Live Wire — Energy Sector Cyber Exposure & Supply Chain Intelligence
Based on ThingsRecon scans of 5 energy organisations across the UK, Netherlands, Belgium & Luxembourg ·
Why energy sector attack surfaces demand continuous monitoring
Energy companies operate at the intersection of critical infrastructure and highly digitalised customer operations. They manage smart meter networks, online energy portals, grid management dashboards, B2B trading platforms, and increasingly complex IT/OT integrations — all of which create an external attack surface that attackers scan continuously. The consequences of a successful attack extend beyond financial loss: energy disruption affects homes, hospitals, industry, and national security.
Yet the external attack surface — everything visible from the public internet — is rarely mapped with the same rigour applied to internal OT security. Subdomains, supplier scripts, DNS records, and cloud-hosted energy management interfaces change constantly, often without security team oversight. ThingsRecon maps this surface agentlessly, from public data alone, revealing the suppliers, vulnerable components, and DNS misconfigurations that standard security tooling misses.
This report draws on simultaneous scans of five energy organisations across the UK, Netherlands, Belgium, and Luxembourg — spanning oil and gas operators, green energy retailers, large utilities, regional energy suppliers, and energy services companies. The findings reveal a sector where external hygiene lags well behind operational security investments, and where four common technology suppliers are embedded in every organisation's digital estate.
All organisations in this report are anonymised. Technology suppliers and infrastructure providers are named as they appear on the external attack surface.
How do energy organisations compare?
ThingsRecon scanned five energy organisations simultaneously — from a small North Sea operator to one of Belgium's largest energy utilities. All five received an overall score of C, masking significant variation in individual risk indicators. The two standout findings: a DNS F rating at a regional energy supplier (the most alarming single indicator across all organisations) and a Header D rating at the largest utility, which operates the most complex and supplier-rich external estate.
Structural vulnerabilities across the energy digital estate
The patterns below appear consistently across energy organisations regardless of size, country, or sub-sector. They reflect the accumulated technical debt of organisations that have expanded digital customer services rapidly without equivalent investment in external security hygiene.
Energy operators (electricity, gas, oil) are classified as essential entities under NIS2 Annex I. This triggers mandatory obligations under Article 21: risk analysis and security of information systems, supply chain security (Article 21.2.d), vulnerability handling, use of cryptography, and incident reporting within 24 hours (Article 23). UK energy operators face equivalent obligations under the Network and Information Systems (NIS) Regulations and OFGEM's cybersecurity guidance. ThingsRecon provides the continuous outside-in visibility that Article 21 compliance and regulatory audit evidence requires.
Discovery. Prioritisation. Monitoring.
Energy organisations manage digital estates that span customer portals, smart meter APIs, trading platforms, partner integrations, and OT-adjacent web interfaces — all growing continuously. ThingsRecon maps every publicly visible asset and supplier connection from a single seed domain, with no agents required and no access to internal systems.
Continuous Discovery
Energy digital estates expand constantly — new customer portals, smart home integrations, B2B energy trading APIs, and partner platforms. ThingsRecon discovers every subdomain, cloud-hosted service, and third-party script continuously, including DNS records that have become dangling or misconfigured as infrastructure evolves over time.
Risk Prioritisation
With 111 Fix Now items across five organisations, energy security teams cannot address everything simultaneously. ThingsRecon scores every finding by exploitability and proximity to business-critical assets — enabling teams to act on the DNS F, the vulnerable customer portal libraries, and the SSL misconfigurations before less critical hygiene issues.
Supply Chain Monitoring
Four technology suppliers appear in every energy organisation scanned. ThingsRecon monitors every supplier connection for changes — new scripts, certificate rotations, CDN routing changes, unexpected subdomain appearances — the moment they occur on the external surface, before they become incidents reportable under NIS2 Article 23.
