In late August, the Coast Guard and the FBI boarded a crude oil tanker bound for Galveston after signs that its networks had been compromised. The ship, the VL Prosperity, is 1,093 feet long and can carry about 2.3 million barrels. In October, Bloomberg reported that investigators had found evidence the intruders reached the ship’s propulsion system, citing officials who were not named, while the FBI said there were no reports of operational disruption. Between those two reports, on September 24, Texas Railroad Commissioner Wayne Christian called on the state’s oil and gas producers and pipeline operators to strengthen their cyber defenses, saying “the cost of hesitation exceeds the cost of preparation.”
A tanker is not a well pad, and nothing in those reports says a Texas producer was breached. But the warning was aimed at producers and pipeline operators, not shipping lines, and the weakness it points to is one we see in many mid-market energy companies. It is not a missing tool. It is a missing owner.
It is not a missing tool. It is a missing owner.
The Seam Nobody Owns
Picture a $150 million oil and gas operator with a few hundred wells and some gathering lines in the Permian. The IT manager reports to the CFO and looks after email, the accounting system, laptops, and the office network, with help from a managed service provider. The field automation, meaning the controllers on the well pads, the radios and cellular modems that carry their data back, and the SCADA system the control room watches, belongs to the VP of Operations. A lease operator bought half of the modems. The SCADA vendor set up the remote connection it uses for support, and two contractors have their own ways in.
Every one of those people is competent and doing the job they were hired to do. Ask the IT manager whether the field network is secure and you will hear that it belongs to operations. Ask operations and you will hear that IT handles cyber. Ask the managed service provider and you will find that its contract stops at the office. Nobody is lying. The field network sits in the gap between their jobs, and the gap is where the risk lives.
The field network sits in the gap between their jobs, and the gap is where the risk lives.
Where the Attackers Have Been Getting In
The evidence on how attackers reach energy operations points at exactly that gap. Dragos, which sells security for industrial systems, reported in April that a threat group it tracks as VOLTZITE compromised cellular gateways across U.S. midstream operations in 2025, then moved to engineering workstations and copied configuration files and alarm data, the kind of information that shows what would make a process shut down. Dragos notes that these gateways often sit at unmonitored edges of the operating network and that IT teams frequently do not know they exist.
The same report found that in its oil and gas engagements, poor separation between IT and operating networks showed up in 29 percent of findings, the highest share of any sector, and default or weak passwords in 26 percent. Read those figures with their limits. They come from a vendor’s own engagements, with companies that chose to hire a specialist firm, and they do not tell you how common the problems are across the industry. But they line up with what federal agencies have said. In May 2025, CISA, the FBI, the EPA, and the Department of Energy published a short list of mitigations for operating technology, and it reads like a description of the seam: take operating systems off the public internet, change default passwords, secure remote access, including the access contractors use, separate IT and operating networks, and practice running operations by hand.
None of that is advanced. All of it requires someone to know what is in the field and to have the authority to change it.
All of it requires someone to know what is in the field and to have the authority to change it.
Why the Mid-market Carries More of This Risk
Large operators have had to build this muscle. TSA has issued cybersecurity directives to the pipeline operators it designates as critical every year since the Colonial Pipeline attack in 2021, renewing them again in 2026, and those companies have named cybersecurity coordinators, filed assessment plans, and tested their response plans because the directives require it. Producers are not covered by those pipeline directives, and our understanding is that most smaller gathering operators are not on TSA’s list either.
Our view is that this leaves them in an awkward middle. They are too small to have a security team that spans the office and the field, and large enough that their field networks have grown, one modem and one vendor connection at a time, into something nobody fully mapped. The operations side is used to safety culture and redundancy, and it is very good at keeping physical equipment running. It is often less used to thinking of a modem as a door. The IT side knows doors but has never been asked to look past the office.
Five Questions for Your Next Operations Meeting
You do not need to be technical to find out where your company stands. These five questions, asked of IT and operations together in the same room, will tell you most of what you need to know.
First, who owns every modem, radio, gateway, and remote connection at our field sites, and can someone show me the list? If the answer is a pause, the inventory is the first piece of work, and everything else depends on it.
Second, can anything on the field network reach the office network, or the internet, directly? Separation does not have to be elaborate, but someone should be able to describe it in a sentence and show where it is enforced.
Third, who has remote access to our operating systems, including vendors and contractors, and when was that list last cleaned up? Remote access is how support gets done in the field, so the goal is not to remove it. The goal is that every connection has a named purpose, uses strong sign-in, and is turned off when the work ends.
Fourth, if our SCADA system went dark tonight, how long could we run safely by hand, and when did we last practice it? Most operators have manual procedures. Fewer have tested them recently against a scenario where the screens are wrong rather than blank.
Fifth, if someone in the control room sees something odd at two in the morning, who do they call, and does that person know they are the one who gets called? An incident that starts in the field and spreads to the office, or the reverse, will cross the seam in minutes. The response plan should cross it too.
Name One Owner for the Seam
The answer is not to merge IT and operations, or to hand the field to people who have never worked a production schedule. Operations should keep running the equipment. What the company needs is one named person who is accountable for the security of the whole network, office and field, with the authority to set the standard for both and the duty to report on it to you. In a mid-market company that person might be a senior IT leader with field experience, an operations leader with security support, or an outside advisor for the first year while the work gets organized. The title matters less than the accountability.
That owner’s first year is plain work: a joint inventory of everything connected in the field, a separation plan, a cleaned-up list of remote access with a review date, a manual operations drill, and one incident exercise that includes both sides. We wrote about the same pattern in water utilities in Seven States, Thirty Water Systems, One Default Password, where the fix was mostly knowing what you own and deciding who gets to touch it. The lesson travels. So does our view, laid out in Governance Is a Freeway, Not a Roadblock, that clear ownership speeds a company up rather than slowing it down. A field network someone owns is one you can extend to new wells, new sensors, and new analytics with confidence, which matters as more operators put their field data to work, a trend we tracked in our 2026 analytics maturity survey for energy and oil and gas.
It also changes what you can say when someone asks. In our experience, insurers, purchasers, and partners ask operators more often than they used to how they secure their operating systems. A company with a named owner and a current inventory can answer those questions in a day. One without them can spend a month finding out.
What This Will Not Do
The tanker incident is a maritime case, and the details in the October report come from officials who were not named; neither tells you anything specific about your field sites. The Dragos figures come from a security vendor’s own engagements and skew toward companies that chose to hire a specialist. The operator in our picture is a picture, not a client. Our view that mid-market operators sit in an awkward middle, and our recommendation to name a single owner, are our judgment from working with companies on both sides of the seam. Nothing here replaces a technical assessment of your own networks, and none of it will stop a determined, well-funded attacker on its own. What it will do is close the easy doors, which is where much of the reported activity has started.
Where to Start
This month, put the five questions on the agenda of one meeting with your IT lead and your head of operations together, and ask for the field inventory in writing within two weeks. If the list is incomplete or the answers point at each other, that is the finding. If you would like help mapping the field network and setting up ownership for it, our independent assessment can include the office and field together, and our cybersecurity and disaster recovery work picks up from there. If you would rather talk it through first, you can reach us through the contact form on our About page.
