Scaling Smart: What the Energy Sector Must Learn from Its Own Digital Revolution
The energy transition is digital. But digital without resilience is risky. And with the UK’s net zero ambitions tied directly to infrastructure performance, the stakes couldn’t be higher.
That was the clear headline at the Digitalisation in Energy event in London, hosted by Cyber Innovation Hub in partnership with Amentum. From a keynote by SSEN Transmission’s Iain Dougan and an expert panel discussion, a consistent message emerged: if we want a secure, reliable, and scalable energy future, we need to rethink how we lead digital transformation, from substations to supply chains.
Infrastructure Is Scaling Fast. Risk Is Scaling Faster.
SSEN Transmission is investing over £22 billion in digital infrastructure by 2031, with 70 new substations and a sixfold increase in power flow capacity. But this isn’t just a hardware upgrade, it’s a security wake-up call.
There is no energy transition without transmission,” said Iain. “You can build all the wind turbines you want, but if you can’t get the energy to the grid, it goes nowhere
As assets go digital, they also become more exposed. SSEN’s upcoming fully digital substation, going live in 2027, will be a prime example. An engineering breakthrough, but also a cybersecurity target. Iain reinforced that cyber incidents are no longer theoretical “Nation-state actors are no longer hypothetical. We’ve had to shift our entire mindset.”
The scale and speed of this transformation requires cultural change across every level of the business, not just better technology.
Lesson 1: Resilience Must Be Built-In, Not Bolted On
For many in the sector, resilience still means writing recovery plans. But that’s not enough anymore. The panel, featuring Pete Sueref (Empirisys), John Elder (Amentum), Gillian Dunn (Frazer-Nash) and Heather Lowrie (Resilionix), challenged organisations to redesign for resilience.
Recovery has to be part of the design,” said Gillian Dunn. “If a platform goes down, what will your senior team do? How does your business keep running?
Rather than viewing resilience as a contingency, it must become a design principle. This includes building systems that degrade gracefully, integrating OT/IT incident exercises as routine, and ensuring that technical and non-technical teams share responsibility when something goes wrong.
Lesson 2: Legacy Tech Isn’t Going Away – But It Can’t Be a Blind Spot
Digital transformation in energy doesn’t start from scratch. It builds on systems that pre-date the internet. But layering AI, cloud, and advanced sensors onto 1980s control systems is creating new risks faster than they can be mapped.
Lots of legacy applications were designed before the internet,” said Pete Sueref. “Now we’re trying to bolt on modern tech, and that makes security exponentially harder
There’s a growing capability gap in the workforce, with not enough engineers equipped to secure these hybrid environments. As Heather Lowrie put it, “We need more security architects.”
The panel agreed that without closing this gap, integration efforts could introduce more vulnerabilities.
Lesson 3: Field Teams Are Your First Line of Defence
One of the most actionable takeaways came from Iain Dougan’s keynote: don’t overlook frontline teams. The substation engineer is now a critical cybersecurity stakeholder.
At SSEN, basic but high-impact behaviours are being trained in: scan any devices before plugging them in, report anything suspicious, and escalate early. These aren’t complex controls, they’re everyday habits that prevent major incidents.
It’s just basic things like thinking about what you’re plugging in,” Iain shared. “And knowing what to do if something seems wrong
The takeaway? Culture change doesn’t start with new frameworks; it starts with making cyber tangible to the people who interact with assets daily.
Lesson 4: Supply Chain Maturity Isn’t Optional
Supply chain risk is no longer limited to immediate partners. Fourth and fifth-party risk is now on the radar, with new regulations demanding deeper visibility. And when thousands of suppliers are involved, the risk multiplies quickly.
You can’t fix everything four tiers deep,” said John Elder. “But you can defend your own environment, and assume something will go wrong
Energy leaders need smarter segmentation of suppliers, deeper relationships with critical vendors, and built-in fail-safes that prevent one weak link from breaking the chain. And just like with frontline teams, culture matters, and supplier engagement must go beyond forms and checklists to meaningful dialogue.
Our Perspective: Culture is Infrastructure
From Iain Dougan’s keynote to the panel’s expert debate, the message was clear: digital infrastructure is only as resilient as the people and culture behind it. Getting systems in place is one thing. Getting people to believe it matters is another.
At Cyber Innovation Hub, we work with organisations across energy, defence, and critical infrastructure to build that culture, through simulation, training, testbeds, and leadership engagement.
Because the future of energy is digital, but the risk is still human.
Our immersive exercising can help you:
- Simulate real-world cyber events on systems like yours
- Bring teams together across departments to rehearse response
- Stress-test transformation plans and uncover hidden gaps
- Show decision-makers exactly what’s at stake
Whether you’re validating defences or trying to convince your leadership team why resilience needs prioritising, this is where the penny drops. When the system goes dark in a test, or communication breaks down, the importance of getting cyber right becomes undeniable.
And that’s when change starts to happen.
See how National Highways used our testbeds to prepare their teams >
Wherever you are in your digital transformation journey, we’ll work with you to design an experience that reflects your systems, your challenges, and your people.
Let’s build the capability, confidence and culture to face it.
