Energy sector in spotlight as cyberattack threat grows

On the positive side, the convergence of information technology (IT) and operational technology (OT) has enabled energy providers to better predict equipment failure and increase the reliability of energy services, which Australian society relies on to function smoothly.

However, as previously air-gapped OT assets have been brought online, they have also been exposed to cyber criminals looking to launch attacks.

Why is OT particularly vulnerable to attack?

Many of these OT systems contain legacy devices, which were never designed with internet connectivity in mind. This presents issues on multiple fronts, as these systems often have unpatched vulnerabilities, outdated software, and weak security controls, which results in an expanded attack surface that threat actors can easily exploit.

It’s no wonder that cyber-attacks on Australia’s energy sector are increasing. According to the latest Annual Cyber Threat Report, critical infrastructure including the energy sector saw an overall 11% year-on-year increase in attacks. The Australian Energy Market Operator (AEMO) notes that Australia’s energy infrastructure is a “high-value target for cybercriminals, state actors, and hacktivists. A number of recent high-profile incidents – ranging from ransomware attacks on pipelines to coordinated attempts to disrupt power grids – have highlighted the vulnerabilities inherent in Australia’s critical infrastructure.”

With this in mind, it’s important for chief information security officers (CISOs) to understand that traditional security methods can’t protect complex interconnected networks against increasing cyberattacks. The convergence between IT and OT environments requires a purpose-built solution built to handle the complexities of cyber-physical systems (CPS).

Here are the top three takeaways that all energy CISOs need to know.

1. Disruptions from cyberattacks are increasing

As digital transformation increases the attack surface of energy environments, cyber criminals are taking advantage and disrupting critical operations. In the last five years, several key ransomware attacks have targeted energy operations and critical infrastructure, from the largest publicly disclosed critical infrastructure attack on Colonial Pipeline in 2021, to the 2023 breach of 22 Danish energy firms and most recently the Russian attack on Poland’s power grid in December 2025.

In Australia alone, there have been multiple incidents including the 2021 ransomware attack on government-owned electricity provider CS Energy, along with the 2023 attack on Energy One, a major Australian wholesale energy software supplier, and most recently, the July 2026 cyberattack on Origin Energy.

When energy and critical infrastructure companies are hit with cyberattacks, disruptions and downtime can have devastating consequences. Financial impacts, productivity loss, negative business outcomes, and even threats to assets and physical safety can arise from disruptions.

The increasing threat of cyberattacks demands a thorough cybersecurity strategy that takes into consideration the increased attack surface brought about by digital transformation and the convergence of IT and OT systems.

2. Current approaches to CPS cybersecurity fall short

Energy companies rely on a complex web of solutions to protect their cyber-physical environments, which consist of both IT and OT technology. The IT environments include things like servers and laptops, devices with standard protocols that are usually connected to the internet and are compatible with most standard security solutions. OT environments on the other hand feature diverse assets with proprietary protocols and legacy operating systems, including the likes of sensors, pumps, valves, actuators, and other industrial control devices that support power generation, transmission and distribution. These assets are incompatible with most security solutions, leaving them exposed to attackers.

3. OT environments require a CPS-specific security solution

In the convergence of IT and OT environments, protecting OT requires a specialised approach. Your OT environment is an asset to protect, but is also typically outdated and not built for connectivity and cybersecurity, making OT a big target for adversaries. In fact, more and more cyber attackers view OT as the crown jewel for ransomware. While attacks on IT can usually be quickly thwarted and shut down before they penetrate too deeply, OT is much more complex. With such a wide variety of OT devices spread across energy networks, each with different operating systems and proprietary protocols, this complex environment requires cybersecurity tools built to handle the intricacies of these devices.

Key takeaway

A strategy built on CPS-specific cybersecurity for your OT environment starts first and foremost with a foundation of asset visibility. By using multiple discovery methods to uncover every device connected to your network, you can ensure a complete asset inventory and know that every device can be protected. From there, implementing comprehensive exposure management, network protection, threat detection, and secure access allows you to protect OT in a way that is impossible with traditional cybersecurity methods.

Author: Jason Pearce, Field CTO, APJ , Claroty