November is Critical Infrastructure Security and Resilience Month, and CISA's 2026 theme is "Resolve to be Resilient." This year, the agency is asking infrastructure owners and operators to focus on four practices: know your infrastructure and its dependencies, prioritize the risks that matter most, make actionable plans, and measure progress.
For mid-sized energy operators, such as electric cooperatives, municipal utilities, midstream operators, and renewable generation sites, one dependency deserves more attention than it usually gets: the outside vendors who can reach into your operational technology (OT) environment from somewhere else.
Every OT environment has guests
Modern energy operations run on vendor support. The SCADA integrator who tunes your HMI. The OEM that monitors turbine or compressor performance. The controls contractor who troubleshoots a PLC at 2 a.m. so a crew doesn't have to drive out to a remote site.
That access keeps operations running and costs down. It's also one of the most common ways attackers get into industrial environments. In a 2025 Claroty survey of cyber-physical systems organizations, including power and energy respondents, 46% said they had experienced a breach in the past 12 months caused by third-party access.
Attackers don't need to break into a control network if they can log in through a trusted connection someone else already set up.
The visibility gap
Secomea's State of Industrial Remote Access 2026 report surveyed manufacturing and critical infrastructure organizations. Several findings stand out for energy operators:
- Only 43% have full audit trails of vendor remote sessions.
- In North America, 57% manage six or more external vendors with remote access into OT environments.
- Just 23% review vendor credentials monthly or more often.
- Organizations using three or more different remote access tools reported lower session visibility than those running a consolidated setup.
Put simply: many operators can't say with confidence who connected to their OT environment last month, what they did while they were in, or whether the account they used should still exist.
How vendor access drifts over time
Few utilities set out to build an unmanaged access path. It happens gradually.
A vendor installs a remote access tool during commissioning and it never comes out. A contractor finishes a project but their account stays active. Three vendors use three different remote tools, each approved separately. A shared login gets passed between technicians at the vendor's office. A firewall rule opened "temporarily" for an emergency fix is still open two years later.
None of these decisions look risky in the moment. Together, they create a set of always-on doors into the systems that keep power flowing and pipelines moving, many of them monitored by nobody.
What resilient vendor access looks like
Applying CISA's four practices to remote access gives energy operators a practical checklist.
Know the paths. Inventory every way an outside party can reach OT: vendor-installed tools, VPN accounts, cellular modems, jump hosts, and cloud-connected monitoring. Include who owns each one and why it exists.
Give every person their own identity. Shared vendor logins make investigation nearly impossible. Each technician should authenticate individually, with multifactor authentication.
Grant access when it's needed, not all the time. Just-in-time access, approved per session and closed when the work is done, removes the standing connections attackers look for.
Record and review sessions. Session logs and recordings turn "we think the vendor was in on Tuesday" into a clear record of what happened.
Separate and monitor the boundary. Vendor access should land in a controlled zone, not directly on the control network, with monitoring at the IT/OT boundary for activity that doesn't match the approved task.
Have a kill switch. If a vendor reports a breach of their own systems, you should be able to cut their access to your environment in minutes and know exactly what that affects.
Measure it. Track how many access paths exist, how many are consolidated, and how often credentials are reviewed. Progress you can measure is progress you can defend to a board or a regulator.
Why mid-sized operators feel this most
Large utilities often have dedicated OT security teams and formal vendor access programs. Mid-sized operators typically rely on a small engineering staff who are experts in operations, not in security architecture. They depend on vendors more, which makes vendor access both more important and harder to govern.
That's not a reason for alarm. It's a reason to treat remote access as an operational risk with an owner, a process, and a plan, the same way you'd treat a critical spare part or a backup generator.
Where to start
If you're not sure how many vendors can reach your OT environment today, that's the first answer to get. From there, the highest-value steps are usually closing unused access paths, ending shared accounts, and putting session approval in front of the connections that remain.
How Tec-Refresh helps
Tec-Refresh works with energy and utility operators to map OT dependencies, assess remote access paths, and build vendor access practices that support operations instead of slowing them down.
This Critical Infrastructure Security and Resilience Month, we're offering a one-hour OT/ICS security consultation for energy operators. Bring your questions about vendor access, segmentation, or monitoring, and leave with clear priorities for your environment.
Resolve to be resilient, starting with who has the keys
Resilience isn't only about recovering after something breaks. It's also about knowing who can reach your most important systems, and making sure every one of those doors is one you chose to open.