How UK Power Networks tested early attacker detection in OT environments
Working with UK Power Networks and the Power Networks Demonstration Centre, Lupovis was evaluated on a representative distribution network. The project showed that attacker behaviour can be detected early in operational technology environments, with minimal false positives and no impact on live operations.
Critical infrastructure · Threat-led defence
.png)
Threat-led defence
Get research and insights on the vulnerabilities attackers are exploiting and what they mean for your defences.
Summary
Working with UK Power Networks and the Power Networks Demonstration Centre, Lupovis was evaluated on a representative distribution network. The project showed that attacker behaviour can be detected early in operational technology environments, with minimal false positives and no impact on live operations.
At a glance
- Supported by: Distribution network operators including SP Energy Networks and Scottish and Southern Electricity Networks
- Regulatory context: UK NIS Regulations
- Deployment: Managed evaluation
- Year: 2022
Headline results
- SOC visibility across OT environments without disrupting operations
- Earlier detection of adversary behaviour in the first stages of an attack, with 95% of alerts confirmed as real attacker interaction
- Cyber resilience validated against evolving NIS regulatory expectations
The challenge
Utility providers face growing pressure from threat actors and from regulators, including under the UK NIS Regulations, to strengthen threat detection and incident reporting. Traditional controls often miss or delay detection of sophisticated attacks, and SOC teams are held back by high volumes of false positives.
UK Power Networks and PNDC wanted to evaluate whether Lupovis could close those gaps in operational technology environments across the energy sector.
The solution
Lupovis was tailored to a representative distribution network operator environment and run without touching live operations. Attacker behaviour was captured as it progressed, scored for severity and intent, and enriched with external threat intelligence.
What changed
The project demonstrated that threats in OT environments can be detected early and an attacker's progress slowed. Signals were high in fidelity, with minimal false positives.
[purple-block-start]
The outcome
The SOC gained visibility across OT environments, along with contextual data to support risk decisions and patching strategies. The work also gave the operators evidence of resilience in line with NIS expectations.
[purple-block-end]
"It's all about detecting intelligent movement, an early warning system, allowing for the defender to detect and remediate any weakness in its defences to any potential or further attempt at a cyber breach. A simple solution to deploy with full support from Lupovis, a valuable experience."
Matthew Bates, OT Cybersecurity Lead, UK Power Networks
"[Lupovis] proved to be an innovative approach to early detection of threats, the subsequent monitoring of its progression and attack characterisation."
Stephen Ugwuanyi, Research Engineer, PNDC
