Cyber risk in utilities: Securing the right protection

Utility companies form the basis of many essential services which are indispensable to our daily lives and commerce. Although it is often out of sight, they are responsible for both providing and managing critical services such as electricity, natural gas and water.

When this critical infrastructure fails, there is almost always an impact on people and business, and the economy and society.

Geopolitics as an operating condition

Since the escalation of the regional conflict involving the United States, Israel, and Iran from 28 February 2026 onwards, Gulf utilities have been targeted both kinetically and digitally. Kuwait has confirmed repeated damage to power and desalination plants, a Bahraini desalination plant was struck in March, and the IRGC-linked group CyberAv3ngers has progressed from default-credential attacks on Unitronics PLCs to purpose-built OT malware.^6,7,8 Property damage, cyber and political violence are now produced by one actor within one campaign.

On 1 March, Iranian drones struck three AWS data centres in the UAE and Bahrain; on 15 September AWS confirmed it cannot restore data held exclusively in its Bahrain region or in one UAE availability zone.
Reported customer credits of around USD 150 million fell outside insurance by operation of war exclusions, and many affected organisations had no Middle East presence at all, having simply routed workloads through the region.^9,10 With Lloyd’s requiring state-backed exclusions since 2023 and some 48 approved wordings in that market alone, attribution now sits between a utility and its recovery.¹¹

Moving towards the wording’s utilities should review

Cyber insurance, as a risk transfer tool, historically had low uptake within the utilities sector. The hesitation of cyber insurance within the utilities industry was based on a misconception that it only addressed data privacy and privacy breaches. The evolution of cyber insurance wordings are addressing the broader exposures faced within the utility sector, and the below will highlight some key points which should be considered whether you are a first-time buyer, or current purchaser, of cyber insurance.

1. Utility companies are heavily regulated, and regulatory bodies within the utilities sector, such as NERC, are addressing cyber threats against critical infrastructure in a more active role. Furthermore, utility companies may have to adhere to further regulations if they are a listed company on a stock exchange. It is important that your cyber insurance policy wording, in respect of regulatory fines and penalties, extends to cover specific utility regulators and enforced shutdowns directed by regulatory authorities.
2. Utility companies heavily involve the use of operational technology, used to directly monitor, control, and automate physical infrastructure such as power grids, water networks and gas pipelines. It is important that your cyber insurance policy defines operational technology clearly, to ensure that the coverage extends if the physical plant operations are disabled.
3. Utility infrastructure outages can run significantly longer than other industries, and many cyber insurance policies will only provide a maximum indemnity period of 180 days. It is important that the indemnity period of the cyber insurance policy is reviewed as many will offer a full 365 days to factor for the potential longer periods which may be due to many factors e.g. regulatory requalification.
4. Utility companies rely on a complex supply chain of vendors, whether this is for software providers, system integrators and/or managed service providers. However, they may also rely on vendors which provide services beyond solely an I.T service such as construction, engineering and customer communication services. It is important to review the outsourced service provider definition within the cyber insurance policy wording to ensure that coverage extends to cover various outsourced service providers being utilised.
5. An attack, which causes physical damage to energy infrastructure, can sometimes create a loss which is blurred between standard cyber insurance and property insurance. The complication is that many property insurance policies now exclude losses caused by cyberattacks, and standard cyber insurance policies will also exclude property damage. Addressing this coverage gap prior to any first time purchase or policy renewal is critical.
6. Utility companies may use AI to save time, cut costs, and make improved decision making in various areas such as grid management and optimization. As the use of AI increases, so does the potential new vulnerabilities which can further introduce new regulations alongside different business interruption events previously unseen. Cyber insurance policy wordings may provide cover, but it has not always been affirmative in its language. Addressing this potential coverage issue is a consideration which has not previously been addressed.

References

1. The National, “Ransomware activity rises across Middle East as criminal groups attack Gulf”, 16 September 2026.
2. Utilities Middle East, “UAE energy, aviation sectors among top cyberattack targets”, 17 September 2026; Norton Rose Fulbright Data Protection Report, 8 March 2026.
3. Positive Technologies, Gulf cyberattack analysis H1 2026, reported in Dark Reading, 23 September 2026.
4. Honeywell, 2026 Operational Technology Cybersecurity Benchmark Report.
5. Dragos, 2026 OT/ICS Cybersecurity Year in Review; Bitsight, “2026 Global State of ICS/OT Exposure”, 4 June 2026.
6. Kuwait Times, “Oil facilities, ministries complex, power and desalination plants hit”, 5 April 2026; Al-Monitor, July 2026.
7. The National, “Iran targets key infrastructure in Kuwait, Bahrain and UAE”, 5 April 2026.
8. CISA Advisory AA26-097A, updated 22 July 2026; Tenable Research, August 2026.
9. AWS Health Dashboard, 15 September 2026, reported in Data Center Dynamics and Help Net Security, September 2026.
10. Forbes reporting on AWS customer credits and war exclusions, April 2026; Insurance Journal, 16 September 2026.
11. Lloyd’s Market Bulletin Y5381, effective 31 March 2023; Insurance Business, “The Iran War’s hidden insurance crisis”, 31 March 2026.