By: Allison Duke, CPA, and Mohamad Al-Kawafha, CPA
Your organization has met every cybersecurity requirement. The assessments are complete, the documentation is in place, and the boxes are checked. But, if a cyberattack happened today, would that compliance actually protect your operations? For energy companies facing increasingly sophisticated threats, the answer may reveal a troubling gap between meeting regulatory standards and achieving real security
Real Threats in Real Time
Cyber threats are constantly evolving, with new attacks coming online on a daily basis. Hackers are always working to discover novel vulnerabilities in older software, weak points in more recent security tools, and new strategies for fooling people and systems. And, in the energy sector, their ambitions extend well beyond data theft.
You’re up against a host of advanced threats that can cause operational disruption and lead to significant costs, reputational damage, and regulatory consequences.
The primary cyber threats facing energy companies in 2026 include:
- Ransomware-as-a-Service (RaaS): This type of attack allows financially driven hackers to bring operations to a halt by controlling data and systems, leaving the target organization unable to access critical information or tools. Groups like LockBit or BlackCat often target dual-use corporate networks in RaaS attacks. And even if attackers only manage to hit the business side, affecting functions like billing or email, companies often shut down operations entirely to limit the spread.
- State-Sponsored Advanced Persistent Threats (APTs): In this case, highly sophisticated actors are working for a foreign government. These groups are often looking to gain future geopolitical advantage by planting “sleeper” malware in critical infrastructure. If the hidden malware remains undetected, APTs can pull the trigger at an opportune moment to wreak maximum economic, military, political and social havoc.
-
Living off the Land (LotL): This form of attack is a massive threat today and is likely to continue growing in importance. In a LotL attack, hackers don’t rely on custom malware that triggers alarms. Instead, they use legitimate, built-in system administrator tools already on the network to blend in with normal traffic. That allows them to avoid getting flagged as a threat while they access sensitive data, search for vulnerabilities and poke around in your company’s “private” environment.
When Regulation Lags Behind Risk
Threat actors can change their tactics quickly, but the regulatory frameworks intended to reduce cyber risk cannot evolve at the same pace. This creates a critical gap between meeting established requirements and defending against the threats energy organizations face today.
The most relevant frameworks for the energy industry are:
- North American Electric Reliability Corporation Critical Infrastructure Protection (NERC-CIP)
- National Institute of Standards and Technology Critical Security Framework (NIST CSF)
- TSA Security Directives for pipelines
- Federal Information Security Modernization Act (FISMA) for federally controlled energy organizations
Compliance with each of these as they apply to your organization is imperative. It’s also a good idea from a risk reduction perspective. However, leaders often don’t know that there’s a significant gap between regulatory guidance and protection from real-world cyberattacks.
This kind of delay is a serious problem that can expose your business to excessive risk. That’s because it typically takes years to update frameworks like NERC-CIP or FISMA, which means the rules you’re diligently following reflect a threat environment that’s no longer the reality.
Regulatory evolution is a slow process, and for good reason. Multiple steps are required to achieve consensus and advance an update from ideation to implementation:
- Identifying the threat
- Determining best practices to mitigate associated risks
- Assessing feasibility
- Gathering input from all stakeholders
- Issuing preliminary regulations
- Seeking feedback through public comment periods
- Tweaking proposed updates in response to feedback
- Issuing final rules
- Bringing the new legislation into effect
The entire journey takes two or three years at a minimum. But threat actors, unencumbered by bureaucratic responsibilities or fairness concerns, can modify their malware code or switch up their attack tactics in just a couple of hours. They are attacking in a dynamic threat environment, while the protective regulations you see offer only a static snapshot of what security looked like years beforehand.
Our advisors can show you how to bridge the gap between regulatory compliance and real security. Reach out today for answers and insights to help you manage a dynamic threat environment.
