ENISA: energy threat report
European agency warns of increased state-aligned activity targeting energy operators.
Source · ENISA
In energy and industry, a breach can halt production, not just leak data.
In energy and industry, the networks that control production (SCADA and ICS systems) are as critical as the IT networks, and often far older and more exposed. A breach here does not only mean leaked data: it can stop a plant, degrade a supply or put at risk the people who work around that infrastructure. We test your production networks, your remote access and your cloud infrastructure with the same level of sophistication a state-sponsored attacker would use.
Tell us about your industrial project
30 minutes with a senior consultant. Under NDA.
Protected by reCAPTCHA. The Google Privacy Policy and Terms of Service apply.
Mensaje recibido.
A senior consultant will reply within one business day.
No se ha podido enviar. Inténtalo otra vez o escríbenos.
Trusted by energy, utility and industrial teams across Europe.
A cyberattack here doesn’t stay on a screen.
In almost any sector a leak costs data, trust and money. In energy and industry it can cost supply and safety. An attack here does not stay in IT: it can stop a production line, degrade or cut supply, alter the systems that govern physical processes and, in the worst case, put people at risk.
Headlines that set the trend
Norsk Hydro (NO)
Earlier LockerGoga incident continues to define the cost of OT-impacting ransomware in metals.
Source · Reuters
Iberdrola (ES)
Cyberattack on customer-data systems exposed records of more than 600,000 customers.
Source · El País
Schneider Electric (Global)
Ransomware group claimed access to corporate systems of a major industrial automation vendor.
Source · Bleeping Computer
Halliburton (US)
Cyberattack disrupted operations at one of the world’s largest oilfield service companies.
Source · Reuters
Colonial Pipeline (US)
Ransomware shut down the largest US fuel pipeline; fuel supply impact across the East Coast.
Source · Reuters
Industroyer2 (UA)
Malware built to disrupt power operations in Ukraine, designed for specific OT environments.
Source · ESET
Triton / TRISIS
Attack targeting industrial safety systems (SIS), with potential physical consequences.
Source · Dragos
ENISA: energy threat report
European agency warns of increased state-aligned activity targeting energy operators.
Source · ENISA
Norsk Hydro (NO)
Earlier LockerGoga incident continues to define the cost of OT-impacting ransomware in metals.
Source · Reuters
Iberdrola (ES)
Cyberattack on customer-data systems exposed records of more than 600,000 customers.
Source · El País
Schneider Electric (Global)
Ransomware group claimed access to corporate systems of a major industrial automation vendor.
Source · Bleeping Computer
Halliburton (US)
Cyberattack disrupted operations at one of the world’s largest oilfield service companies.
Source · Reuters
Colonial Pipeline (US)
Ransomware shut down the largest US fuel pipeline; fuel supply impact across the East Coast.
Source · Reuters
Industroyer2 (UA)
Malware built to disrupt power operations in Ukraine, designed for specific OT environments.
Source · ESET
Triton / TRISIS
Attack targeting industrial safety systems (SIS), with potential physical consequences.
Source · Dragos
Why attackers single out this sector.
Three things make energy and industry unusually attractive to attackers, from criminal groups to nation-states.
01
One failure spreads
Energy and industry sit underneath everything else. Take down a grid, a pipeline or a plant and the damage does not stay put: essential services, transport, payments and supply chains all feel it. That reach is exactly the leverage a serious attacker is looking for.
02
IT and OT are now joined up
Operations need connectivity today: remote access for engineers, data coming back from equipment in the field, vendors dialling in to maintain machinery. Every one of those links is useful to you, and a possible way in for an attacker. The old idea that the operational network is safely cut off from everything else rarely holds in practice.
03
The equipment is old and hard to change
Control systems are built to run for decades. They can rarely be patched on demand, and you cannot simply take them offline to fix them, because stopping the process is not an option. Attackers know these systems are fragile and slow to update, and they plan around it.
Why would the industrial sector call us?
A vendor asks for plant access
Maintaining machinery opens a route towards the operational network. Worth knowing how far that connection reaches before you grant it.
NIS2 now covers you as an essential entity
Energy and much of industry count as essential sectors, and the directive raises the bar on security testing and incident reporting.
A digitalisation project connects the plant
Data coming back from field equipment and remote access for engineers: every new link between IT and OT is also a possible way in.
An IEC 62443 certification ahead
It is the recognised standard for securing industrial and operational technology, and technical testing evidence is what supports it.
Leaked contractor credentials surface
Reused passwords and leaked remote-access logins belonging to staff and suppliers are the first door that opens in this sector.
An ENS review under way
Public-sector energy and utilities in Spain fall under the Esquema Nacional de Seguridad, which asks for pentest evidence.
Proving the incident is actually closed
After an attack the question is not what happened, but what is still exposed and whether the fixes hold up on a second look.
