Rexel: Security & Connectivity on the Road to Cloudification
With a mission to offer customers worldwide innovative and sustainable solutions to improve the comfort, security and energy performance of installations, infrastructure and buildings, Rexel has been a major player in the professional electrical supplies distribution market in France and worldwide for more than 50 years.
In an energy world undergoing transition, Rexel develops custom solutions to respond to all its customers' needs, every day. The company is a worldwide expert in the professional multichannel distribution of products and services for the energy world, with a revenue of €19.2bn (US$20.7bn) in 2023.
One of the main challenges Rexel faces today is staying ahead of rapidly evolving cybersecurity threats. “New threats and techniques emerge every day, so we need to continually conduct research and raise awareness on this topic,” says Pierre-Emmanuel Leriche, Group Chief Information Security Officer. Additionally, as he highlights, instilling a consistent cybersecurity culture across Rexel's multi-local business model is an ongoing priority.
Another major challenge stems from Rexel’s multi-local business model. With entities across different regions, it can be difficult to instil the same level of cybersecurity understanding and culture everywhere, where people have varying backgrounds when it comes to cybersecurity knowledge.
“We are actively working to build a global community around this issue,” Pierre-Emmanuel Leriche says. “Our goal is to ensure everyone in the company is on the same page and operating with a consistent, high level of cybersecurity proficiency.”
Jye Sutton, the company's Chief Technology Officer, highlights talent management and development on a global scale as a key challenge, along with ensuring consistency and standardisation across regions with differing technology maturity levels.
Rexel’s top priority, he explains, is maintaining stable and secure technology to support the business operations. “From this clear mandate, two key challenges arise. One is talent management and development on a global scale, and the second is ensuring consistency and standardisation across our many regions with differing maturity levels.”
Rexel frequently acquires new companies, and integrating their technologies into its standardised platforms and processes poses questions.
“Do we merge them into our standards or do we keep them standalone? The overarching challenge is achieving the right balance - implementing consistent global technology standards, while still allowing flexibility to meet local business requirements as needed.
“Adapting to enable this standardisation, paired with appropriate customisation, is one of our biggest priorities today. We must get it right to move the business forward effectively worldwide.”
The move to a hybrid cloud approach
As a global company, Rexel operates across over 19 countries, necessitating a constant embrace of change. The centralisation of IT has enabled better security controls and economies of scale.
Kaya Demircigil, Rexel’s Head of Cloud, has witnessed Rexel's transformation from a classical legacy IT firm to an IT company driving transformation and leveraging data.
“We need a robust IT backbone that supports the business. Because if we have problems there, it could hugely impact our revenue. We must secure those platforms, and ensure they are scalable on demand and agile enough, with a fast time-to-market.
“When I joined Rexel, we started talking about these digital transformation needs. But our backbone wasn't ready, so we moved from a more classical legacy IT company to an IT company driving transformation and using data to improve. We're still bulk sellers, but our backbone is that we are IT experts.”
With Rexel continuing to grow and acquiring other businesses, Jye Sutton highlights some of the challenges to negotiate when dealing with legacy IT. “There's a lot of legacy IT when we acquire businesses that need uplifting to operate in the modern world. That's one challenge we have. That's where we start talking about hybrid networking elements – we have to look at how we do all of this securely, maintaining legacy while innovating to meet the business's digital requirements.”
As the organisation continues to embark upon this transformation, Rexel has significantly invested in cybersecurity to keep pace with the evolving threat landscape. Cloud acceleration has also been a major focus, requiring a shift from traditional perimeter security to protecting data itself via techniques like zero trust.
“The traditional "castle" approach of securing the perimeter is no longer viable,” Pierre-Emmanuel Leriche says. “We need to protect the data itself, not just how it is managed. And of course, there is identity, which ties into the journey toward a zero trust approach.”
