Colonial Pipeline
A single VPN password with no multi-factor authentication, on an account no longer in use but still active. The largest fuel pipeline in the US stopped. (Source: Bloomberg)
The Privileged Access Blind Spot: Energy and Utilities
One unretired VPN account with no MFA shut down the largest fuel pipeline in the United States. The pattern in the three incidents below is the same: an access path into operations that outlived its reason to exist.
Two pagesPublic reporting onlyFreeWritten by certified engineers
The incidents
Three breaches, one pattern
Default industrial control passwords
Control-system devices left on vendor default passwords, some reachable straight from the internet.
IT and OT convergence
Networks joined for good operational reasons, without the MFA and segmentation that joining them demanded.
The read-across
What the pattern means for you
The IT/OT boundary is the most important line in your estate, and vendor remote access is the most common way across it. Since 1 April 2026, CIP-003-9 expects that access to be controlled at low-impact sites too — which for many utilities means systems that were never in scope before.
Self-check
The 60-second self-check
- Can you name every vendor with remote access into operational systems, and terminate any of them within the hour?
- Is every crossing of the IT/OT boundary a brokered, recorded session?
- When an operator leaves, is access to control systems gone within 24 hours — and can you prove the timestamp?
- How many firecall or emergency accounts exist, and who reviewed their use last quarter?
- Which low-impact sites came into CIP-003-9 scope in April, and are they covered?
If any answer is "no" or "I would have to ask", that is the blind spot.
The full brief
Get the full brief
The two-page PDF adds the full account of each incident and the control that would have stopped it. Name and work email, and it comes straight back.
Next
Where to go next
The sector page: identity security for energy and utilities. The service that closes the gap: PAM implementation. And a free audit is 30 minutes with a certified engineer on your own environment, findings in writing: Get a free audit.
Get the Energy and Utilities brief
Name and work email. The two-page PDF covers each incident in full and the control that would have stopped it.