The fact that the wider energy system was reportedly unaffected should not distract from the significance of a cyberattack reportedly taking a power-generating facility offline for four days. This is proof of just how quickly a cyber incident translates into real-world operational disruption.

Attackers do not need to bring down the national grid in order to cause disruption. Taking even a single facility offline highlights why cyber risk in critical infrastructure needs to be measured not only in terms of data loss, but in downtime, service availability, and the ability to keep essential processes running.

Our own research into 200-plus attacks against cyber-physical systems found that 82% involved attackers using VNC clients to remotely access exposed, internet-facing assets, not sophisticated exploits or zero-days, but weak or default credentials and insecure legacy protocols.

Building resilience starts with knowing what is connected across IT and operational technology environments, how those assets communicate, and which systems could provide a route to critical operations. From there, operators need to secure remote access and segment critical systems to limit an attacker’s ability to move through the environment. The priority is to contain an intrusion before it can disrupt physical processes, while ensuring essential services can be maintained or safely restored if an attack succeeds.