Rexel’s cloud transformation: The end goals
For Jye Sutton, the cloud transformation aims to establish stable, secure, and modular cloud services to drive the company's digital evolution – an ongoing journey, not a one-time project. It's about enabling innovation while maintaining control and reversibility.
“For us, the transformation is about enabling the business. We are global business partners helping Rexel evolve in that sense. Cloud transformation is not a one-time thing, it's something continuous. The main point is that we are working on stable, secure, and modularized services for the cloudification of everything.
“That's not a one-shot project - it's something ongoing. We'll keep modularizing different elements as we move forward. We're not moving to the cloud because the cloud is magical, but we'll need to adapt and grow with the business.”
From an operational risk perspective, Jye Sutton explains that Rexel aims to strike a balance when it comes to its cloud transformation. “Sometimes we need to have total control on our side. When going through security investigations that happen in large companies, you realise the value of on-premises infrastructure and your ability to access logs in real-time to make quick decisions.
“A lot of our decisions for a hybrid approach are also protecting us in the future,” he adds. “If there is a cloud problem, that means we can manage some workloads on-premises, and have the reversibility to adapt and change to future needs.”
Pierre-Emmanuel Leriche agrees, highlighting security's role as an enabler rather than a blocker, facilitating the shift to the cloud while focusing on identity, data protection, and cloud security posture improvements.
“I think there has been a shift over the last few years – from security being seen as a blocker, to now acting as an enabler for the business. But whether it's in the cloud or any other technology, it's more about having the right mindset to always support the business and digital transformation, rather than the specific environment.”
Rexel at the edge of cloudification: Agility and scalability
According to Bruno de La Bretèche, Head of Digital Technologies at Rexel, one of the biggest challenges is scaling both IT and the organisation to support Rexel's target for digital sales to reach 40% of its total revenue by 2025, all while maintaining agility. “The point of cloudification is that it's helping us stay and be agile at scale,” he says.
“We need to scale our organisation, but also our way of working, while staying super agile. That's the main challenge my team faces today, and I'd say it's Rexel’s main challenge overall.”
The point of cloudification, Bruno de La Bretèche explains, is to help Rexel maintain agility at scale.
“If you want to scale, at some point you have to automate. If you want to keep agile, you have to automate,” he says. “The full DevSecOps pipeline model is impossible without automation. Now, you can start doing everything on-premises if you want, and if you have millions of engineers, or you can use a hyperscaler to get accelerators. One point of moving to the cloud is to be able to go faster and have more accelerators. It can also make you more predictable - everything is versioned, so it's easier to see what changed. It’s helping us be more predictable, faster to production and shortening loops.”
Kaya Demircigil underscores the cultural shift required for concepts like DevSecOps, where historically siloed teams like coders and infrastructure personnel now need to collaborate seamlessly.
“For a long time, we had teams doing coding in languages like C++ or Java, and other teams creating virtual machines (VMs). Now those two cultures have to learn to work together, and each side has to understand the other. This is a cultural transformation.
“When done properly and efficiently, then yes, you can have ecosystems ready in days. But if the DevSecOps across those areas can't communicate, even in the cloud it will still take three months to get your infrastructure ready. That's really where the infra folks had to learn to speak up and communicate with the app developers, and the app developers had to learn to understand a bit about how the infrastructure works.
“That's the biggest challenge and the only way it can succeed is getting those cultures to understand and work together seamlessly.”
Cloud transformation supporting digital solutions
For Bruno de La Bretèche, the cloud enables faster delivery cycles, reduced from six-week releases to hourly deployments by automating processes and standardising across regions. “It helps us to go faster,” he states.
“We know our responsibility. We know we need to deliver quickly. How can we make it happen? There is a shift. For example, before we had a release every six weeks; now we can do a release in a few hours.”
Sutton adds that cloud solutions provide agility in launching new digital products, customising regionally and optimising workload response times closer to customers.
The evolution has driven a mindset change from pointing fingers at "innocent applications" or "guilty infrastructure" to shared accountability for streamlining choke points.
