Utilities Cyber Security for Energy and Water

How SoSafe helps

Solutions for your utilities cyber security risks

Training that fits between shifts and call-outs

Whether someone works at a shared console in the control room or checks a phone in the service van, they get short lessons on the device they already use. Enrolment works without a company email address, so utilities cyber security reaches the teams who keep power and water flowing, not only the office.

Simulations that look like a normal working day

An invoice from a maintenance contractor you really do work with looks just like the ones that arrive every week. Phishing simulations by email and SMS build on everyday situations like this. In email simulations, difficulty and frequency adjust to each person’s results: people who spot the fakes move on to harder scenarios, while those who struggle get foundational guidance.

Reporting that shows behaviour change, not just attendance

Completion rates alone say little about risk. SoSafe turns simulation results, reported threats and learning progress into reports that map to NIS2, ISO/IEC 27001 and GDPR. Management can follow human risk trends in the Human Security Index, a score built from awareness, behaviour and culture data, while the security team sees which departments need attention.

SoSafe learning path with achievements beside an interactive lesson asking what to do about a QR code on a café table

Simulated phishing email in Outlook with a SoSafe hint explaining how to spot a counterfeit sender

SoSafe Human Security Index dashboard with awareness, behaviour and culture scores and suggested interventions

Training that fits between shifts and call-outs

Whether someone works at a shared console in the control room or checks a phone in the service van, they get short lessons on the device they already use. Enrolment works without a company email address, so utilities cyber security reaches the teams who keep power and water flowing, not only the office.

Simulations that look like a normal working day

An invoice from a maintenance contractor you really do work with looks just like the ones that arrive every week. Phishing simulations by email and SMS build on everyday situations like this. In email simulations, difficulty and frequency adjust to each person’s results: people who spot the fakes move on to harder scenarios, while those who struggle get foundational guidance.

Reporting that shows behaviour change, not just attendance

Completion rates alone say little about risk. SoSafe turns simulation results, reported threats and learning progress into reports that map to NIS2, ISO/IEC 27001 and GDPR. Management can follow human risk trends in the Human Security Index, a score built from awareness, behaviour and culture data, while the security team sees which departments need attention.

Book a demo

THE CHALLENGE

What energy and water utilities are up against

Phishing that looks like routine operations

Many attacks still begin with a message. In ENISA’s analysis of incidents in the EU between July 2024 and June 2025, phishing, including phone-based vishing, was the entry point in about 60% of observed cases (ENISA Threat Landscape 2025). In a utility, the lure might be a maintenance ticket, a supplier’s new invoice address, a request to confirm grid connection data or a notice about a meter replacement, sent to someone who may handle dozens of those a day.

The call to the control room

A caller says he is from the equipment vendor and needs remote access now, or from the IT helpdesk and needs a password reset before the next shift. With voice cloning, a familiar voice is no longer reliable proof of who is calling. In power grid cyber security, teams on phone, radio and mobile need the habit of verifying first.

The way in through service partners

Maintenance firms, metering service providers and IT partners often hold remote access to operational systems. For cyber security in the energy sector, NIS2 makes supply chain security a required risk management measure. When a partner’s account is compromised, the login looks legitimate, and an employee who questions an unusual request can stop it early.

Several companies, one small security team

Grid operation, energy supply, water and other municipal services often sit in separate companies, in many cases because EU energy rules require grid operators to be kept separate from supply. The security team is usually small, handles utilities cyber security for all of them and needs evidence for each one.

Book a demo

WHO GETS TRAINED

Role-based training for your entire utilities workforce

In the control room

A good part of power grid cyber security happens at the console. Operators learn in units of a few minutes, on a shared terminal or their own device, whenever the shift allows. The cases come from their own work. A vendor suddenly wants remote access. A caller reports a fault and pushes for a quick decision.

Out in the field

Meter readers and maintenance crews are out on the road for much of the day, and many of them have no company email address. They sign up and learn on their phones, and seasonal or temporary staff can join the same way. Some simulations arrive by text message, such as a new job that was never assigned or a login request they did not start. Service partners with access to your systems can be included as well.

Where payments and customer data move

Billing, customer service and procurement handle accounts and payments every day, and attackers like to imitate exactly that. Training uses the same kind of requests each team knows from its own work: in billing, a supplier announcing new bank details; in customer service, a caller asking to change the account holder; in procurement, a tender notice with a link to “view the full file”.

