Cybersecurity: Not Just an IT Problem

According to Forbes Advisor, there were 2,365 cyberattacks in 2023, affecting an astounding 343,338,964 people — roughly 10 million more people than the U.S. population. A USA Today article says “the cost of cybercrime would reach a massive $9.5 trillion in 2024 and exceed $10.5 trillion in 2025,” and it “is estimated that attacks on businesses, consumers, governments and devices will happen every two seconds by 2031.” With the average data breach costing companies $4.5 million as rapidly evolving technologies make cyber attackers more sophisticated by the day, this isn’t a concern anyone has the luxury of ignoring.

Along with the crucial efforts to mitigate the effects of climate change and severe weather events, an aging infrastructure and an aging workforce, and the mandate to keep up with environmental regulations, utilities are working diligently to protect their communities from the added threat of cyberattacks. To safeguard their communities and ensure they can continue to provide essential services, utility companies are taking proactive measures to protect against these cyber threats. While addressing climate change and environmental issues remains a top priority, utilities recognize that cybersecurity is a critical component of their overall strategy.

With cyberattacks becoming increasingly sophisticated and frequent, utilities must remain vigilant in their efforts to protect their systems and data. Failure to do so could result in significant disruptions to services and potentially devastating consequences for the communities they serve.

Black & Veatch’s 2024 Electric Report illustrates the pressing need for investment in cybersecurity across both information technology (IT) and operational technology (OT).

On the IT side, seven in 10 survey respondents consider phishing attacks as their most concerning cyberthreat, followed by ransomware and malware (both at 45 percent) — three methods that tend to dominate headlines. On the OT front, malware (52 percent) and ransomware (47 percent) top the list, with cloud vulnerabilities coming in as a most concerning threat for 35 percent of respondents.

While no defense is invincible, ample solutions exist to increase agility for IT and OT defenses.

One question remains: How exactly is cybersecurity affecting OT?

Measuring Preparedness

The rate of attacks on OT is far outpacing the maturity of most industrial cybersecurity programs. As systems become more connected and automated, they become more exposed to increasingly skilled cyber attackers. Meanwhile, many OT managers don’t have a comprehensive view of their networks, leaving them even more vulnerable.

While that is good, that also means half have never consulted with an outside expert, leaving them and the public’s access to electricity potentially vulnerable to threats.

One-fifth of respondents have never hired or consulted with grid cybersecurity specialists — a concerning number, given the gravity of the threat.

The figures at hand paint a picture of an industry ready and armed for a cyberattack, but the question remains: could they withstand just any cyberattack? Additionally, recovery might be an objective assurance, but the length at which it takes to recover becomes a subjective matter, requiring more context around the utility’s specific plans.

Since the attackers are becoming more sophisticated, it is especially crucial for utilities to prepare and have a plan and resources in place for a speedy recovery that minimizes the number of households and businesses affected.

Compliance as a Starting Point

The industry is on the precipice of big changes to meet regulatory standards in the constantly evolving energy ecosystem. But compliance alone might be the go-to standard for a far greater number than the industry should feel comfortable with.

While mere compliance is part of the equation, for almost one-fifth of respondents to answer it as the most needed response shows a disconnect in where we are in the electric industry versus where we need to be.

In this real-life game of chess, utilities would be wise to not conflate compliance with actual security — or see it as merely a box-checking exercise. It’s essential for utilities to ensure that their cyber defenses are robust, thoroughly implemented, consistently monitored, and frequently pressure-tested and revised to remain effective. As threats evolve, so must the protections against them.

Think of it this way: In a neighborhood where most homes have a security alarm, those complemented with ample lighting, warning signs and a gated fence are less likely to be targets.

Download the Report