Digital Culture, Not Just Code: Why Energy Leaders Must Rethink Transformation
Cyber threats are no longer abstract. They’re real, persistent, and increasingly aimed at the systems that power our lives – from electricity grids to data pipelines. But protecting the energy sector isn’t just about better firewalls or flashy new tech.
Technology isn’t the hard part. Culture is.
That was the message from the expert panel at our Digitalisation in Energy event in London, hosted in partnership with Amentum. As digital systems become central to the UK’s energy transition, leadership behaviours, shared ownership, and cultural readiness are proving to be the true differentiators.
The panel featured: Pete Sueref (Empirisys), John Elder (Amentum), Gillian Dunn (Frazer-Nash Consultancy), and Heather Lowrie (Resilionix).
Their message? If you don’t win hearts and minds, your transformation will stall.
Resilience Isn’t Just Recovery, It’s Readiness
For too many organisations, resilience still means “what we do after something breaks.” But when critical national infrastructure is on the line, that’s not enough. The better question is: how do we stay operational in the first place?
That shift requires a mindset change – from reactive to proactive. Building in fault tolerance, fail-safes, and redundancy must become standard, not optional. Incident response exercises, involving both IT and OT, must become business as usual.
“We still see critical infrastructure operators focusing on ticking compliance boxes” said John Elder of Amentum. “But when the pressure’s on, the back end often doesn’t hold up. Testing failure modes matters as much as prevention.”
Cyber doesn’t just impact IT – it hits operations, customers, and reputations. And the response can’t sit in one department. It must be jointly owned across IT, OT, operations and leadership.
Legacy Tech + New Tools = New Risks
Digital transformation is a balancing act and nowhere is that more visible than in the energy sector. Exciting new tools are often layered onto decades-old OT systems never meant to be connected. Many of these systems were never designed for internet connectivity, let alone modern threat landscapes.
“Lots of legacy applications were designed before the internet,” said Pete Sueref. “Now we’re trying to bolt on modern tech, and that makes security exponentially harder.”
The result? Complex integrations, hidden vulnerabilities, and mounting risk.
While “secure by design” remains the north star, that means building systems with fault tolerance, redundancy, and degraded-mode operation at their core. panellists highlighted the urgent need for secure-by-integration practices, ensuring new tools don’t create new risks when grafted onto ageing infrastructure. But that takes skilled architects, deeper collaboration, and an honest look at the talent pipeline. Are there enough engineers left who truly understand these legacy systems?
Spoiler: not yet.
“We need more security architects,”noted Heather Lowrie. “We’re trying to modernise security thinking, but the capability gap is real, especially around integration models.”
Gillian Dunn added, “You need to consider the full technology lifecycle, because nothing lasts forever. Whatever you adopt today could be obsolete or unsupported in five to ten years. It’s not just about solving for now; it’s about planning for what comes next.”
Supply Chains: Too Deep to Ignore
With thousands of suppliers in a single operator’s ecosystem, energy supply chains are vast, and vulnerable. Some energy organisations are managing thousands of suppliers, spread across multiple tiers. That’s thousands of potential attack vectors.
“You need to control what you can control, so that you can defend your environment.” said John Elder.
The message: Not every supplier is critical. But some absolutely are. Identify the critical ones, engage directly, and ensure alignment on both technical requirements and shared responsibility.
And those relationships demand more than tick-box compliance. Know who your high-impact suppliers are. Knowing your critical suppliers, and working with them to manage risk collaboratively, can’t be replaced by a questionnaire. Build two-way engagement. Discuss risk, not just forms, and design your systems so a failure in one link doesn’t cascade across your network.
Remember: people are part of the supply chain too. Cyber awareness at the operational edge, from contractors to field teams, must be part of the culture.
“People are still people,” Elder noted. “They’ll click on links, skip steps, make mistakes. It’s not about blaming them, it’s about designing networks and controls that reduce the blast radius when something goes wrong.”
CIH Perspective: Turning Belief into Action
At Cyber Innovation Hub, these lessons aren’t theoretical. We see them play out across sectors every day. That’s why we focus on building real-world readiness. Through immersive simulations, testbed environments, and targeted training for frontline staff and leadership alike.
You don’t need more dashboards. You need more belief, behaviour, and practice.
Let’s build cultures where cyber is owned by everyone, not just those with ‘security’ in their job title.
