Industries
Securing the grid and the systems that run beside it
Cybersecurity for generation, transmission and distribution systems, and for the water, gas and broadband operations that face the same constraints.
Utility leadership should not have to explain what an RTU, a phasor measurement unit or a control loop is to an outside consultant before the conversation can start.
This page describes how we work with electric co-operatives, municipal systems, investor-owned providers and the water, gas and broadband utilities that operate under comparable constraints: two technology estates, one budget, and an operational side that cannot be taken down to be fixed.
Background
Built from inside the sector
Caltrop Defense Group was founded out of systems administration work inside an electrical engineering firm serving the power sector. That is where the sector fluency comes from, and it is the reason this page exists rather than a generic one with a substation photograph on it.
Fluent in OT and IT
We work across both estates: the corporate network with its identity, email and endpoint problems, and the substation, plant and station environments where the constraints are entirely different. Most of the difficulty in this sector lives at the join between them, and that is where we spend our time.
Aligned to how utilities are actually regulated
Co-operatives, municipal systems and investor-owned providers sit under different combinations of NERC CIP, state commission oversight and federal supply chain restrictions, and water and gas operations answer to frameworks of their own. We work to the ones that apply to you rather than to a generic checklist.
No generalist filler
The controls we propose are chosen for the threat vectors and operating constraints specific to energy and utility delivery. Where a recommendation is standard practice everywhere, we will say so rather than dress it up as sector expertise.
Capabilities
Core capabilities for energy and utility providers
OT and IT boundary defence
Hardening the boundary where the corporate enterprise network meets SCADA, historians, engineering workstations and industrial control systems, including the vendor remote-access paths that quietly cross it. Segmentation is designed around how your operations staff actually work, because a boundary that obstructs them will be routed around within a month.
Supply chain and component risk auditing
Inventorying, vetting and isolating hardware and firmware, so that questions about equipment provenance, manufacturer and remote access have documented answers rather than estimates. This has become a live question in light of recent federal action on foreign-sourced bulk-power system equipment.
Incident response built for energy delivery
Containment planning for environments where isolating a system to investigate is not a neutral act. Response steps, decision authority and escalation paths are agreed with your operations and engineering teams in advance, so that nothing has to be improvised while service is affected.
Continuous telemetry and monitoring
Log ingestion and behavioral monitoring tuned for industrial environments, where normal traffic looks very little like an office network and generic alerting produces mostly noise. The objective is catching anomalous behavior early enough that the response is a maintenance decision rather than an emergency one.
Working together
How we work with utility teams
Alongside your engineers, not over them
Your operations and engineering staff know the plant, and we do not arrive intending to explain it to them. Where you have internal IT, they are colleagues rather than competition. Most of what we contribute is at the boundary neither team was given clear ownership of.
Audit-ready before the audit
Control documentation and evidence are produced as the work is done, so that a commission inquiry, an insurance renewal or a mutual-aid questionnaire draws on records that already exist rather than starting a scramble.
Retainers that fit your operations
Incident retainers and support arrangements are structured around your maintenance calendar, seasonal load and crew availability rather than a standard business-hours template. Response commitments are written to reflect what your operation can actually accommodate.
A practical consideration for Utilities & Energy
Almost every piece of utility security work depends on an asset inventory, and almost nobody has a complete one. Before segmentation, monitoring or a compliance program is worth designing, it is worth knowing what is actually connected: every controller, relay, radio, historian, engineering laptop and vendor remote-access path, with make, model, firmware and owner recorded. It is unglamorous, it takes longer than anyone expects, and skipping it is the most common reason a security program in this sector stalls in its second year.