“Instead of having a one-year update on infrastructure components, we're having major updates every quarter,” he adds. “The infrastructure side has needed to be more agile, working with the sprints, and to be current and supported on the platforms, so there's been a big shift from that perspective.”
Partnerships with Devoteam and Almond
Collaboration with consulting partners has been invaluable for Rexel, providing diverse perspectives, skilled resources and flexibility. Devoteam supported Rexel’s early cloud journey, continuing into more mature phases, while Almond has bridged on-premises infrastructure with the cloud, ensuring robust security and connectivity solutions.
“Almond has been instrumental in supporting us with network and peripheral elements, essentially bridging our on-premise infrastructure with the cloud,” Sutton says. “They play a crucial role in ensuring the development of appropriate security measures and connectivity solutions.”
Demircigil, meanwhile, highlights Devoteam's vital analysis and architecture role in understanding application needs and requirements before recommending cloud adoption. “One of the big things we ask Devoteam is to analyse and create a business case - is this what we truly need and does it make sense?
“We also ask those cloud-centric people whether we sometimes need to go to the cloud at all. We don't have a cloud-only strategy. So we need people to understand the cost of a VM in the cloud versus a data centre. Do we need the cloud's elasticity for this project? It's a real analysis of the use case - what will the application do, what features could use Platform as a Service instead of Infrastructure as a Service? It's about changing mindsets.
“We want Devoteam to bring that analysis, architecture and pattern creation, which will facilitate our business transforming to the cloud where it makes sense.”
Look to the future: Continued cloudification
Pierre-Emmanuel Leriche envisions a continued cloudification trend, with an emphasis on identity, data protection, and cloud security posture advancement as threats evolve.
“I think this trend of moving to the cloud, which we call 'cloudification', will continue for a while. We don't have a strict 'move to cloud' strategy - we're building in the cloud only. As we put security barriers and measures in place, attackers will constantly try to find new ways to attack and reach their goals. So I'm envisioning a quite stable trend in cloudification based on what we've seen over the last few years.
“Identity and data will be critical areas of focus for the next 12-18 months,” he adds. “Threats will continue evolving as we try to secure things, so we have to stay vigilant on identity and data protection, and evolving our cloud security posture intelligently when moving to the cloud makes sense for the business.”
Sutton anticipates managing disruptors like AI, which could aid containerisation and orchestration but must be implemented securely. Greater serverless computing adoption and a focus on sustainable IT practices are also expected to shape future cloud strategies.
“There will also likely be a push towards greater serverless computing adoption. But we need to understand that serverless doesn't mean servers disappear - we still need to look at how to secure operations. And I think this is where the developer and coder roles are changing. They need to be more savvy about security and infrastructure, to have more of a full stack skillset including infrastructure and security layers, to operate future cloud models.
“Then there will always be, and it will be interesting navigating, the focus on sustainability - how can we do IT sustainably? This could involve renewable data centres, and many other potential approaches that may not even exist today, to see how we can evolve sustainably.”
Rexel's commitment to the cloud roadmap is clear, albeit with talent scarcity as an ongoing challenge given industry-wide demand. As de La Bretèche asserts, Rexel will continue along its current trajectory.
“Cloud is here to stay. I don't think we're going back to on-premises infrastructure. I've seen articles suggesting, ‘Oh, it's too expensive now. Let's go back on-prem,’but I don't think that's the case for Rexel today. What I know from Rexel's strategy is that, by 2025, we'll have to reach 10% more digital revenue, the equivalent of approximately €8bn (US$8.7bn).
“Digital is our biggest platform, so we really have to support this and ensure we have the right skills, the right people and the right partners to achieve this goal.”
**************
Make sure you check out the latest edition of Supply Chain Digital Magazine and also sign up to our global conference series - Procurement & Supply Chain LIVE 2024
**************
Supply Chain Digital is a BizClik brand
