Under Pressure —Utilities Sector Cyber Exposure & Supply Chain Intelligence
Based on ThingsRecon scans of 5 utilities organisations across Belgium, the Netherlands & the United Kingdom
Why utilities carry unique and systemic cyber exposure
Water utilities, wastewater operators, and energy-from-waste providers occupy a privileged and pressured position in critical national infrastructure. Their operational technology environments — SCADA systems, remote telemetry units, treatment plant control networks — attract the most attention in cybersecurity discourse. But their digital estates are equally consequential: customer portals, billing platforms, operational dashboards, regulatory reporting systems, and supplier integrations all sit on the public internet, reachable to any attacker with a browser and a reconnaissance tool.
The utilities sector also presents a distinctive supply chain profile. GIS mapping platforms such as Esri ArcGIS are embedded across multiple operators for infrastructure asset management. National telecoms provide the backbone for both internet connectivity and operational communications. And the full stack of enterprise technology — Microsoft 365, Azure, Cloudflare CDN, Google Analytics — is present at every organisation, creating an unusually dense concentration of shared dependencies across the sector.
This report draws on simultaneous scans of five utilities organisations across Belgium, the Netherlands, and the United Kingdom — spanning drinking water production, water utility operations, wastewater management, and energy recovery from waste. The findings reveal a sector-wide failure of security header controls, a striking variation in software hygiene between operators, and a certificate estate at one organisation where 46 individual certificates carry an F rating — exposing operational and customer-facing services alike to transport-layer attack.
All organisations in this report are anonymised. Technology suppliers and infrastructure providers are named as they appear on the external attack surface.
How do utilities operators compare?
ThingsRecon scanned five utilities organisations simultaneously. Four carry an overall score of C; one achieves a B — the standout result in this benchmark and a notable contrast to sector peers. The defining pattern across all five organisations is a universal failure of security header controls: every operator in this benchmark scores D for header risk, making this the first sector in this report series where a single risk category fails across the entire field. Org E, the largest asset estate after Org D, carries 29 Fix Now priorities, D-rated software risk, and a Cert C rating driven by 46 F-rated certificates.
Cert C (46 F-rated)
For the first time in this sector intelligence series, a single risk category fails at every organisation in the benchmark. All five utilities operators score D for header risk — meaning that critical browser-side protections including Content Security Policy, HTTP Strict Transport Security, X-Frame-Options, and Referrer-Policy are absent or misconfigured across the full sector. This is not an isolated oversight at one operator; it is a structural gap in how the utilities sector approaches web security hygiene, from drinking water to wastewater to energy recovery.
Where the sector is consistently exposed
Security headers are the sector's universal failure — but they are not the only area of concern. Software risk, certificate hygiene, and application ratings vary significantly between operators, revealing both a sector baseline and individual outliers in both directions. Org C's B score and Software A rating demonstrate that a small-to-mid-sized utility can operate a well-controlled external estate. Org E's Software D and 46 F-rated certificates demonstrate what under-investment in web hygiene produces at scale.
The structural vulnerabilities defining this sector
Universal Header Misconfiguration
Header security failing at all five operators is not coincidence — it reflects a sector-wide gap in web security policy governance. The sector's reliance on shared technology platforms (Cloudflare, Microsoft) means header remediation at scale is achievable — but requires deliberate action, not default settings.
Certificate & Software Debt at Scale
Org E's 46 F-rated certificates and D-rated software risk represent the outer edge of accumulated web hygiene debt in this sector. At a waste-to-energy operator touching grid infrastructure and municipal contracts, the external web estate is the interface through which operational and commercial relationships are managed.
Seven-Supplier Concentration Risk
Seven technology suppliers — Microsoft, Cloudflare, Google, Amazon, Meta, GitHub, and jQuery — are present in every utilities organisation scanned. A security event affecting any of these platforms propagates instantly across the full benchmark. Meta's presence across all five operators is particularly notable for a sector handling sensitive infrastructure data.
