The Four Pillars Are No Longer Enough — Here Is What a Real Defense Looks Like
If you have been following this series, August’s conversation on Zero Trust Architecture set an important foundation: the old perimeter-based model of network security is no longer sufficient for the way energy companies actually operate today. Effective ransomware defense for energy companies builds on that foundation with multiple layers of protection designed for today’s distributed operations. This month, we are taking that foundation and pressure-testing it against the most disruptive threat your business is likely to face: ransomware.
Why Ransomware Is a Growing Threat to Energy Companies
Ransomware is not a new concept. But the version of ransomware that targets energy sector businesses in 2026 bears almost no resemblance to the nuisance-level infections of a decade ago. Modern ransomware is a coordinated, business-model-driven criminal operation. Threat actors research their targets and identify the highest-leverage systems to encrypt. They also time attacks for maximum disruption. Increasingly, they threaten to publish stolen data if the victim does not pay the ransom — a tactic known as double extortion. The Colonial Pipeline attack put ransomware’s potential for operational disruption into mainstream headlines. That event did not slow the attacks. It advertised the playbook.
Ransomware threatens energy sector companies of all types. That includes companies operating storage terminals, running transport fleets, managing rail movements, or serving as shippers on pipeline networks. It also includes upstream organizations working in consultative or monitoring capacities. The question is no longer whether ransomware actors are aware of your industry. They are. The question is whether your defenses match the threat.
The Four Traditional Pillars Are Not Enough Anymore
Most small and mid-size energy sector businesses built their IT security programs around four foundational practices. However, ransomware defense for energy companies now requires protections that extend well beyond these traditional controls. These are real, these are important, and you should absolutely still be doing all of them. But they are not sufficient on their own — and the gap between these four pillars and what modern ransomware defense requires is exactly where attacks succeed.
Pillar 1 — Patching
Patching unaddressed software vulnerabilities is essential, and unpatched systems remain one of the top ransomware entry points. But patching alone does not stop credential-based attacks, does not detect lateral movement after a breach, and does not protect systems that cannot be patched on a standard cycle — like legacy operational technology or third-party managed platforms.
Pillar 2 — Antivirus
Traditional signature-based antivirus catches known malware. Modern ransomware often evades traditional antivirus by design. Attackers also use living-off-the-land techniques to bypass antivirus detection. Instead of deploying new malware files, they rely on legitimate system tools already present on your machines. Endpoint detection and response (EDR) has largely replaced antivirus as the relevant standard, and even EDR requires human oversight to be effective.
Pillar 3 — Firewall
A perimeter firewall is a necessary baseline control. But as we discussed in August, your perimeter is no longer a clean boundary. Today’s traffic patterns do not fit neatly into a traditional inside/outside firewall model. Transport drivers connect from the road. Employees and consultants work from home offices or globally dispersed locations. Third-party vendors also access systems remotely. Once an attacker is inside — through a phishing email, a compromised credential, or a vendor connection — the firewall is largely irrelevant to what happens next.
Pillar 4 — Backup
Backup is your last line of defense and a non-negotiable component of ransomware resilience. But backup alone does not prevent an attack. It does not stop double extortion threats where data has already been exfiltrated before encryption. It does not recover fast enough if the backup environment itself has been compromised. And if you have not tested your recovery process recently, you do not actually know whether it works.
These four pillars are the floor. Modern ransomware defense requires a multi-layered architecture built on top of them.
The Distributed Reality of Energy Operations
One of the biggest challenges in ransomware defense for energy companies is that operations are fundamentally distributed, creating an attack surface at every connection point.
Consider the range of access scenarios a typical energy company manages on any given day:
Drivers and field personnel connecting dispatch apps, compliance reporting tools, and communication platforms from tablets or phones — often from truck stops, distribution points, rail yards, or customer sites, frequently over public or semi-trusted networks.
Terminal and site operations staff who may access inventory management, custody transfer systems, or scheduling platforms from on-site workstations or remotely, often connecting to cloud-hosted applications that live outside the corporate network entirely.
Upstream professionals who work globally or from remote locations, often moving between client sites, home offices, and field locations. These individuals may need access to monitoring dashboards, reporting systems, or shared collaborative platforms across multiple organizations simultaneously.