A 30-minute conversation with someone who understands critical infrastructure.
Whether it is an energy operator, an industrial plant, a piece of critical infrastructure or an OT/IT convergence project, together we define the scope, the schedule and the consultant who will run your project. The same person who runs the tests is with you from the first call.
The latest cybersecurity news on the tools used in the industrial sector.
Real advisories from CISA, in products used across the Energy & Industrial sector.
Checked 1 Sep 2026, 03:13 UTC.
-
- KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerability Known exploited CISA KEV (opens in a new tab)
- PTC Windchill and FlexPLM Improper Input Validation Vulnerability Known exploited CISA KEV (opens in a new tab)
- Lantronix EDS5000 Code Injection Vulnerability Known exploited CISA KEV (opens in a new tab)
- Rockwell Multiple Products Insufficient Protected Credentials Vulnerability Known exploited CISA KEV (opens in a new tab)
- Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability Known exploited CISA KEV (opens in a new tab)
- OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type Vulnerability Known exploited CISA KEV (opens in a new tab)
- OpenPLC ScadaBR Cross-site Scripting Vulnerability Known exploited CISA KEV (opens in a new tab)
- Dassault Systèmes DELMIA Apriso Code Injection Vulnerability Known exploited CISA KEV (opens in a new tab)
Source: CISA Known Exploited Vulnerabilities catalogue (Creative Commons Zero 1.0) and CISA ICS advisories. Asperis is not affiliated with, or endorsed by, CISA. Sector match: CISA's own critical infrastructure classification where the advisory carries one, otherwise matched by Asperis from vendor and product.
Every finding, its technical evidence and its closure, in one place.
Live tracking of every vulnerability, with evidence ready for your engineering team, your auditor and your board, without touching operations.
ASPERIS PLATFORM · DEMO
LIVE
What our clients say, in their own words.
We at Etnia highly value our collaboration with Asperis Security. Their professionalism, approachability, quick response and ability to adapt to our needs have been key in every project. The quality of service and continuous support always give us peace of mind. Without a doubt, it is a pleasure to have them as technology partners.
At NPAW we have collaborated with Asperis on various security initiatives and the experience has been very positive. We especially value their ability to adapt to our needs and the depth with which they approach each project. Results are clear, structured and useful for decision-making and continuous security improvement. We like working with Asperis for the judgment and value they bring to every collaboration. Their work has helped us strengthen our security level.
ASPERIS has worked alongside us to define and implement our cybersecurity roadmap in Microsoft 365 with a structured approach aligned to business objectives. Thanks to their advice, we took the strategic step of completing our Microsoft ecosystem and reinforcing it with CrowdStrike for advanced mobile device protection, significantly raising our security level.
With Asperis you don’t hire a service. You hire a partner. They don’t look to bill a project. They look to establish a relationship of trust, caring about the key points that affect your organisation’s security. Professionalism, know-how and diligence.
Questions we get from industrial CISOs and OT leads.
Seven questions we hear in every industrial introductory meeting. If yours isn’t here, ask it.
No. A properly run pentest does not disrupt operations. We agree rules of engagement, testing windows and clear limits up front, and we coordinate closely with your team throughout. We do not run disruptive techniques on live operational systems unless you explicitly authorise it, in a controlled setting.
We focus on the IT side and the path toward your operational technology, not on attacking live control systems. Live control systems are fragile and safety-critical, so we treat them conservatively: an architecture and segmentation review, read-only checks, or work on an offline copy, rather than by exploiting them directly.
The way in is almost never the control system itself. It is poorly governed remote access, weak or missing segmentation between IT and OT, reused or shared credentials, over-broad privileges, and the paths that third parties and equipment vendors quietly open into the operational network. That is where we focus.
NIS2, the CER Directive, IEC 62443 and, for public-sector operators, the ENS. We supply the testing evidence these frameworks expect. Signing off your compliance is for your assessor or the relevant authority, not for us.
No. It makes an audit concrete. It shows what is actually exploitable, ranks it by real-world impact and gives you evidence that the fixes work, which is exactly what an assessor wants to see.
A technical contact, the systems in scope, your operational constraints and testing windows, and a procedure for critical findings. Where operational technology is in scope, we also ask for a map of access paths, vendors, the routes between your networks and how they are segmented, so we can plan the work safely.
A clear report with proof for each finding, a prioritised remediation guide, a certificate you can share, a retest to confirm the fixes, and everything tracked in our platform.
Other sectors we work with.
Ready to prove your infrastructure is secure?
We work with energy operators, industrial plants, critical infrastructure and OT/IT convergence projects to test their security without stopping production. We scope the work carefully, we run the tests against the real environment, and we hand over evidence your auditors and your board can rely on, closed with a retest.
Or email [email protected] directly.