Loading story…
The energy sector is experiencing significant digital transformation, leading to increased integration between information technology (IT) and operational technology (OT) systems. Joe Doetzl, head of cybersecurity at Hitachi Energy, highlights that this convergence is driven by the need to support distributed grid architectures, power data centers, and expand renewable energy generation, which collectively broaden the threat landscape for both cyber and kinetic attacks. As a result, organizations are adopting unified security strategies and tools to manage risks across both IT and OT environments.
Doetzl emphasizes that common governance, risk management, and cybersecurity practices can be applied across IT and OT domains, with centralized leadership and technology stacks enabling more effective enterprise-wide defense. The use of shared tooling for risk measurement and action planning, as well as the integration of data from both environments into a single cyber defense center, are key steps in addressing the evolving security challenges faced by the energy sector.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Joe Doetzl, head of cybersecurity at Hitachi Energy, said the energy sector's rapid digitization is increasing convergence between IT and OT environments and expanding the threat landscape. He described using shared security operations, common tools such as a single SIEM, integrated incident response, threat intelligence sharing, supply chain risk management, and attention to evolving regulations.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A recent study from the Karlsruhe Institute of Technology has highlighted the increasing impact of geopolitical tensions on cyberattacks targeting the energy sector, including power grids and fuel systems. Researchers analyzed major cyber threat databases such as MITRE ATT&CK Groups, CSIS, ThaiCERT, Malpedia, EuRepoC, and the AI Incident Database to identify patterns in attacks against energy infrastructure. They developed an AI-powered pipeline to structure unstandardized incident data, achieving higher accuracy and recall for energy-related incidents compared to traditional rule-based systems. The study found that energy sector attacks are more specialized and regionally concentrated, with Russia and China frequently identified as origin countries and the Middle East as a prominent target. Conflict zones, such as Russia-Ukraine and Israel-Palestine, experience spikes in cyberattacks on energy infrastructure during periods of heightened tension. The digital transformation of the electric sector, including the integration of operational technology (OT) and information technology (IT), has increased both efficiency and vulnerability. Notable incidents, such as the 2015 Ukraine power grid attack and the 2021 Colonial Pipeline ransomware event, demonstrate the real-world consequences of cyberattacks on critical energy systems. U.S. utilities continue to face persistent threats from both nation-state and criminal actors, prompting federal agencies to issue repeated warnings. The growing reliance on AI and digital technologies in the energy sector further expands the attack surface, making robust cybersecurity measures essential. Experts emphasize the need for electric firms to harden their systems and invest in workforce training to address evolving threats. As AI becomes more integral to energy operations, the risk of attackers weaponizing AI to exploit vulnerabilities in the grid increases. The dependency of AI-driven systems on uninterrupted energy supply makes the grid an even more attractive target for sophisticated adversaries. Risk management strategies must adapt to address the convergence of IT, OT, and AI in the energy sector. The combination of geopolitical motivations, advanced attack techniques, and expanding digital infrastructure underscores the urgency for comprehensive security frameworks. Ongoing research and cross-sector collaboration are critical to defending against the escalating threat landscape facing global energy infrastructure.
Jun 29, 2026
The oil and gas sector is undergoing a significant transformation in cybersecurity, with a growing emphasis on identity as the central control plane for both operational technology (OT) and information technology (IT) environments. As the industry modernizes, the convergence of IT and OT is accelerating, driven by the adoption of cloud technologies, AI-driven analytics, and the need for improved production, safety, and resilience. This shift is prompting organizations to move beyond legacy tools and siloed approaches, recognizing that modernization and security must be integrated to address evolving threats and regulatory pressures. At the same time, organizations across critical infrastructure sectors are recognizing the necessity of strong partnerships between CISOs and COOs to ensure operational excellence and resilience. The digital transformation of operations means that cybersecurity incidents now pose existential risks to business continuity, making cyber resilience a core component of operational strategy. Effective collaboration between security and operations leadership is essential to prepare for, respond to, and recover from cyber threats while maintaining uninterrupted business functions.
Jun 29, 2026
Operational technology (OT) environments, such as manufacturing lines, refineries, pipelines, and rail control systems, are increasingly adopting advanced cyber defense strategies to address the unique challenges posed by modern cyber threats. Traditional perimeter-focused security models are being replaced by breach-ready cyber defense approaches that assume compromise is inevitable and prioritize rapid containment and resilience. This shift is driven by the recognition that OT systems often involve long-lived equipment, complex dependencies, and components that cannot be easily patched, making them particularly vulnerable to sophisticated attacks. At the CS4CA Europe conference, industry experts highlighted the growing need for virtual segmentation in OT environments as a practical means to implement zero trust principles and contain threats before they can propagate. Virtual segmentation allows organizations to enforce security boundaries within heterogeneous OT networks, even when physical segmentation is impractical or impossible. The approach emphasizes mapping attack paths, reducing the attack surface, and controlling lateral movement to prevent breaches from escalating. Regulatory bodies like CISA have updated their guidance to encourage dynamic, risk-based segmentation strategies tailored to the operational realities of OT. In these environments, safety and operational continuity are paramount, often taking precedence over traditional IT priorities such as data integrity and comprehensive patching. As OT systems increasingly connect to the cloud and integrate artificial intelligence, the attack surface expands, necessitating more agile and resilient defense mechanisms. Breach-ready strategies also include rapid response measures such as quarantining affected zones, isolating unaffected systems, and ensuring robust recovery and failover capabilities. The ultimate goal is to prevent cyber incidents from resulting in catastrophic outcomes, such as loss of life, environmental disasters, or disruption of critical national infrastructure. Industry practitioners are urged to assess their breach readiness, identify hidden lateral attack risks, and develop visual roadmaps for remediation. The convergence of IT and OT security teams is seen as essential for operationalizing zero trust and maintaining production while managing cyber risk. These evolving practices underscore the critical importance of proactive, layered defenses in safeguarding the foundational systems that underpin modern society.
Jun 29, 2026