Hitachi Energy Chooses Zscaler Zero Trust SASE to Power a Greenfield Security Transformation

More than three billion people on planet Earth depend on Hitachi Energy to power their daily lives. From producing transformers and high-voltage products to building, automating, and integrating energy grid systems across the globe, the company plays an integral role in the world’s energy infrastructure ecosystem.

The Hitachi Energy of today was formed in 2020, the result of a carve-out and divestiture of the power grid business unit from ABB Ltd (the global technology company originally known as Asea Brown Boveri) following acquisition by Hitachi, Ltd. Rather than fully absorb the new business unit into existing operations, Hitachi decided to create a new standalone, cloud-first global energy technology company complete with its own independent IT team. With this independence came the rare opportunity for a greenfield security transformation.

“As an IT leader, this is something you might get to do once in your professional lifetime,” shared Michael Loechle, Executive Advisor in Japan, Hitachi Energy. “We had the architectural freedom to design a modern cybersecurity architecture from first principles and without legacy constraints.”

The company needed to secure a globally distributed environment spanning users, applications, factories, operational technology (OT) systems, and energy infrastructure operations across the globe. With more than one-third of the world’s population using Hitachi Energy technologies on any given day, cybersecurity resilience isn’t just about business continuity—it’s about protecting the critical systems that support modern society.

Hitachi Energy required a security architecture capable of protecting highly distributed operations at a massive scale, and for Loechle and his team, zero trust was the only choice.

“Traditional security models are largely built around implicit trust, and the risk that creates could be catastrophic for a dispersed global infrastructure like ours,” said Loechle. “Zero trust reverses that logic entirely, and that fundamental shift in mindset aligns with our vision for a security architecture designed for maximum scalability and operational resilience.”

For most large enterprises, zero trust implementation typically involves navigating through decades of legacy security architecture build-up, incrementally streamlining appliance-heavy security stacks.

When Hitachi Energy was formed, the company was not bound to the incumbent legacy security architecture in place at ABB prior to the carve-out, and new parent company Hitachi did not mandate security stack design specifics. From day one, Hitachi Energy was able to avoid legacy, network-centric architecture and fragmented point solutions, instead designing a modern zero trust security architecture to meet its operational needs. 

The company wanted a cloud native zero trust platform that could secure global connectivity, manage diverse internal access requirements, and strengthen security posture by preventing lateral threat movement between critical operating environments.  Choosing the Zscaler Zero Trust Exchange platform as the foundation for its zero trust security architecture allowed Hitachi Energy to support rapid business growth at scale while standardizing security processes across the enterprise.

“We did not want another collection of spot solutions. We wanted a single-vendor platform that could grow with us at the pace we needed,” explained Loechle. “The highly scalable Zscaler platform is the foundation of our zero trust architecture, empowering robust security across the enterprise without adding complexity to our environment.”

Hitachi Energy technology and infrastructure is actively used across most of the planet—the company has an installed base in more than 190 countries. A dedicated group of 50,000+ employees working from corporate locations and remotely in 60 of those countries manage the energy technologies that support billions of people around the world. 

With global reach at this level, internet performance is no longer just about productivity and convenience. A slow or vulnerable connection could threaten critical energy grids worldwide. In this environment, reliable and secure access to the internet and public SaaS applications is existential.

Prior to the ABB carve-out, a proxy-centric security architecture was in place. That existing cloud proxy environment lacked the consistency, scalability, and architectural simplicity that Loechle and his team wanted. Hitachi Energy replaced that existing proxy solution with Zscaler Internet Access (ZIA) to broker direct outbound connectivity to the internet and SaaS applications from anywhere.

Zscaler delivers traffic inspection and policy enforcement as close to the end user as possible, from 160+ edge locations worldwide. Policy enforcement based on user location instead of network location eliminates the need to backhaul internet traffic. ZIA includes functionality for IPS, DNS protection, URL filtering, encrypted traffic inspection at scale, and Advanced Threat Protection. With these important security measures built-in to the Zscaler platform, Hitachi Energy can standardize zero trust policy enforcement for any outbound traffic while also eliminating multiple point products. 

“Because our workforce is so distributed, we needed a solution for outbound security that could deliver consistent protection and user experience globally,” said Loechle. “The Zscaler platform allows us to enforce standardized security policies at scale without the added complexity of managing fragmented spot controls.”

Hitachi Energy manages one of the world’s largest and most geographically distributed critical infrastructure environments, including extensive OT and industrial control systems. The company also maintains five dedicated global research centers focused on advancing energy innovation. 

Supporting these operations requires secure access to a broad private application ecosystem spanning enterprise business systems, engineering platforms, and manufacturing environments, as well as research and development. 