IT, security and management

Administrators go deeper into privileged access, remote maintenance and incident triage. Managers and executives get a shorter track built around what NIS2 expects from management bodies: approving risk management measures, following training themselves and knowing who sends the early warning for a significant incident, which is due within 24 hours.

Our product

How SoSafe works day-to-day

Book a demo

Lessons that match the job

Content adapts to role, prior knowledge and risk profile. A control room operator gets different scenarios from a billing clerk, and people who already know the basics can move on more quickly.

Smartphone showing a short SoSafe security lesson in progress with a progress bar

Real attacks, turned into training

When someone reports a suspicious email, for example a fake outage notice, your team can upload it and turn it into a simulation within minutes. It then goes to the groups that received the original.

SoSafe phishing simulation editor with a draft email imitating a supplier

A safe first call

At the end of the interactive vishing lesson, people take a realistic, AI-voiced call in their browser and practise checking who is on the line. Nobody has to hand over a phone number. The call is part of the lesson and is not tracked like a phishing simulation.

Interactive vishing lesson showing an incoming IT support call beside the response options in the browser

Your policies as lessons

Upload an existing document as a PDF, such as the rules for remote access by service partners. SoSafe drafts an editable lesson for your team to review, refine and publish.

SoSafe Policy-to-Lesson view turning an uploaded policy into a security lesson

Reporting in one click

The Phishing Report Button in the email client sends suspicious messages to a single triage queue. The security team sees all reports in one place and decides which ones need action.

The SoSafe report button in an email toolbar with a cursor selecting it

Evidence you can export

Exporting a report aligned with NIS2, ISO/IEC 27001 or GDPR usually takes less than an hour. The Human Security Index shows how behaviour develops across control room, field and office teams.

SoSafe Human Security Index dashboard with awareness, behaviour and culture scores over time

“In a crisis, no technology will help you – only resilient colleagues who keep a cool head even in such a stressful situation, apply what they have learned, and do their best to get the company back on track. SoSafe is the solution provider that helps us to get there quickly and to engage our employees in an appealing way.”

Jens Feistel

CISO at DEW21, a local energy supplier in Germany

Read the story

88%

knowledge retention after 12 months

90%

reduction in risky interactions

80%

reporting threats within 12 months

15 min

per week to run the full programme

Measurable impact

Utilities cyber security is judged on evidence. These figures come from aggregated data across live SoSafe programmes.

Book a demo

Built to fit the systems your utility already runs

Utility cyber security has to work with the identity, email and service management tools that are already in place. SoSafe connects to them, so the programme runs inside your existing setup rather than alongside it.

Integrations

See all the integrations

Phishing simulation integration with Microsoft 365

Compliance

See all our certifications

GDPR Compliant

German Engineered

EU Hosted

Utilities cyber security FAQs

Drinking water and waste water are among the most vulnerable critical infrastructure in the EU. ENISA’s NIS360 2026 ranks them among the least mature sectors and places them in its risk zone, where criticality outweighs maturity.

Protecting critical infrastructure from cyber attack takes technical controls and people who recognise attacks early. Multi-factor authentication and regular training are among the measures NIS2 lists, and separating operational from office networks helps as well. In utilities cyber security, SoSafe covers the people side.

Several providers offer security awareness training and phishing simulations for energy and utility companies. Check whether staff without a company email can take part and whether reports map to NIS2 and ISO/IEC 27001. SoSafe combines both in a Human Risk Management platform that supports cyber security for water utilities and energy suppliers such as DEW21.

Yes, field technicians and shift staff without a company email address can take part. Enrolment doesn’t require a business email, and lessons run on personal or shared devices, so control room, field and office teams follow the same utilities cyber security programme with content for their role.

SoSafe supports NIS2 and the CER Directive in utilities on the people side. Training, simulation results and reporting behaviour are mapped to NIS2 and ISO/IEC 27001 and can be exported as audit evidence. For CER, the programme supports the training and awareness measures the directive describes. Whether either applies depends on national law.

Licensing for a utility with several companies depends on your workforce size and selected package. Multi-year commitments provide price protection for the agreed term. Request pricing for your organisation.

SoSafe helps staff prepare for phone scams and cloned voices with lessons on vishing and voice cloning. An interactive vishing lesson ends with a realistic call in the browser, without collecting employee phone numbers. It is practice within the lesson, not a standalone simulation with click-rate tracking.

The effort of running a utilities cyber security programme stays manageable for a small IT team: it can launch within two days, and ongoing operation starts from 15 minutes a week. Campaigns run on a schedule, reported messages land in one triage queue, and Sofie answers routine questions from employees.