Study highlights lack of investment in cybersecurity in the electricity sector

Eight out of ten companies in the electricity sector say that Digital technologies are enabling your energy transition. This digitalization, although positive, leaves energy companies more prone to cyberattacks.

Not surprisingly, the cyber security agenda is now present at the highest levels of governance. Despite increased awareness of cyber risk, energy professionals question whether the investments made are adequate to face the challenges required to protect electrical infrastructures.

These are some of the conclusions of the report “Energy Cyber ​​Priority 2023: Closing the gap between awareness and action“, published by the international consultancy DNV. The survey interviewed 601 energy sector professionals from 92 countries.

According to the report, companies that had a significant security breach were the most likely to believe that their organization does not take cyberspace as seriously as it should. A third of respondents said cybersecurity is one of their organization's top risks, behind operational/technical, security and financial.

Three in four energy professionals reported that cybersecurity is treated as a business risk within your organizations. The commercial benefits of cyberspace are important and will guarantee a competitive advantage over slower competitors.

The research highlights the key challenges energy companies will face around cybersecurity. Barriers to be overcome by cybersecurity departments include a lack of investment, qualified labor and communication between teams at different hierarchical levels and departments.

The study reveals that less than half of energy professionals think their companies' current level of investment in cybersecurity is sufficient to ensure the resilience of their operational assets and infrastructure. Only one in five strongly agree that sufficient investment is being made.

The research points out that regulation will be the main driver to unlock investments in cybersecurity.

“It is worth asking whether there really is a shortage of cybersecurity budget being made available, or whether it is not being used effectively and whether teams are consequently forced to seek additional funding,” notes Jalal Bouhdada, Global Director of Cyber ​​Security at DNV .

“For other companies, the concern is that while energy companies accept that cybersecurity risk is increasing, they don't think an attack would happen specifically to them and so they don't dedicate enough budget.”

Labor and communication

Another challenge for managers will be to recruit and retain talent capable of protecting organizations against cybersecurity threats. More than a third of professionals pointed out that the lack of technical skills is a barrier.

The research also reveals that cybersecurity professionals struggle to communicate and collaborate with operational teams who do not share the same level of knowledge, as well as with executives in the most senior roles. This difficulty, combined with the difference in experiences, is leading to a “cyber perception gap”.

Part of the problem is the inability of cybersecurity professionals to accurately articulate and report security challenges. Three in a quarter of respondents believe that cyber professionals need to learn to speak the language of the energy operations sector better.

Linked to this, 76% also say that cybersecurity and engineering teams must learn to collaborate more effectively to strengthen the security of their assets and infrastructure.