By Jason Pearce, Field CTO APJ at Claroty
Australia’s energy sector is undergoing two transformations at once.
The first is an energy transition, driven by renewable generation, battery storage, distributed energy resources, smart inverters and increasingly digital transmission and distribution networks. The second is a digital transition. Information technology, operational technology, cloud platforms, telecommunications services and third-party systems are becoming more interconnected across energy operations.
Together, these changes are improving efficiency, reliability and asset performance. However, they are also creating a more complex cyber-physical environment in which a cyber incident can have direct operational consequences.
For energy organisations, cyber risk can no longer be treated solely as an information-security issue. It is an operational risk that can affect the ability to generate, transmit, distribute and safely restore essential services.
Related article: 900,000 customers’ data accessed in Origin Energy hack
From cyber incident to operational disruption
Historically, IT systems supported business functions, while operational technology controlled physical processes such as generation equipment, substations, turbines, pumps, valves and protection systems.
That separation has diminished.
Energy companies now connect operational systems to enterprise applications, remote maintenance tools, cloud services and specialist suppliers. These connections support predictive maintenance, remote operations and improved asset performance, but they also create new pathways into operational environments.
An attacker does not need to directly manipulate a control system to disrupt energy operations. If engineers lose access to trusted identities, communications, maintenance systems, operational data or remote support, an organisation may still be unable to operate safely or restore services quickly.
The critical question is therefore not simply whether an attacker has entered the network. It is whether the incident could affect safety, generation availability, service continuity, grid stability or recovery.
Australia’s energy transition is expanding exposure
Australia’s energy system is becoming more distributed and digitally managed. Alongside traditional generation and network infrastructure, operators must now protect solar and wind farms, battery systems, smart meters, virtual power plants, remotely managed substations and other connected field assets.
Many established environments also continue to rely on equipment with long operational lifecycles. Some assets were designed before internet connectivity, ransomware and remote support became common considerations.
These environments may contain unsupported operating systems, proprietary protocols, difficult-to-patch devices, shared accounts, insufficiently segmented networks and poorly governed third-party access.
The result is not simply a larger attack surface. It is a more interconnected and operationally sensitive one.
The highest-risk pathway may be a trusted connection
Legacy vulnerabilities remain important, but energy-sector cyber risk is not solely a patching problem.
Material incidents often begin through compromised credentials, exposed remote-access services, engineering workstations, poorly configured network devices, removable media or trusted supplier connections.
Energy operators depend heavily on original equipment manufacturers, systems integrators, maintenance contractors and specialist engineers. Their access may be operationally necessary, but it must also be tightly controlled.
Organisations should know who is connecting, which systems they can reach, why access has been granted, what activity is taking place and when that access should expire.
A trusted connection should not automatically be treated as trusted activity.
Prevention alone is not resilience
No energy company can realistically prevent every cyber incident. The goal must also be to stop an intrusion from developing into an uncontrolled operational event.
Operational resilience is the ability to anticipate disruption, withstand compromise, maintain essential functions and restore safe operations within an acceptable timeframe.
That requires operators to understand:
• Which assets and processes are critical
• How sites and systems depend on one another
• Which pathways could create material operational consequences
• How far an incident could spread
• Which services must be restored first
• Whether essential operations can continue in a degraded or manual state.
This is broader than cybersecurity prevention. It requires collaboration between cyber teams, engineering, operations, risk, procurement, suppliers and executive leadership.
Visibility must lead to action
An accurate inventory of operational assets remains the foundation of an effective cyber-physical systems protection program. However, visibility alone is not resilience.
Asset information must be converted into action by identifying critical systems, prioritising exposures according to operational consequence, reducing unnecessary connectivity, securing remote access, detecting abnormal behaviour and preparing for safe recovery.
Network segmentation is particularly important. In an energy environment, segmentation is not simply technical hygiene. It is an operational containment control that can limit how far an incident propagates and help preserve unaffected systems during response and recovery.
Exposure management must also be risk-based. Not every vulnerability presents the same threat. Operators should prioritise remediation according to exploitability, asset criticality, network accessibility and potential operational impact.
Regulation is reinforcing the resilience imperative
Australia’s Security of Critical Infrastructure framework, Critical Infrastructure Risk Management Program requirements and Australian Energy Sector Cyber Security Framework are reinforcing the expectation that energy organisations understand and manage material operational hazards.
The objective should not be compliance for its own sake.
A mature cyber-physical systems protection program should help operators demonstrate that critical risks are understood, controls are effective, incidents can be contained and essential services can be recovered.
It should also allow boards and executives to evaluate whether operational risk is being reduced, rather than simply whether more security technology has been deployed.
Related article: What happens when hackers come for the grid?
The key takeaway
For Australia’s energy sector, the objective is not to eliminate every cyber risk. That is neither realistic nor measurable.
The objective is to understand which digital dependencies could create unacceptable operational consequences, reduce the pathways to those systems, contain incidents before they spread, and then restore safe operations quickly.
Asset visibility is the foundation, but visibility alone is not resilience.
Energy operators need a repeatable cyber-physical systems protection program that combines asset and dependency visibility, risk-based exposure management, segmentation, secure access, threat detection, operational response and recovery assurance.
The organisations that make this transition will be better placed to protect safety and reliability, meet regulatory expectations and maintain public confidence as Australia’s energy system becomes more distributed, digital and interconnected.
Cyber risk is now operational risk. It must be managed accordingly.