The suppliers inside every energy digital estate
ThingsRecon maps the technical supply chain — every third-party component detected on the external attack surface via scripts, certificates, DNS, ASN routing, and HTTP headers. These are the suppliers that standard TPRM questionnaires miss because they were never deliberately onboarded: they arrived embedded in platforms, CMS themes, analytics tooling, and acquired infrastructure. In the energy sector, where IT/OT convergence means web-based energy management interfaces increasingly talk to operational systems, the risk profile of this invisible supply chain is elevated significantly.
Microsoft is the most deeply embedded technology supplier across every energy organisation in this benchmark. At 71% digital proximity in one organisation, Microsoft infrastructure is woven into the heart of the customer-facing digital estate. In practice, this means Azure Active Directory controls identity for every customer-facing and internal application, Microsoft 365 handles all staff communications including operational alerts, and Azure hosts energy management workloads and customer data platforms. For energy operators with IT/OT integration, Azure-hosted dashboards and Teams-based operational communications create a dependency chain where a misconfigured Entra ID application registration, an overpermissioned OAuth scope, or an undeclared Azure-hosted service can provide attackers with a path from the public internet toward operational technology environments. Under NIS2 Article 21(2)(d), energy essential entities must specifically assess ICT supply chain security — and Microsoft, as the universal IT infrastructure provider across this sector, is the highest-priority supplier to map and continuously monitor.
Aggregated risk signals across all scanned organisations
The following findings reflect patterns observed across all five energy organisations. Individual organisation-level findings with full asset detail are available through a full ThingsRecon engagement.
- Fix NowDNS F rating at an energy supplier — immediate remediation required. The most alarming single finding across all five energy organisations. An F-rated DNS estate indicates dangling DNS records, DNSSEC failures, or misconfigurations that leave externally accessible energy services — customer portals, billing systems, B2B APIs — open to subdomain takeover and traffic interception. This is the highest-priority finding in the energy sector benchmark and requires immediate attention before an attacker discovers it first.
- Fix NowSoftware vulnerability Fix Now items across all five organisations. Outdated JavaScript libraries with publicly disclosed CVEs are present on externally accessible energy web applications in every organisation. The largest utility has 24 software Fix Now items alone. In energy portals that handle account management, consumption data, and payment processing, a known-vulnerable library provides the initial entry point for supply chain attacks without any network intrusion.
- Fix NowSSL service Fix Now findings across multiple organisations. Weak TLS configurations and SSL mismanagement on customer-facing energy portals create man-in-the-middle exposure on exactly the sessions that carry payment data and authentication tokens. The largest utility has 10 SSL-related Fix Now items — a significant concentration of TLS risk for a customer-facing energy platform.
- Fix SoonHeader D rating at the sector's largest energy utility. 12,639 assets and 217 supplier connections, with D-rated HTTP security headers across the external estate. Missing Content-Security-Policy on energy portals that load jQuery scripts, Google Analytics, and GitHub-hosted libraries creates direct cross-site scripting exposure on customer-facing applications managing energy accounts, direct debits, and consumption data.
- Fix Soon282 Fix Soon items across the sector — structured remediation programme required. The largest utility alone has 215 Fix Soon items — cookie security failures, application misconfigurations, and certificate issues that require a prioritised, tracked remediation programme. At this scale, ad-hoc remediation is insufficient: continuous monitoring with a Fix Now / Fix Soon priority framework is required to make measurable progress against the backlog.
- MonitorFour universal suppliers not tracked in TPRM programmes. Microsoft, Google, GitHub, and OpenJS Foundation / jQuery are present in every energy organisation's external estate — yet the technical connections that create this dependency (CDN-loaded scripts, OAuth redirects, ASN routing) are rarely captured in formal supply chain risk registers. ThingsRecon maps and monitors these connections continuously, alerting when new versions, new domains, or new certificate authorities are introduced without security team oversight.
Your organisation's exposure — mapped in 48 hours
This sector report shows the patterns. A ThingsRecon scan of your organisation shows exactly which DNS records are dangling, which suppliers are in your estate, and which of your 111 sector Fix Now equivalents apply to you — with the NIS2 evidence pack your compliance team needs.