Cybersecurity for multi-utilities and critical infrastructure
Energy & Utilities companies run on increasingly exposed digital infrastructure. CyberGrant blocks ransomware, intrusions and sabotage, and the protection stays on the data once it leaves the operational network.
Why are multi-utilities among the most exposed targets?
Digitalising power, water and gas multiplied the points of contact: connected SCADA, customer portals, contractors, IoT vendors. Serious incidents worldwide reached 5,265 in 2025, up from 3,541 the year before, a 48.7% rise and the steepest on record (Clusit Report 2026). An energy sector breach now costs USD 4.83 million on average (IBM Cost of a Data Breach 2025).
What are the top cybersecurity risks for energy & utilities?
Every outage puts millions of users at risk. Cyber resilience is what keeps an essential service running, not an add-on to the IT budget.
Technicians, contractors and third parties reach critical plants and systems, often without strong authentication. One stolen credential is enough. SecretGrant treats every credential like a file: shared, tracked, revocable.
Consumption records, contracts and plant documentation must be encrypted and traced, not just stored. FileGrant encrypts at creation and logs every single access.
Ransomware appears in 48% of the breaches analysed in the Verizon DBIR 2026, up from 44%. RemoteGrant blocks ransomware and phishing on endpoints and conceals exposed RDP ports.
48% of breaches now run through a third party, double the figure of two years ago. The Santander case shows the mechanism: the cloud vendor is breached, the customer's data walks out. With EmailGrant, an attachment sent to a supplier stays revocable after sending. More on this in supply chain cyber risk.
NIS2 demands monitoring, traceability and fast incident reporting, with baseline measures operational by 31 October 2026. That calls for verifiable audit trails, not statements of intent.
Which CyberGrant solutions protect multi-utility infrastructure?
- Quantum-safe Lock&Go encryption using CRYSTALS-Kyber, the NIST FIPS 203 standard, on plant diagrams, supply contracts and network documentation
- RBAC permissions and expiry on links shared with contractors, maintenance crews, EPC partners and technical consultants
- Download, print and screen capture blocking, with an audit trail on every single open
- Transparent encryption and USB whitelisting by serial number on substation, control room and engineering workstations
- RDP port hidden from scanners for remote access to SCADA, telecontrol and back-office systems
- Clipboard control and blocking of uploads to personal cloud accounts and unmanaged browsers
- On-premise private AI over operating procedures, tender specifications and plant manuals: data never leaves your network
- Automatic classification of documents by plant, area and supplier, with a full log
- A governed alternative to shadow AI, which adds 670,000 dollars to the average breach cost (IBM 2025)
MULTIUTILITIES
- Revoke access after sending: a misdirected attachment or a cancelled tender closes in one click
- Scheduled expiry on messages and attachments, with tracking of who opened and from which IP
- Extra password encryption on bids, commercial terms and bank details
- Attack Surface Discovery, Vulnerability Assessment and Penetration Testing on customer portals, APIs and IT/OT environments
- Phishing and ransomware simulation ahead of seasonal peaks and maintenance windows
- Executive Summary and Technical Report you can use in NIS2 audits and client security questionnaires
- Encrypted vault for credentials to SCADA, telecontrol, regulatory portals and metering platforms
- Tracked sharing with suppliers and shift staff, without ever sending a password in the clear
- Immediate revocation at contract or shift end, with no need to change the credential
Power never stops. Neither should your defenses.
Frequently asked questions about cybersecurity for multi-utilities and critical infrastructure
Multi-utilities run essential services on hybrid infrastructure: industrial control systems, customer portals, cloud document platforms and a wide network of contractors. Serious incidents recorded worldwide reached 5,265 in 2025, up from 3,541 in 2024, a 48.7% rise and the steepest on record (Clusit Report 2026). An energy sector data breach costs USD 4.83 million on average (IBM Cost of a Data Breach 2025). The exposure does not come from plants alone. It comes from the technical, contractual and consumption documents that leave the perimeter every day.
NIS2 was transposed in Italy by Legislative Decree 138 of 4 September 2024, in force since 16 October 2024. Energy, drinking water, waste water and gas fall under the highly critical sectors, so operators are classified as essential or important entities. Baseline security measures must be operational by 31 October 2026. In practice: documented risk management, access control, encryption, supply chain security, event traceability and incident notification within the set deadlines.
Legacy DLP watches the exits from the network and stops working the moment a file reaches its recipient. File-centric DLP encrypts the document at creation, and the protection travels with the file wherever it goes. For a utility that means a plant diagram shared with a contractor, a supply contract or a consumption data export stays unreadable outside authorised devices, even if copied or exfiltrated. CyberGrant's FileGrant applies that model with quantum-safe encryption, post-sharing revocation and an audit trail on every access.
Quantum-safe encryption uses algorithms resistant to attacks from quantum computers. CyberGrant uses CRYSTALS-Kyber, standardised by NIST as FIPS 203 (ML-KEM) in August 2024. The concrete risk is called "harvest now, decrypt later": data encrypted today with classical algorithms is collected now and decrypted once quantum computers reach scale. For a multi-utility that is a live concern, because grid designs, concessions and supply contracts hold value for ten or twenty years.
According to the Verizon DBIR 2026, 67% of users access AI services from non-corporate accounts on corporate devices, and the share of employees who use AI regularly went from 15% to 45% in one year. Policies alone do not hold. AIGrant, CyberGrant's on-premise private AI extension, brings the engine inside the infrastructure: technicians query documentation and procedures through an enterprise RAG segregated by department, with no data leaving. In parallel, FileGrant blocks AI scraping on encrypted files and CyberGrant Connector keeps them unreadable to Copilot inside SharePoint.
No. CyberGrant sits alongside the existing stack and covers the protection missing there. Connector encrypts files inside SharePoint and OneDrive with no migration: documents stay where they are, users keep their Microsoft login and habits, and encryption also covers the non-Office formats Microsoft Purview leaves uncovered. AIGrant does not replace Copilot: it offers an on-premise alternative for documents that cannot leave. RemoteGrant adds to the remote access tooling already in use rather than replacing it.
What you need to know
- Serious incidents worldwide reached 5,265 in 2025, up from 3,541 in 2024, a 48.7% rise (Clusit Report 2026)
- An energy sector data breach costs USD 4.83 million on average (IBM Cost of a Data Breach 2025)
- Third parties are involved in 48% of breaches, up from 30% the previous year: contractors and suppliers are the fastest growing vector (Verizon DBIR 2026)
- NIS2 (Italian Legislative Decree 138/2024) lists energy, water and gas as highly critical sectors: baseline measures operational by 31 October 2026
- CyberGrant's file-centric DLP encrypts the document at creation with CRYSTALS-Kyber (NIST FIPS 203) and keeps revocation and audit trail alive after sharing