Consultants and contractors who bring their own devices. This is one of the highest-risk access patterns in any energy organization. A consultant with legitimate SharePoint access can still represent an uncontrolled entry point into your environment. Their personal laptop may lack current patches, device management, or corporate endpoint security. Their device may be perfectly clean today, but a credential-harvesting attack could compromise it tomorrow — and if they have access to your systems, that access is now potentially in the hands of a threat actor.
Vendor and third-party connections for terminal automation, fleet management, railcar tracking, ERP integrations, and compliance platforms — each create a permanent or semi-permanent access pathway that your team must scope correctly and monitor continuously.
Ransomware actors understand distributed environments. They are patient. They will look for the weakest connection point. It may be a forgotten vendor credential, an unmanaged contractor device, or a phishing email sent to a remote employee. Attackers can then use that entry point to establish persistence before you ever see the attack coming.
The Compliance Pressure You Did Not Plan For
There is a dynamic we see frequently with growing energy companies that does not get discussed enough in cybersecurity conversations: compliance creep.
Your company may have operated for years with a solid operational focus, building the business, growing the customer base, adding staff and locations. Your team has managed security with the four pillars in place, perhaps some endpoint tools, and a reasonable backup strategy. No major incidents. Things feel stable.
Then an RFP lands on your desk. A major pipeline operator, a downstream refinery, a logistics customer, or a government agency wants to know about your cybersecurity program. The RFP includes a section requiring alignment with NIST CSF, ISO 27001 certification, SOC 2, or CMMC, depending on whether any government-adjacent contracts are in the picture.
The due date is in six weeks.
Why Waiting for the RFP Is Too Late
This is compliance creep. It is also one of the most stressful situations we encounter with energy sector companies. Often, they call us after the RFP has already arrived. Because here is the hard truth: you cannot start a NIST CSF alignment journey or an ISO 27001 certification process in six weeks and have something meaningful to present. These programs can take months or even years to complete. They require assessments, gap remediation, policy development, control implementation, and staff training. Some also require third-party audits and attestation.
The organizations that answer these RFPs confidently are the ones that started their compliance journey before the RFP required it.
Build Your Security Framework Before the RFP Arrives
This is not about being over-prepared. As energy companies grow, their compliance requirements grow with them. New customers, larger contracts, and regulated markets can all introduce additional requirements. Those expectations often arrive on someone else’s timeline, not yours. The energy companies that treat compliance as a business growth investment, rather than a reactive burden, are the ones that win the contracts and build the customer relationships that require it.
If your company does not yet have a defined security framework — a documented approach to NIST CSF, a risk assessment cadence, a written incident response plan, a vendor security review process — the time to start is before the RFP, not after. If you do have a framework, now is the time to evaluate whether it is actually being operated, not just documented.
What a Layered Ransomware Defense Actually Looks Like
Building on the Zero Trust architecture foundation from August, effective ransomware defense for energy companies requires a meaningful, layered security program designed for distributed operations and lean IT teams.
Layer 1 — Identity and Access Control
As emphasized in August: start with identity. MFA on every system. Privileged access management that limits which accounts can reach sensitive systems. Access reviews that remove stale credentials — including former employees, inactive vendors, and contractors whose engagements have ended. Conditional access policies are especially important for contractors and consultants using personal devices. These policies can check device health before granting access to corporate platforms like SharePoint or your ERP.
Layer 2 — Endpoint Detection and Response
Replace legacy antivirus with EDR across every managed device. EDR detects behavioral anomalies, not just known malware signatures. It can also identify attackers moving laterally through your environment before they reach critical systems. Pair EDR with a managed detection and response (MDR) capability so that alerts are reviewed by human analysts, not just automated rules that can be tuned to miss threats.
Layer 3 — Email and Phishing Defense
The majority of ransomware attacks begin with a phishing email. Advanced email filtering, sandboxed attachment analysis, and simulated phishing training for all staff — including remote employees and contractors — are foundational controls that directly intercept the most common entry point. Train your team to treat unexpected attachments and login requests as threats until proven otherwise.
Layer 4 — Network Segmentation and Zero Trust Access
Segment your environment so that a compromised endpoint in one area of the business cannot freely access systems in another. Apply Zero Trust Network Access principles — as discussed in August — to replace VPN-style broad network access with application-specific, identity-verified connections for remote staff, field personnel, and vendors. When a contractor’s device is compromised, they should reach the SharePoint site they are authorized to use — not the network broadly.