Water supply and wastewater operators qualify as essential entities under NIS2 Annex I — the stricter of the two NIS2 classifications, carrying higher supervisory obligations and more stringent enforcement powers than the Annex II "important entity" category. Org A (drinking water, NL), Org B (water utility, BE), and Org D (wastewater, BE) are directly subject to essential entity obligations. In the UK, Org C falls under the UK NIS Regulations 2018. Security header failures, software vulnerability debt, and unaddressed certificate risk each represent concrete gaps against NIS2 Annex I requirements for risk management, supply chain security, and demonstrable control of network and information systems.
The technology layer connecting utilities operators
1,472 supplier connections were mapped across the five organisations. Seven suppliers — Microsoft, Cloudflare, Google, Amazon, Meta Platforms, GitHub, and jQuery — appear in every organisation's external estate, forming the densest universal supplier footprint observed across any sector in this series. Microsoft leads in digital proximity, reaching 72% at both Org A and Org D — meaning these operators' external identities are substantially defined by Microsoft infrastructure.
The top suppliers by reach and digital proximity across the utilities benchmark:
Microsoft's 72% digital proximity at Org A and Org D means these operators' external estates are more than half-defined by Microsoft infrastructure. This level of integration is both an operational strength and a concentration risk. Any Microsoft platform event — a misconfiguration, a credential compromise, or an authentication infrastructure incident — would propagate directly into the external attack surface of two essential entities in this benchmark.
From public reconnaissance to operational infrastructure access
Priority issues identified across the utilities benchmark
- Fix NowSecurity headers absent sector-wide — 5/5 organisations — No other risk category in this sector intelligence series has failed at every operator simultaneously. CSP, HSTS, X-Frame-Options, and Referrer-Policy are missing or misconfigured across all five utilities organisations, irrespective of estate size, geography, or operator type. Remediation is well-understood and implementable via CDN configuration or web server policy — but requires deliberate prioritisation.
- Fix NowOrg E — 46 F-rated certificates across a 5,393-asset estate — Deprecated TLS versions, expired certificates, and misconfigured cipher suites on a waste-to-energy operator's digital estate create interception risk on connections between operational platforms, grid interfaces, and municipal contracting systems. Combined with Software D and Header D, Org E carries three concurrent D-or-worse risk categories — the highest concentration of systemic web risk in this benchmark.
- Fix NowOrg E — Software D and 29 Fix Now priorities — Org E carries the highest Fix Now count in this benchmark and the sector's only D-rated software risk profile. Known CVEs in JavaScript libraries and server-side components embedded across its estate provide documented, unauthenticated exploit paths.
- Fix SoonOrg D — 8 F-rated applications within 12,435-asset estate — Org D is the largest estate scanned in this benchmark and carries 8 applications rated F, contributing to 16 Fix Now and 26 Fix Soon priorities. For a wastewater operator classified as an NIS2 Annex I essential entity, F-rated web applications represent direct compliance exposure alongside technical risk.
- Fix SoonOrgs A and B — SSL service risk C — Both the Dutch drinking water operator and the Belgian water utility carry C-rated SSL risk. Deprecated TLS configurations on externally reachable services undermine the security of encrypted connections handling regulatory data, operational management traffic, and customer billing information.
- Fix SoonMeta Platforms present across all 5 utilities organisations — An unusual finding for a sector handling sensitive infrastructure data and operating under NIS2 essential entity obligations. Meta's presence through embedded tracking pixels, social sharing scripts, and analytics integrations creates data outflow pathways from utilities' public-facing portals.
- MonitorEsri / ArcGIS embedded at 3/5 utilities — ArcGIS serves as the infrastructure asset management backbone for water and wastewater operators — mapping pipe networks, treatment facilities, and service zones. A compromise of ArcGIS-connected interfaces could expose infrastructure topology data with significant operational security implications.
See exactly where your utilities operation is exposed
ThingsRecon scans your external attack surface from the outside in — no agents, no credentials, no internal access required. Within hours you receive a full picture of your web estate, supply chain dependencies, and prioritised remediation roadmap.