Defining OT Resilience Priorities for APAC Energy Operators

Across Australia, India, and Southeast Asia, energy operators are being asked to comply with some of the most demanding — and most different — critical infrastructure regimes in the world. Australia's enhanced Critical Infrastructure Risk Management Program obligations, in force since 2024–2025 under the SOCI Act, require energy operators to meet AESCSF Security Profile 2 maturity, a framework purpose-built for OT environments. Singapore's Cybersecurity Act now carries a mandatory OT-specific addendum to its Code of Practice for Critical Information Infrastructure (CCoP 2.0). India's Central Electricity Authority has moved from voluntary guidance to draft binding cybersecurity regulations for generation, transmission, and distribution utilities, coordinated through CERT-In, NCIIPC, and the newly established CSIRT-Power. For an operator running assets across several of these markets at once, compliance alone is now a full-time operational discipline.

Regulation is only half the picture. The region's energy mix is being rebuilt in real time: Indonesia still generates roughly 60% of its electricity from coal while pursuing a targeted 72 GW of solar and wind capacity by 2030; Thailand is restructuring its Power Development Plan to lift renewables to 51% of final energy consumption by 2037; and the Philippines is projected to post the fastest renewable growth rate in Southeast Asia this decade. Layered on top of this transition is the ASEAN Power Grid Initiative — an estimated $800 billion, multi-decade plan to interconnect ten national grids, with only 13 of a planned 27 cross-border links completed so far. Every new interconnection extends the OT attack surface across a border, a regulator and an operator that didn't exist the year before.

The threat landscape is keeping pace with the opportunity. Ransomware activity against energy and utilities operators rose an estimated 80% year-over-year through 2025, and Southeast Asia's energy sector was named among the region's most targeted industries, alongside government. In one widely reported 2025 incident, a Southeast Asian energy provider had control systems disabled for 18 days after a ransomware intrusion, with attackers demanding an eight-figure payment. This executive research study examines how 50 senior energy and critical infrastructure leaders across Australia, India, Indonesia, the Philippines and Thailand are responding — where they feel exposed, where they are investing, and what they believe resilience will require over the next 24 months.

No two energy markets in this study regulate, generate or defend their infrastructure the same way. An operator running sites in Australia, India and Indonesia is simultaneously meeting AESCSF Security Profile 2, CEA's emerging incident-reporting regime and a market with no unified OT cybersecurity mandate at all. That regulatory inconsistency, combined with an electrical grid that is part coal-fired legacy plant and part brand-new renewable asset, is where the region's operational risk lies.

Fragmented Regulatory Visibility

Operators spanning Australia's AESCSF-aligned CIRMP regime, Singapore's CCoP 2.0 OT addendum and India's draft CEA cybersecurity regulations are being asked to prove three different variations of OT maturity, often without a single centralised view of the assets each framework actually covers
Legacy-Renewable Hybrid Exposure

With Indonesia still drawing roughly 60% of generation from coal while racing toward tens of gigawatts of new solar and wind, and Thailand restructuring its entire Power Development Plan around renewables, operators are defending two very different generations of technology inside the same perimeter
Remote Site & IT-OT Threat Containment

Ransomware activity against energy and utilities operators rose an estimated 80% year-over-year in 2025, including a widely reported incident that took a Southeast Asian energy provider's control systems offline for 18 days – a reminder that containment at the OT boundary, not just detection, is what determines downtime
Third-Party Integrator & OEM Risk

A regional build-out of this scale runs on a dense, fast-moving supply chain of system integrators, EPC contractors and equipment OEMs – each one a potential entry point for the physical files and transient devices that routine commissioning and maintenance work requires
Regulation vs. Insurance-Driven Investment

As Australia's ransomware payment reporting rules and India's incident reporting mandates come into force alongside tightening global cyber insurance underwriting standards, energy operators are being pulled toward OT investment by two different forces – and not always toward the same priorities
Cross-Border Network Segmentation Gaps

The ASEAN Power Grid has completed only 13 of a planned 27 cross-border interconnections, and each new link – backed by an estimated $800 billion in regional investment through 2045 – extends the OT network across a jurisdiction, a counterparty and a set of technical standards that didn't previously have to interact with each other

What You'll Learn

Gain insights into how energy and critical infrastructure leaders across Australia, India and Southeast Asia are addressing today's most pressing OT cybersecurity and operational resilience priorities.

Research at a Glance

50 Senior Decision-Makers across OT Security, Operations, Engineering and Critical Infrastructure leadership
5 Regional Markets: Australia, India, Indonesia, the Philippines and Thailand
4 Critical Infrastructure Sectors: Oil & Gas, Utilities, Mining & Metals, Renewable Energy

Key Findings

How energy operators are sequencing compliance across Australia's AESCSF regime, Singapore's CCoP 2.0 and India's emerging CEA cybersecurity rules.
Where legacy generation assets create the greatest exposure as renewable capacity comes online.
How prepared operators feel to contain – not just detect – a threat at a remote site or the IT-OT boundary.
What's slowing down network segmentation as cross-border interconnection accelerates.
How much of the region's third-party integrator and OEM ecosystem is covered by formal security controls.
Whether regulation or cyber insurance is doing more to shape OT security budgets today.

Build One View Across Multiple Regulatory Regimes

Consolidate OT asset visibility so a single framework doesn't have to be rebuilt for every market and every mandate
Secure the Legacy-Renewable Transition

Protect aging, unpatchable generation assets while extending the same security posture to newly commissioned renewable and smart grid infrastructure
Contain Risk at the Edge as the Grid Crosses Borders

Strengthen detection and containment at remote sites and interconnection points without hindering the region's cross-border power trade ambitions