OT-Safe Ransomware Resilience for an Energy Utility
Recovery time for core systems proven at under 18 hours, without touching live operations.
Client name withheld by agreement- Client
- Electric and gas utility
- Region
- Gulf Coast, U.S.
- Year
- 2024
- Duration
- 20 weeks
- Scope
- 42 substations · 2 control centers
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
An electric and gas utility had watched peers lose weeks to ransomware. Its recovery plans assumed backups that had never been restored at scale, and its operational technology could not be touched during testing.
Regulators, the board and the public would judge the utility on one thing: how quickly the lights and gas stayed on.
What we did
The approach, step by step.
- 01
Crown jewels and blast radius
We mapped the systems the utility cannot operate without and the paths ransomware would use to reach them from IT.
- 02
OT-safe assessment
Passive network analysis and architecture review of 42 substations and two control centers, with zero active scanning on live equipment.
- 03
Recovery proven
Immutable backups, isolated recovery environments and a full restore test of core systems under timed conditions.
- 04
Crisis exercise
An executive tabletop that rehearsed decisions on isolation, communication and regulator notification.
Outcomes
What changed, in numbers.
- Under 18 hrs
- proven recovery for core systems
- 42
- substations assessed without disruption
- 2
- control centers re-segmented from IT
- 0
- operational interruptions during testing
We now know how long recovery takes, because we have done it.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
United States · 8 weeks
Offensive Security & Resilience · 2025Pre-Peak Penetration Testing for a National RetailerTwo critical payment-page exposures found and fixed six weeks before holiday trading.
-
Dallas, Texas · 24 weeks
Offensive Security & Resilience · 2025 · OngoingOne Evidence Model for a Fintech LenderFour frameworks mapped to one control set, with audit evidence requests down by two thirds.
-
United States · 10 weeks
Offensive Security & Resilience · 2024Business Continuity and Crisis Exercise for an InsurerA board-level crisis exercise that exposed and closed four single points of failure.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.