EVRAZ maintains a high level of information security maturity with one of the smallest dedicated teams in the metals and mining sector. The company achieved more than 92 percent compliance in its most recent external audit and continues to meet or exceed industry benchmarks for security program maturity.
Andrey Nuykin, head of the Information Security Department at EVRAZ, oversees protection for more than one thousand developers, tens of thousands of users, industrial infrastructure, and numerous IT contractors. His team also addresses the growing risk of employees using generative AI tools to create unofficial services without proper security review.
Gradual Implementation of Security Controls
Instead of imposing strict bans, EVRAZ introduced security requirements over several years with extended transition periods. Initial checks focused only on critical vulnerabilities in selected projects. Later stages added medium-severity issues and eventually expanded to all company projects after project managers requested broader coverage.
The company avoids replacing proven open-source solutions when no suitable alternative exists and when regulatory requirements do not mandate change. Employees who develop internal tools are allowed to share them after the security team reviews the code for vulnerabilities.
Structured Involvement in IT Projects
Every IT project follows a defined process that includes an Information Security section in the technical specification. Architecture diagrams must be submitted for review, with particular attention to internet-facing services that require DMZ placement and protective controls such as WAF, anti-DDoS, and antivirus solutions.
Static code analysis is integrated into the DevOps pipeline. Any detected vulnerabilities block the pipeline until they are remediated or marked as false positives. Final security approval is required before a system can move to pilot operation, after which a comprehensive system passport is prepared and approved by all operational units.
Real-World Examples and AI-Related Risks
In one case, developers initially resisted adding required security layers to a public-facing service. After a temporary WAF disablement during a platform migration resulted in a surge of bot traffic, the same team requested that the protection be restored.
Another incident involved a non-IT employee who built a small internal dashboard using AI assistance. The tool gained popularity and was nearly published externally before the security team demonstrated multiple vulnerabilities during a live review. The service was kept internal and later migrated to official IT-supported infrastructure.
EVRAZ continues to explore scalable methods for reviewing AI-generated code and controlling data shared with large language models while avoiding outright prohibition of these tools.
