In many people’s imagination, a cyberattack on a power plant looks like a disaster scene: a sudden shutdown, darkness, chaos. In reality, the most serious incidents in energy infrastructure begin far more quietly — from the moment someone unauthorised gains access to the network and remains unnoticed for a long time. The failure, if it happens at all, is only the finale.
This quiet phase is the most important, because it is where it is decided whether the defence has any chance of working. In this article we explain what the period of an attacker’s undetected presence is, why it tends to be exceptionally long in OT environments, and what genuinely allows it to be shortened.
What does it mean that an attacker “sits” in the network for weeks?
In security we speak of dwell time — the period between first gaining access and detecting the intruder. This is not idle time. On the contrary: the attacker uses it for network reconnaissance, gaining further privileges, mapping systems and patiently preparing their actual action.
The longer the dwell time, the worse the defender’s position. The attacker has come to know the environment better than many of its own administrators. That is why shortening this period — detecting the presence early, before the attacker reaches their goal — is one of the most important tasks of security monitoring.
Why does detection take longer in OT than in IT?
In a typical IT network there is rich telemetry: system logs, detection tools on workstations, central event collection. In OT this picture is often far poorer, for several reasons:
- many systems were not designed with security monitoring in mind and do not generate comparable events,
- sensitive field devices cannot host agents or undergo aggressive scanning,
- environments tend to be heterogeneous and aged, with protocols that typical IT tools do not understand.
The effect is that an organisation may have limited visibility into what is really happening in the control layer — and what you cannot see, you cannot detect in time.
What traces does an attacker leave before striking?
Quiet does not mean signal-free. Before the actual action takes place, small anomalies appear in the network that, to an attentive observer, are a warning:
- communication between devices that normally do not talk to each other,
- the appearance of a new device or an unusual address in the control segment,
- commands sent at an unusual time or from an unusual source,
- remote logins falling outside the agreed maintenance windows.
Each of these signals alone may be innocent. Together, in the context of a known “normal” network behaviour, they form a picture worth checking. The art of detection in OT lies precisely in the ability to tell background from signal.
Why are a firewall and segmentation not enough?
Segmentation and firewalls are indispensable — they limit an attack’s reach and tidy up the IT/OT boundaries. But these are preventive mechanisms, not detective ones. They will not tell you that someone is already inside, that they came through a trusted remote-service channel, or that they are moving between systems they formally have access to.
Security requires both layers: prevention that makes entry harder, and detection that notices presence and action. An organisation that invested only in prevention often discovers an incident only once its effects are already visible — which is far too late.
What does OT monitoring look like in practice?
The key is passivity. Instead of actively polling sensitive devices, OT monitoring analyses a copy of the network traffic without affecting the operation of control systems. On this basis it builds a picture of the environment’s “normal” behaviour and then catches deviations from it.
In practice this means:
- continuous inventory of devices and flows — what exists and what communicates with what,
- detection of anomalies in communication and unusual commands,
- correlation of OT and IT signals, because many attacks start on the office side,
- alerts reaching analysts who understand the process context.
This approach reconciles two seemingly contradictory requirements of the energy sector: the need for visibility and the absolute ban on disrupting the process.
How do you shorten the time from detection to response?
Detection alone does not settle the matter — what counts is how quickly action follows it. Here preparation and organisation decide:
- ready response procedures tailored to OT, not copied from IT,
- a clear division of roles between the security team and the operations team,
- defined thresholds and escalation paths, so an alert does not wait for a decision,
- regular exercises that turn response into a reflex rather than improvisation.
In a SOC model providing round-the-clock oversight, the goal is for minutes, not hours, to pass between detecting a significant signal and the first response. At nFlo the response time is a contractual commitment set per incident priority — because in critical infrastructure, every delay increases the potential impact.
Why must a SOC for the energy sector understand OT?
An analyst who knows only the IT world easily makes one of two mistakes: ignoring a signal that is serious in OT, or responding in a way that itself disrupts the process. An effective SOC for the energy sector therefore combines security competencies with an understanding of industrial protocols, process logic and acceptable limits of intervention.
This is the difference between “monitoring a network” and “monitoring an energy network”. Only the latter allows an alert to be assessed correctly and a response made without risk to supply continuity.
Related concepts
Learn more
- Why a SOC is practically essential for KSC/NIS2 compliance
- Incident response plan: IT vs OT
- KSC NIS2 and OT/ICS security in industry
Explore our services
- SOC 24/7 — round-the-clock monitoring and response covering OT
- OT security architecture design — visibility and segmentation
- ISA/IEC 62443 security audit — assessment of incident-detection readiness
The most expensive incidents in energy are the ones that stay invisible for weeks. They are not won at the moment of attack but far earlier — by building the ability to notice the attacker before they reach their goal. That is what turns security from reacting to consequences into real control over risk.