Demand for these resources is highly distributed, with tens of thousands of employees and third-party partners requiring varied levels of access at any time. The risk of threat from inbound exposure or cross-environment lateral movement is top of mind for Loechle.

“We operate in a massive cloud footprint, but we also have to manage significant OT across physical locations. A flat network creates risk I am not willing to accept,” explained Loechle. “We wanted to ensure that potential compromise in one corner of our digital estate never triggers a domino effect across the whole enterprise.”

Loechle did not want to rely on a traditional VPN solution for private access. The way traditional VPNs function to broker remote access via public IP addresses inherently creates a wider attack surface. Because VPNs do not support granular access control policies, the risk of lateral threat movement across a flat network also increases.

Hitachi Energy deployed Zscaler Private Access (ZPA) as the zero trust alternative to traditional VPNs. The company’s private applications and systems, hosted across a hybrid environment anchored by Microsoft Azure, are now hidden behind the Zero Trust Exchange and no longer accessible via the internet. Behind the Zscaler platform, these resources become invisible to unauthorized users and bad actors.

ZPA enables identity- and context-based policies that map users only to the resources they are entitled to access. This user-to-app segmentation prevents lateral threat movement by connecting users directly to only the private applications they are authorized to use, eliminating the risks associated with the whole-network access that VPNs enable.

“The Zscaler platform hides our private ecosystem from the public internet,” said Loechle. “With Zscaler, we have neutralized the risk of inbound exposure and lateral threat movement, which fundamentally improves our security posture.”

On the Zscaler platform, Hitachi Energy is operating totally VPN-free.

Hitachi Energy operates across 60 countries with 50,000+ employees working from offices, remote locations, and field sites wherever connectivity exists. For an organization powering critical energy infrastructure, this geographic dispersion creates a unique challenge: ensuring consistent application and network performance across dozens of ISP networks, each with different reliability profiles. When connectivity degrades, the ripple effects extend beyond frustrated employees to operational delays that impact the energy systems businesses and families depend on worldwide.

The IT team initially relied on fragmented monitoring tools that created visibility gaps and delayed troubleshooting. "You can't truly protect what you don't see," explained Loechle. "Without end-to-end visibility, we were reactive. We were responding to user complaints instead of preventing problems."

To address this, Hitachi Energy leveraged Zscaler Digital Experience (ZDX) as a core component of its Zero Trust Exchange platform. ZDX continuously monitors application, device, and network performance across their entire global footprint, generating a quantifiable Digital Experience Score every five minutes. Real-time data flows into a centralized dashboard that provides immediate visibility into:

User experience metrics: Application response times and availability by geography and ISP 

Device health signals: Battery, CPU, and connectivity quality across all 50,000+ endpoints 

Last-mile network performance: ISP latency, packet loss, and throughput bottlenecks in real time

Using ZDX, Hitachi Energy has shifted from reactive troubleshooting to proactive performance management. IT teams now identify and resolve performance issues such as ISP degradation or device health anomalies before they impact users. 

"With Zscaler, we can map every user journey to every application," says Loechle. "We have total transparency and measurable reassurance that our cybersecurity processes and performance strategies are working in harmony. We're no longer troubleshooting in a vacuum."

Achieving holistic zero trust is an evolving journey, not a one-time IT upgrade, so Hitachi Energy is already taking next steps. The company is currently piloting two additional Zscaler solutions, with plans for broader deployment in development.

Loechle wants to leverage Zscaler Zero Trust Branch to replace SD-WAN architecture at Hitachi Energy factory sites and physical offices. Traditional SD-WAN creates a wide, flat, connected network between corporate sites, and this environment is especially vulnerable to lateral threat movement. Zero Trust Branch enables café-like branch connectivity, allowing devices and apps running in the cloud, data centers, or other company locations to communicate directly with each other through the Zero Trust Exchange without exposing the underlying corporate network or industrial infrastructure.

Zero Trust Branch empowers Hitachi Energy to implement a more advanced Zero Trust Secure Access Service Edge (SASE) methodology. Traditional SASE models can fall short in critical infrastructure because they rely on underlying routing overlays that enable implicit trust. A Zero Trust SASE approach anchored by Zero Trust Branch would allow Loechle and his team to decouple factory networks from the corporate network, severing the horizontal connections between Hitachi Energy physical locations. This decoupling will remove implicit network trust entirely, isolating individual company locations into ‘networks of one’. This modern approach to branch connectivity further streamlines the technology estate for Hitachi Energy and significantly shrinks the blast radius of any potential future security breach. 

