Smart DCC cuts incident detection time by 84% and protects 124 million devices with Elastic Security

Smart DCC operates the UK's smart metering network, connecting 70% of British homes to their energy providers and managing approximately 124 million devices across critical national infrastructure. By consolidating onto Elastic Security, the team reduced mean time to detect from 50 minutes to 8 minutes, extended their searchable data window from 3 months to 12 with no rehydration delays, and saved more than £250,000 in 12 to 18 months.

Smart DCC is the licensed operator of the UK's smart metering communications network, connecting approximately 70% of British homes to their energy providers across about 124 million devices. Before consolidating onto Elastic Security, the team managed security across 15 supplier systems using a mix of a third-party managed provider, separate endpoint tooling, and self-managed infrastructure that buckled as ingestion volumes grew. After deploying Elastic Security on a containerized Kubernetes platform with tiered storage, cross-cluster search, and machine learning, monthly event ingestion scaled from 3 billion to 13 billion events, mean time to detect dropped 84% from roughly 50 minutes to around 8 minutes, and the team now catches 87% more incidents before prepayment customers lose heat or face service disruption.

When a message leaves an energy provider like British Gas or E.ON and travels to a smart meter in a UK home, it may touch more than 100 servers and endpoints across 15 different supplier systems before it arrives. Smart DCC operates that communications network: the licensed infrastructure connecting 70% of British homes to their energy providers and managing approximately 124 million devices across gas, electricity, and IoT platforms spanning 4G, 2G, long-range radio, and broadband.

The stakes are concrete. Smart DCC serves prepayment customers who rely on the network to top up their heating day in, day out.

Every UK household with a gas or electric bill funds Smart DCC. That means every tool added to the stack, and every efficiency gained or lost, ultimately flows back to consumers.

Smart DCC's security operations did not begin with an enterprise contract. The team originally ran the open source version of Elastic alongside an enterprise SIEM run by a third party. Within four to five months, the in-house team built a proof of concept that matched the enterprise SIEM's benchmarks, built from inside their own environment. That proof of concept reframed the question entirely. Following a formal procurement process, Smart DCC adopted Elastic's premium platform.

Customization was the decisive factor. Smart DCC's data environment is unusually complex: a single message traverses 15 supplier systems, touching more than 100 servers and endpoints as it moves end to end. Stitching those logs into a coherent picture of a single customer journey requires the ability to enrich data on the fly at any point in the investigation, without raising a ticket with an external vendor and waiting for a new pipeline build. Mid-investigation insights can be relayed to engineers and incorporated into the platform before the next shift begins, a flexibility Osborne describes as impossible through third-party providers.

Before moving to a unified Elastic platform, Smart DCC ran Elastic on self-managed EC2 instances. The setup was functional under stable conditions, but as ingestion volumes grew, the architecture became a reliability challenge. If data volumes exceeded disk capacity, the platform would fall over and rearchitecting to add capacity was manual and not scaleable. This increased engineering oversight and continual monitoring to ensure stability, rather than being able to focus on product improvement.

The searchable window was constrained to three months, which created a practical blind spot. Ofgem updates energy tariffs every three to four months, and every supplier must simultaneously push those changes to millions of meters. Those quarterly price-control events produced spikes and patterns in the data that sat just outside the three-month window, making it hard to tell a genuine anomaly from operational behavior that had simply cycled out of view.

Endpoint visibility on the corporate estate was also handled by a separate third-party tool, adding cost without the consolidation benefits the team needed. Replacing it with Elastic EDR brought approximately 1,000 corporate endpoints into the same platform as the rest of the security operation. The smart metering estate operates under separate security policies and network boundaries and is managed independently.

Smart DCC now runs Elastic Security, built on the Elasticsearch Platform, in a containerized, self-managed Kubernetes deployment. The migration from EC2 resolved the reliability issues and made it possible to scale data volumes without rearchitecting the platform each time ingestion grew. Elastic on Kubernetes gives Smart DCC the scalability of a managed platform while keeping full operational control.

