Abstract
<jats:p>Modern energy systems increasingly depend on digitally interconnected operational technology (OT) environments that integrate control, monitoring, and physical processes across power generation, transmission, and hydrocarbon transport. Energy infrastructure relies on tightly coupled OT systems designed to ensure continuous operation, safety, and physical integrity. These systems control generation assets, pipeline pressures, grid frequency, and safety interlocks, often in real time and with minimal operational limitations. Historically, OT environments were engineered for reliability and availability rather than adversarial resilience, operating in isolated or semi-isolated configurations with limited external connectivity.</jats:p> <jats:p>Over the past decade, digital transformation initiatives have increased connectivity between OT and information technology (IT) environments, enabling centralized monitoring, remote operations, and advanced analytics. While these capabilities improve efficiency and reliability, they also expand the attack surface available to malicious actors. Of particular concern are zero-day vulnerabilities. A zero-day vulnerability, defined as an unknown or unpatched flaw in software or hardware, represents a latent failure mechanism within OT environments. Unlike known vulnerabilities, zero-day exploits operate without signatures or prior indicators, limiting the effectiveness of traditional detection and compliance-driven security controls. Zero-days can bypass signature-based detection, exploit trusted interfaces, and persist until operational anomalies are observed.</jats:p> <jats:p>A single exploit could allow attackers to (a) shut down power plants by manipulating industrial control systems; (b) sabotage natural gas pipelines by altering SCADA (Supervisory Control and Data Acquisition) settings, leading to dangerous over pressurization or shutdowns; or (c) destabilize smart grids by hacking smart meters, leading to erratic power fluctuations and cascading failures. The interconnected nature of energy systems also means that a breach in one area can have cascading effects across adjacent sectors (Hoxha 2024; Mohan & Hoxha et al., 2025). Figure 1 illustrates a representative zero-day intrusion pathway across a digitized energy OT environment, from external actor through IT perimeter controls, across the IT-OT boundary, and into core control and safety systems.</jats:p>