SecurityScorecard report reveals the energy sector faces surge in supply chain risks amid growing dependence on vendors
SecurityScorecard and KPMG LLP have released a co-authored new cybersecurity research report on the 250 largest US energy companies. In A Quantitative Analysis of Cyber Risks in the U.S. Energy Supply Chain, security researchers and industry subject professionals provide a detailed analysis of cybersecurity vulnerabilities across the energy sector and its supply chains.
Novel insights into energy sector cybersecurity
The report arrives at a pivotal moment as regulatory bodies worldwide intensify cybersecurity requirements and initiatives for the US energy sector. It aligns with global efforts to bolster cybersecurity across the energy supply chain, reflecting commitments made during the June 2024 G7 summit to enhance defences against escalating cyberthreats.
The White House just convened the fourth round of International Counter Ransomware Initiative (CRI) meetings. CRI’s 68 members issued a joint statement following the meeting, which continued ‘the joint commitment to develop a collective resilience to ransomware’. In parallel, the US Department of Energy is actively convening energy sector leaders to advance the Supply Chain Cybersecurity Principles.
SecurityScorecard’s latest research highlights frequent threats, such as ransomware attacks on conventional IT systems, which are often enough to cause widespread disruption across the energy sector. Much attention has been paid to potential attacks on industrial control systems (ICS) and Operational Technology (OT), which will continue to be a focus for risk mitigation. As the shift to cleaner energy accelerates, however, the sector’s vulnerabilities may grow, as a greener, more interconnected grid becomes increasingly reliant on software, making it more susceptible to cyberattacks.
Ryan Sherstobitoff, Senior Vice President of Threat Research and Intelligence, SecurityScorecard, said: “The energy sector’s growing dependence on third-party vendors highlights a critical vulnerability – its security is only as strong as its weakest link. Our research shows that this rising reliance poses significant risks. It’s time for the industry to take decisive action and strengthen cybersecurity measures before a breach turns into a national emergency.”
Key findings
- Third-party risks are disproportionately high in the energy sector: Third-party risk drives almost half (45%) of breaches in the energy sector. This is significantly higher than the global rate of 29%. Additionally, 90% of companies that suffered multiple breaches were hit via third-party vendors
- US energy scores a ‘B’ on cybersecurity: The US energy industry scores a ‘B’ on average based on SecurityScorecard’s scoring methodology. Four-fifths (81%) of companies have either an A or B rating, but the remaining 19% with weak scores pose a significant risk to the entire supply chain
- Software and IT vendors are the leading cause of third-party breaches: Software and IT vendors outside the energy sector are the main sources of third-party breaches. Of the incidents studied, 67% of third-party breaches were due to software and IT vendors, with only four involving other energy companies
- Renewable energy companies fall behind: Oil and natural gas companies scored well above average with an ‘A’, while renewable energy firms lagged with a ‘B’ score
- Vulnerabilities condensed in key risk factors: 92% of companies had their lowest scores in just three of 10 risk factors: application security (40%), network security (23%), and DNS (Domain Name System) health (29%)
Prasanna Govindankutty, Principal, Cyber Security US Sector Leader, at KPMG, said: “The energy industry is a complex system that is undergoing a generational transition with a heavy reliance on a steady supply chain. With geopolitical and technology-based threats on the rise, this complex system is facing an equally generational risk exposure that could harm citizens and businesses alike. Organisations that are able to quantify these risks and establish mitigation measures will increase their odds of success in the energy transition journey.”
Methodology
SecurityScorecard researchers compiled a sample of 250 top US energy companies, based on market capitalisation and the various sectors of the industry that they represent. These sectors cover: the successive stages of the traditional oil and gas supply chain; the existence of vertically integrated oil and gas companies covering that whole supply chain; the consumption of some energy via utilities; and the emergence of companies devoted to renewable energy sources.