Layer 5 — Immutable, Tested Backups
The 3-2-1 backup strategy — three copies, two different media, one offsite — remains the baseline. But the critical additions for ransomware resilience are immutability (a copy that cannot be modified or deleted by a ransomware payload, even one that has compromised your backup administrator’s credentials) and regular recovery testing. If you cannot restore critical systems within a defined recovery time objective, your backup strategy is theoretical rather than operational.
Layer 6 — Incident Response Planning
Incident response is a critical part of ransomware defense for energy companies. When ransomware strikes, response time matters. A fast, well-executed response can make the difference between a recoverable incident and a business-threatening crisis. An incident response plan requires more than documentation. Your team should regularly review the plan, test it through tabletop exercises, and communicated to key personnel. A plan that sits untouched in a folder offers little value during an actual attack.
At a minimum, your plan should define who needs notification and when. It should identify which systems your team must isolate and how. It should also establish who has authority to make ransom-related decisions. Finally, the plan should outline how your organization will communicate with customers, regulators, and partners during an incident.
From the Channel Stage: A Different Kind of Security Conversation
In September, I will be preparing for a different kind of stage appearance — one that connects to cybersecurity in a way that may not be immediately obvious. At ChannelPro LIVE: Dallas on October 13–14, 2026 at the Renaissance Dallas North, I will be joining Neil Medwed (VP of Corporate Development and M&A at Meriplex) (https://www.linkedin.com/in/neilmedwed/) and Chris Buckingham (Founder and Principal Advisor at SolveCXO) (https://www.linkedin.com/in/chbuckingham/) on a panel titled “Expert Tips to Boost Profits: Start by Cutting Costs.”
The session link is here: ChannelPro LIVE: Dallas 2026
On the surface, profitability and cost management might seem like a separate conversation from cybersecurity. In practice, they are deeply connected — and here is why these matters to our energy sector clients.
Why a Leaner Security Stack Can Strengthen Cybersecurity
At Intelos, we are rigorous about tool stack discipline. We evaluate every tool we deploy against two criteria: does it meaningfully reduce risk or improve outcomes for our clients, and is it cost-justified relative to the alternatives?
Tool stack bloat — layering security products that overlap in function, that generate noise without improving detection, or that create their own management burden — is a real problem in managed security. Bloated tool stacks are harder to manage, create configuration drift that introduces vulnerabilities, and divert attention from the controls that actually matter.
How Security Efficiency Benefits Energy Companies
The same discipline that drives margin improvement for an MSP drives security posture improvement for the clients we serve. A lean, well-chosen, well-managed tool stack — operated proactively rather than reactively — produces better security outcomes than a sprawling collection of disconnected products that nobody has time to tune and monitor properly. When we optimize our service delivery for efficiency, the direct beneficiary is the energy company whose environment we manage: systems stay current, vulnerabilities get remediated before they become incidents, and the security program runs as an ongoing operation rather than a series of emergency responses.
Proactive, efficient managed services and strong cybersecurity are not in tension. They are the same thing, executed well.
Coming Up in October: Cybersecurity Awareness Month
In October, we will close out the core of this security series with a Cybersecurity Awareness Month piece that brings together the themes from August and September — Zero Trust architecture, ransomware defense, and what “security-first” really means for energy companies navigating a complex and evolving threat landscape. We will also be sharing some exciting news about Intelos’s own security program — a milestone we have been working toward that we believe meaningfully distinguishes our practice and directly benefits the clients who trust us with their most critical systems.
Stay tuned. October is going to be a good month.
The Bottom Line
Ransomware has evolved, and ransomware defense for energy companies must evolve with it. The four traditional pillars of patching, antivirus, firewall, and backup remain important — but they are the floor, not the ceiling. Energy sector companies operating across distributed environments, with remote staff, global consultants, contractor-owned devices, and third-party vendor connections, face an attack surface that demands a layered, Zero Trust-informed defense strategy.
And for the companies that have not yet started a compliance journey: do not wait for the RFP. The organizations that will answer those questions confidently in the next contract cycle are the ones that are building their security programs today, on their own timeline, rather than scrambling to catch up on someone else’s.
Ready to assess your ransomware resilience? Visit intelos.com or reach out to our team to start the conversation. We will help you understand where your defenses stand, where the gaps are, and what a realistic path forward looks like for a company your size.
James Wroten is the CEO of Intelos, a managed service provider specializing in cybersecurity and IT solutions for energy sector companies. This article is part of Intelos’s ongoing cybersecurity series for 2026.
