U growing cybersecurity challenges as they balance operational resilience, regulatory compliance and ageing infrastructure, according to Bridewell’ s Cyber Security in Critical National Infrastructure Report 2026.
LEGACY LAG
Utilities face mounting cyber pressure from ageing systems and unpatched infrastructure
New research from Bridewell has found that attacks exploiting outdated software and unpatched legacy equipment are the most common cyber incidents affecting utilities organisations, highlighting the growing challenge of securing ageing infrastructure. longest to respond to, averaging 9.9 hours, followed by data theft or disclosure incidents at 8.4 hours and unauthorised access incidents at 7.6 hours. tilities organisations are facing
U growing cybersecurity challenges as they balance operational resilience, regulatory compliance and ageing infrastructure, according to Bridewell’ s Cyber Security in Critical National Infrastructure Report 2026.
The research found that 77 % of utilities organisations experienced attacks involving outdated software or unavailable patches on legacy equipment during the past 12 months, making it the most common cyberincident affecting the sector.
Bridewell said the findings highlight the difficulties utilities face in securing operational technology and infrastructure designed to operate for decades rather than withstand modern cyberthreats. Many critical assets cannot be updated or taken offline as easily as traditional IT systems, increasing exposure to attacks that exploit legacy vulnerabilities.
Phishing and business email compromise affected 76 % of utilities organisations during the past year, while malware impacted 74 %. More than seven in 10 organisations also experienced unauthorised system access.
Data protection and privacy emerged as the leading cybersecurity concern, cited by 46 % of respondents. Managing AIrelated cyber-risk and improving incident detection capabilities were also identified as significant challenges.
Regulation is now the primary driver of cybersecurity maturity within the sector, cited by 36 % of respondents, ahead of both the evolving threat landscape and customer demand for improved security.
While 99 % of organisations described themselves as resilient following their worst cyberattack, response times remain a concern. Supply chain attacks took the
The operational impact of cyber incidents is also increasing. Nearly half of organisations( 47 %) reported IT disruption or outages following an attack, while 42 % said incidents resulted in increased cybersecurity spending. Data loss affected 35 % of respondents, 34 % reported revenue loss and 32 % experienced disruption to production or services.
“ Many of the systems underpinning essential utilities services were designed to operate for decades in environments that were never intended to be connected to modern digital networks,” said Sam Thornton, COO at Bridewell.“ It’ s therefore significant that 77 % of utilities organisations reported attacks involving outdated software or unavailable patches on legacy equipment. As utilities providers continue to modernise and connect operational systems, managing the gap between legacy infrastructure and modern security requirements is becoming one of the sector’ s biggest cyber security challenges.”
Bridewell recommends that utilities organisations improve visibility across IT and operational technology environments, prioritise patch management and vulnerability remediation, conduct regular incident response exercises, strengthen monitoring and detection capabilities and review thirdparty and supply chain security arrangements.
“ In the utilities sector, the consequences of a cyberattack extend far beyond IT. When critical systems are disrupted, the impact can be felt by customers, communities and the wider economy, making cyber resilience a businesscritical priority,” Thornton concluded.
28 WWW. INTELLIGENTCISO. COM