Energy breaches cost $4.72M on average. The OT side is uninsured.

Operational technology and information technology used to be physically separate networks at most energy companies, with air gaps and unidirectional gateways preventing direct connectivity. The economic pressure to instrument OT systems with cloud-based analytics, remote-monitoring access, and predictive-maintenance integration has compressed the air gaps materially over the past decade. The benefit is real (uptime improvements of 5 to 15%, maintenance-cost reduction of 10 to 25%). The cost is that ransomware that gets into the IT network can now reach OT systems through legitimate management interfaces.

Colonial Pipeline did not have ransomware on OT systems. Colonial shut down OT systems pre-emptively because the IT-side ransomware made it impossible to operate the billing system that tracked which customer's product was flowing through which line. The six-day shutdown was a precautionary measure driven by inability to invoice rather than direct OT compromise. The fact that an IT-side ransomware event could produce an OT shutdown decision was the watershed insight, and it has driven Department of Energy and TSA policy ever since.

The cost asymmetry is severe. An IT breach that exposes 100,000 employee records at an electric utility costs $134 to $200 per record under IBM's methodology, a total of $13M to $20M. An OT incident that requires a 24-hour grid-restoration sequence at the same utility can cost $50M to $300M in commercial losses (lost transmission revenue, regulatory disallowance, customer indemnification), plus indirect cost in regulator scrutiny and lost trust with public utility commissions. The OT cost does not show up in IBM data because it does not fit the personal-data breach methodology.

NERC CIP (North American Electric Reliability Corporation Critical Infrastructure Protection) is the mandatory cybersecurity standard for the bulk-electric system. CIP version 014 covers physical security, while CIP versions 002-013 cover cybersecurity controls including identity management, system access, malicious-code prevention, security-event monitoring, and incident response. Penalties are imposed by FERC (the Federal Energy Regulatory Commission) on referral from NERC and can reach $1.34M per violation per day under the 2024 inflation adjustment.

NERC publishes annual aggregate penalty data showing approximately 100-200 settled CIP violations per year with average penalty of $50K to $300K per settled enforcement action. The 2019 settlement with an unnamed Western utility for $10M (the largest single CIP settlement) involved 127 violations of 13 CIP standards over a multi-year period. The case established that CIP penalties accumulate aggressively when violations are systematic rather than isolated.

For the pipeline sector specifically, the TSA Pipeline Security Directives issued in May 2021 (and updated annually since) impose cybersecurity-incident reporting requirements, designated cyber-coordinator obligations, and contingency-planning requirements. TSA enforcement carries penalties up to $13,910 per violation per day under 2024 figures. The TSA framework was created in direct response to Colonial Pipeline and has produced a documented shift in pipeline-sector security investment, with major operators reporting cybersecurity budget increases of 30% to 75% between 2021 and 2025.

Energy-sector cyber-insurance policies frequently exclude OT-related losses, either through explicit OT exclusions or through "property damage" exclusions that interact unhelpfully with OT incidents that produce physical effects. The 2017 NotPetya attack against Merck produced a landmark insurance dispute when Merck's property insurers invoked the "hostile or warlike action" exclusion to deny a $1.4B claim. The New Jersey Superior Court ruled in 2022 that the exclusion did not apply because the attribution to a sovereign was sufficiently uncertain. The case is still being litigated on appeal as of 2026, but the policy implications have rippled across the energy sector with most operators now demanding affirmative cyber-perils coverage including the OT side.

For utilities and pipelines that successfully obtain OT-inclusive cyber coverage, premium has risen 25% to 75% annually since 2021. The combination of premium increases, deductible increases (commonly to $5M-$25M for mid-size utilities), and OT-specific underwriting questionnaires has materially raised the total cost of cyber readiness even for organisations that have not experienced a breach.