The team adopted Elastic's tiered storage model, using hot and frozen tiers to extend the data available for detection and threat hunting. Elastic's tiered storage extended the searchable data window from 3 months to 12 months, with real-time query access throughout and no rehydration delays mid-investigation. That depth matters in the UK energy market. A price-control event from 10 months ago is now immediately comparable to one happening today, without waiting for archived data to surface.

Cross-cluster search and cross-cluster replication brought the organization's entire data ecosystem into a single, searchable environment. Machine learning models now surface anomalies automatically, reducing the volume of manual alerting that a round-the-clock team has to process. The network operations team has since joined the security operations center on the same platform, and Smart DCC continues to onboard additional suppliers and further enrich the data.

Technical highlights:

• Deployment: Elastic Security on Kubernetes, containerized and self-managed
• Storage: Tiered hot and frozen architecture; searchable window extended from 3 to 12 months
• Data access: Cross-cluster search and replication; availability reduced from ~45 minutes to ~10 seconds
• Event ingestion: Scaled from ~3 billion to ~13 billion monthly events
• Elastic EDR deployed across ~1,000 corporate endpoints, replacing a legacy third-party tool
• Machine learning models integrated for automated anomaly detection
• Network operations team onboarded alongside the security operations center

Monthly event ingestion has scaled from roughly 3 billion events to 13 billion as the network operations team joined the security operations center. Smart DCC continues to onboard additional suppliers and enrich the data estate.

The price-control scenario illustrates why the extended data window matters operationally. Every three to four months, Ofgem updates the energy price tariff and every supplier must simultaneously push that update to millions of meters. These quarterly events produce spikes and patterns that sit outside a three-month window. With 12 months of history available instantly, and no rehydration wait during an active investigation, the team can distinguish genuine anomalies from expected operational behavior with confidence.

Cross-cluster capabilities cut data availability windows from around 45 minutes to approximately 10 seconds. Mean time to detect dropped 84%, from roughly 50 minutes to around 8 minutes. Smart DCC now detects 87% more incidents before any customer experiences disruption.

The operational shift is most visible at 2:00 a.m. Before, a customer call in the middle of the night meant scrambling: Where did it fail? Which system? Which step in the journey? Now, Smart DCC already knows. Machine learning models have surfaced the anomaly. The team has end-to-end visibility across the customer journey before the phone rings.

That 87% improvement in pre-customer detection is not only a security metric. For a network serving prepayment customers who depend on it to stay warm, it is a service delivery metric.

Bringing the network operations team onto Elastic also delivered direct financial returns. By decommissioning the network operations centre's legacy monitoring platform and its associated cloud infrastructure, Smart DCC saved more than £250,000 in 12 to 18 months. For an organization funded through every UK household's energy bill, that efficiency has a direct line back to consumers.

Smart DCC is now well positioned to benefit from advances in AI-powered security. For Osborne, the logic is clear: AI amplifies what you already have, which makes getting the data right a priority first. With a growing, enriched, and fully searchable data estate in place, Smart DCC has exactly that foundation. The team continues to onboard suppliers, expand machine learning model coverage, and push the frontier of what a lean security operation can achieve at national scale. Security sits at the center of that work because detection, investigation, and automation all run directly on the data Smart DCC has enriched. Every improvement to the foundation strengthens everything built on top of it.

The next step is extending that foundation into response: Smart DCC is currently evaluating integration between Elastic and its ServiceNow environment, with Elastic v9 automated workflows on the roadmap.

Your organization may not be managing infrastructure that connects 70% of a nation's homes to their energy providers, but the same principles apply whether you are monitoring thousands of endpoints or 124 million devices: The data foundation determines the ceiling for everything built on top of it.

Explore what Elastic Security can do for your security operations or start a free trial now.