UK energy sector faces rising cyber threats from legacy systems

The United Kingdom’s energy sector is confronting an escalating cyber risk environment characterised by ageing operational technology and rapid digitisation. Grid operators are navigating a complex threat landscape influenced by geopolitical competition, while simultaneously integrating new renewable infrastructure. This convergence of factors has placed cybersecurity, energy security and sovereignty at the forefront of national priorities.

The government’s Energy Sector Cyber Security Strategy identifies the sector as a prime target for sophisticated attacks, including those from state-backed actors. As the energy system becomes increasingly interconnected, the integration of legacy infrastructure with modern technologies has created new points of exposure. This structural vulnerability complicates efforts to maintain secure and resilient grid operations amidst ongoing technological change.

Recent research conducted by Bridewell highlights the severity of these challenges. The study found that 77 per cent of utility organisations experienced attacks involving outdated software or unavailable patches on legacy equipment in 2025. This specific type of incident was identified as the most common cyber event facing the sector, underscoring the urgent need to address vulnerabilities within existing operational frameworks.