Hitachi Energy is also exploring how Zscaler Cellular can help secure remote endpoint and cellular-connected IoT devices where traditional network infrastructure is either logistically unavailable or economically unviable. Powered by the Zero Trust Exchange, Zscaler Cellular integrates with existing telecom infrastructure to enforce granular zero trust policies and centralize visibility around cellular traffic. Zscaler Cellular has already been deployed in a test cohort of handheld scanner appliances. As this Zscaler solution becomes more widely implemented, it will help the company more effectively address physical network limitations and unmonitored device risk at third-party warehouse locations, where Hitachi Energy needs to conduct business.

“By expanding the Zero Trust Exchange to modernize branch connectivity and secure cellular IoT, we can ensure that our security approach adapts at pace with our needs,” shared Loechle. “The Zscaler platform provides a unified zero trust architecture that can seamlessly protect the whole enterprise—from cloud applications to factory floors.”

At Hitachi Energy, Generative AI (GenAI) is transitioning from an experimental utility into a driver of operational velocity. Microsoft Copilot and GitHub Copilot are enabled for thousands of employees. The company also uses a custom GenAI assistant, Akira, to efficiently harvest internal enterprise data, as well as AI-driven video avatars to onboard new employees via training bootcamps. 

By automating workflows with AI, Hitachi Energy is realizing global productivity gains. But, GenAI use also carries the risk of real threats including data exposure and shadow AI, and the company’s zero trust security architecture is helping Hitachi Energy innovate without compromising corporate security.

By routing all user and device traffic through the Zero Trust Exchange, Loechle can actively monitor AI usage across the company’s global operations and enforce consistent, granular zero trust security policies. This ensures that every AI interaction, from advanced Machine Learning models on the factory floor to autonomous agents in the supply chain, is integrated into the company’s central Identity and Access Management (IAM) framework.

“Everyone is racing to implement GenAI, but threat actors are also racing to weaponize these same tools,” said Loechle. “The Zscaler platform lets us unleash the power of AI while keeping the risk contained.”

The key driver behind zero trust implementation at Hitachi Energy was shrinking the attack surface and eliminating lateral threat movement. “We are attacked on a daily basis, hundreds of times. That is the reality of our threat landscape in this industry,” explained Loechle. 

By shifting from network-centric security to an identity-driven zero trust model on the Zscaler Zero Trust SASE platform, the company has successfully neutralized those attack threats. In a recent quarter, Zscaler processed more than 15 billion transactions and 1,600+ TB of traffic for Hitachi Energy, preventing 205 million policy violations and blocking 1.7 million security threats. More than 450,000 of those blocked threats were hidden in encrypted traffic, traffic that a traditional security architecture would have struggled to inspect.

“The attack attempts haven’t stopped, but the Zero Trust Exchange catches and prevents all of them,” shared Loechle. “Zscaler gives me a good gut feeling about our security posture, and the Zscaler data we have substantiates that.”

The primary goal was absolute risk reduction, but a zero trust security architecture has also yielded structural and operational benefits for Hitachi Energy. 

Traditional security architecture can be complex to manage, with overlapping legacy appliances that carry a heavy administrative tax. These legacy point solutions also create barriers to gathering the actionable insights and data that can guide strategic security governance. Navigating those challenges across an operational footprint as large as Hitachi Energy would be untenable.

Building a modern zero trust security architecture on the Zscaler platform has streamlined the tech stack and eliminated the complexity of security management at Hitachi Energy. “On the Zscaler platform, we are achieving a better security posture with fewer appliances and less administrative effort,” explained Loechle. “Zscaler significantly lowers the cost of complexity for us.”

Loechle recognizes this as part of the larger cascading phenomenon of cost savings that can ultimately result from the transition to zero trust security. “With the Zero Trust Exchange, there’s no longer a need for so much physical hardware or IT staff time spent maintaining it,” said Loechle. “We certainly anticipate saving both time and money as our zero trust approach continues to mature.”

While budget optimization is a welcome byproduct of implementing zero trust security, saving money was not the ultimate goal for Loechle.

“Just like a private individual pays an insurance premium to protect themselves in case of emergency, an enterprise invests in security architecture,” Loechle elaborated. “There’s no alternative to making this investment when you consider the potential cost of a security failure. I don’t think an enterprise can overinvest in its security, and I know we have invested wisely with Zscaler.”

Creating an IT organization from scratch without the restraints of legacy infrastructure could have been a daunting experience, but Loechle believes that Zscaler has proven to be the right zero trust partner.

On the Zero Trust Exchange, Hitachi Energy has built a comprehensive zero trust architecture that provides the scalability to meet constantly evolving global demands and the security edge to thrive in an industry always at risk.

“From day one, our dedicated Zscaler team has treated this transformation as a shared mission, not just a platform deployment,” concluded Loechle. “Not only do we have the best-in-class zero trust security platform, we have a true zero trust ally on our side with Zscaler.”