How should power operators improve cyber resilience when attackers target both industrial systems and people?

Power operators should treat cyber resilience as a combined engineering and human problem. The article points to threat intelligence, joint training, and attack simulation as the practical starting points, because attackers use malware, credential theft, and phishing to move from initial access to impact. Stronger detection improves when technical controls are paired with regular exercises that show staff how attacks unfold in realistic conditions.

Why cyber resilience in power systems has to cover both technology and people

Power operations are exposed through two linked paths: disruption of industrial systems and manipulation of the humans who run or support them. That means resilience is not just about hardening control rooms and field assets, but also about reducing the chance that phishing, stolen credentials, or rushed operator decisions become the first step in a wider incident. The practical goal is to make compromise harder, slower, and easier to detect.

For industrial environments, this usually means understanding where malware can move from IT into OT, where remote access is trusted too broadly, and where availability-sensitive systems may fail safely or fail dangerously. For the human side, the issue is not simply awareness training, but whether staff can recognise attack patterns under pressure and respond in ways that preserve service continuity.

Resilience improves when the organisation treats those two paths as one operating model. Threat intelligence gives context on active adversary behaviour, while joint exercises help teams see how phishing, credential theft, and malware chain together into operational impact. In that sense, the strongest resilience programs build muscle memory before an incident forces improvisation.

How to build realistic training around industrial attack paths

The most useful exercises are scenario-based and cross-functional. A good drill should not only test the SOC or the OT engineers in isolation, but also the coordination between control-room staff, identity teams, incident response, and business leadership when access is abused or a process is disrupted.

That is why OT-specific guidance matters. OT and ICS Identity and Access Guide is a useful reference when shared accounts, vendor remote access, and segmentation decisions shape how far an attacker can go after an initial compromise. Training should reflect those realities, not generic enterprise assumptions.

Exercises should also include endpoint and device trust, because attackers often reach industrial impact through unmanaged or weakly managed access paths. Device and IoT Identity Guide is relevant where device certificates, attestation, and onboarding controls determine whether a field device or connected asset can be trusted to join the environment at all.

The key design principle is realism. If the scenario does not include the communication delays, approval bottlenecks, and access constraints that staff will face during a real event, the exercise may improve awareness but still fail to improve resilience.

Which threat signals should shape response priorities

Power operators should base resilience work on the attack patterns most likely to bridge human and technical failure. That includes phishing that captures credentials, malware that uses those credentials for lateral movement, and access abuse that lets an attacker reach engineering systems, historian data, or remote support channels. The danger is not only the initial compromise, but the sequence that follows.

When attackers target industrial environments, active threat reporting helps decide what to rehearse first. ENISA Threat Landscape is useful for understanding sector-level threat patterns, while CISA Industrial Control Systems provides operational guidance and advisories for critical infrastructure environments.

When the concern is known active exploitation rather than background threat activity, CISA Known Exploited Vulnerabilities Catalog is a practical signal for where technical controls and patching urgency should be tightened first. That helps keep resilience work anchored in current exploitation paths, not just theoretical weaknesses.

Risk and Threat Considerations

Power systems are high-consequence targets because a compromise can cascade from the human layer into operational disruption. Attackers often exploit the easiest weak point first, then use trusted access, unmanaged accounts, or weak segmentation to reach systems that affect availability and safety.

Failure mechanism: A phishing message, stolen credential, or weakly protected remote access path gives an attacker a foothold, after which malware or manual actions can spread into industrial systems or disrupt operator decision-making.

Impact: The result can be loss of visibility, delayed response, unsafe process behaviour, service interruption, or a recovery effort that is slowed by uncertainty about what the attacker touched first.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	GV.RM-01 — Risk Management Strategy	Power resilience depends on prioritising combined cyber and operational risk.
Recommendation — Set resilience priorities around the attack paths most likely to affect operations.
NIST SP 800-53 Rev 5	AT-2 — Awareness Training	Human-targeted attacks make targeted training material to resilience.
	IR-4 — Incident Handling	Exercises should prove coordinated response during industrial compromise scenarios.
	IA-2 — Identification and Authentication (Organizational Users)	Credential theft is a primary attack path into operator and support systems.
Recommendation — Run role-specific training on phishing, credential theft, and operator response. Test incident handling with cross-functional drills that include OT and business teams. Harden operator authentication and reduce the value of stolen credentials.

Practitioner Guidance

What to prioritise: Start with the attack paths that cross people and systems, especially remote access, privileged accounts, and the operator actions most likely to be abused during a real incident. If the organisation cannot explain how an attacker would move from inbox to industrial impact, the resilience program is too abstract.

What to verify: Confirm that exercises include both technical detection and human decision points, such as who escalates, who can disable access, and who has authority to isolate affected assets without creating unnecessary operational risk. The exercise should reveal whether staff know the sequence, not just the policy.

Practitioner takeaway: The best resilience programs treat staff as part of the control surface, because in power environments the difference between a contained event and an operational incident is often whether people recognise the attack fast enough to interrupt the chain.