraging workflow orchestration and automation to maximize the impact of a small, skilled team of engineers. Today, Tines is at the core of their company strategy, driving both growth and innovation.
The challenge
SoterICS sought to transition from its consultancy-based business model to generating recurring revenue by entering the MSSP market. To drive this transformation, they tasked Industrial MDR Lead Amine Besson with spearheading the development of new and innovative solutions.
“We wanted to kill two birds with one stone: an automation-first platform to help build our tech foundation, and a case management interface mature enough to build our first customer portal iteration,” he says.
A powerful SOAR tool was central to Amine’s vision, but Tines proved to be far more than that, eventually redefining his approach to orchestration, AI, and automation.
Why Tines
Amine narrowed down a long list of 20 vendors to just two: Tines and Mindflow.
“They have really good ideas, but I felt they were still playing catchup with Tines," Amine explains.
At this stage of our company, we want to be driven by our tech. We want it to inspire people and raise our maturity.
Amine Besson, Industrial MDR Lead
“Additionally, when I compared the Mindflow pricing model with Tines for our roadmap in 2026, due to our specific multi-customer and multi-physical site requirements, they would cost multiple millions, whereas Tines would still be cost-efficient for us.”
Tines also stood out by offering a solution that’s quicker to deploy and easier to use than typical SOAR platforms, which can take years to fully adopt and might require a high degree of coding skill to use.
“The SOAR market is very slow, very old,” Amine says. “They stopped innovating five years ago, never fully delivered on their promises to accelerate SecOps, and now they're declared obsolete by Gartner."
We settled on Tines because it's not a SOAR, it's platform that we can use to automate our security operations.
Amine Besson, Industrial MDR Lead
“I'm very good at Python, but I don't want the entire platform to be based around that. I want the platform to be smartly designed for other people, and also for me, so I can focus on building workflows, not solving code problems.”
Although not initially a requirement, Tines’ event-driven approach also impressed Amine and his team.
“It actually became the reason why we booted off the other platforms,” he says. “They're not event-driven. They don't have webhooks. I can't replay events when I develop a workflow. All of those things are very, very smart and changed our expectations of what the platform could do.”
Top use cases
Advanced security operations
Case management
The impact
Tines is already shaping up to play a critical role for SoterICS. In fact, Amine tells us, “Our entire company strategy for the next three years is structured around a hyperautomation foundation, which we are building with Tines.”
It’s already had a significant impact on the business, including:
Fuelling a unique and innovative MSSP solution
Tines has empowered SoterICS to introduce a new value proposition to its customers: managed security services delivered through a self-service portal. This portal displays alerts, dashboards, and proactively notifies users of critical incidents, enabling customers to focus on the most important events, reduce costs, and strengthen their security posture.
In 2025, SoterICS aims to pilot an extension to its portal built on top of Tines Workbench and its integrations to customer environments, exploring a unique approach to ChatOps in the context of Industrial security posture control.
It’s a key differentiator for their customers, says Amine.
We want to use Tines as our customer portal for next year, which is a huge saving of money because we’re not going to pay another company to develop it or choose another low-code platform.
Amine Besson, Industrial MDR Lead
"We were planning to deliver a custom frontend, and we - and also our customers - loved Tines interface so much that we chose to keep it for our initial version of the portal.”
Enabling an engineering-first growth story
Tines-driven orchestration, AI and automation has also empowered SoterICS to “flip the script” and transition from an analyst-centric business model, which limited how far the company could grow.
Amine explains, “Leadership asked me, ‘How much analyst time do I need per day per client?’ And I said, ‘We won't be able to scale by just throwing humans at an alert queue. Let's use Tines. Let's automate from the start, as part of our service, and let's eliminate the human toil.’"
I want people who contribute to the intellectual property and who build in Tines, not people who just click on the screen.
Amine Besson, Industrial MDR Lead
"Instead of a linear analyst-based cost scaling, where we'd need at least a dozen hires and potentially millions in wages to tackle our expected sales funnel, we can now invest in a smaller, more expert automation-focused team that scales gracefully. This is our new growth story. Engineering-first.”
Setting new standards through orchestration, AI, and automation
Tines enables Amine and his team to build workflows in hours, versus a “multi-month project” if they used a traditional SOAR platform. This gives the team an immediate advantage over their competitors. But there are also cost and quality benefits that the business can pass on to customers.
“I think it's a higher quality service for customers because there are many MSSPs who just get an alert, create a case, and notify the customer, and then they might use a SOAR to perform basic auto-closing or IOC enrichment. That's not automation. It’s minimal automation,” Amine argues.
“We do it very differently. We eliminate all triaging. We group and merge and enrich all in the workflow and then we create the case, and actually, we keep updating cases. Our approach is to deliver a complete attack storyline around a potential sequence of threat signals, compressing the noise floor down, and ensuring that the unique risk of our customers' industrial environment is used to refactor limit thresholds. No system allows it today out of the box, and it needs to be built with a technology foundation with automation at its core.”
By combining human expertise with Tines workflows, SoterICS can deliver faster detection at a lower cost, he adds.
"We want to create valuable incidents, made from qualified correlations between alerts and industrial devices, and continuously tuning, automating and integrating our client data and business logic. And because you have a self-service portal, you can see with complete transparency what's happening.”
Happier team members and stable service quality
This combination of human expertise and automation means that, even if a team member leaves SoterICS, it retains the intellectual property that drives these higher-quality services.
Tines reduces toil for their engineers, which Amine tells us has “created a lot of enthusiasm in the company. We are eager to keep building our unique product and deliver an end-to-end value add.”
Improved case management and flexibility
Amine has also been pleasantly surprised by Tines’ case management product Cases.
“In my experience at MSSPs, I usually expect customers to want us to integrate with external case management systems, but because Tines Cases is really nice, it's actually a lower priority item,” he says.
In fact, Amine describes Cases and Records as “a bit of a secret weapon.”
“All the SOAR platforms fail because they’re just doing workflow automation, which was not the bottleneck in the industry. The bottleneck was triaging, and triaging for us was grouping alerts,” he explains.
“So I wanted some kind of solution which allows me to assemble and group alerts onto a timeline and then I can raise my case. "
With Tines, I was surprised that the Cases and Records feature together allow me to do very rich use cases.
Amine Besson, Industrial MDR Lead
What’s next
Amine and his team are bullish about the future.
“Tines is what is going to allow us to scale from €2M to €10M ARR, that's in our roadmap. It's a key enabler to our growth,” he says.
A key project on their roadmap is introducing Workbench, a Tines-powered AI chat interface, to their customers.
Our founder has this idea of an OT knowledge base which would be a tool of tools that connects to all the OT customer tools, so they can query anything in a single place and see what comes back. I think Workbench fits perfectly into that.
Amine Besson, Industrial MDR Lead
"The idea of an AI chat interface like Workbench is very desirable for some of our customers.”
SoterICS is also exploring automated containment and entering the threat intelligence space, further expanding its capabilities with Tines.
Reflecting on the importance of Tines to their business, Amine concludes: “Without Tines, we’d lose all our capabilities and advances compared to the rest of the market, and we’d just do click operations, with something like a 15% margin on every employee, with no economy of scale and no growth story."
Our expertise, and ambition to become a leader in Cyber Physical System (Industrial) Security is now enabled by Tines, and we are eager to deliver our value to the market with the platform.
Amine Besson, Industrial MDR Lead