Pentest for Energy and Utilities (OT/SCADA)
Offensive security in OT, SCADA, smart grid and critical energy infrastructure environments.
Why now
The real pain
Generators, transmission and distribution companies are on the priority target list for nation-state actors. A SCADA attack can take a city offline — and ONS/ANEEL regulations don't forgive those caught unprotected.
Applicable regulation
/attack-surface
Vectors we test in energy & utilities
Every engagement is designed for your environment. The points below are part of our standard playbook for this sector — final scope is adapted to your stack and contract.
SCADA / DCS
Audit of Modbus, DNP3, IEC 60870-5, OPC-UA. Purdue Level 2/3 segmentation.
RTU and PLC
Firmware analysis, weak authentication, default credentials, cleartext communication.
Smart meter
AMI, PLC/RF communication, reading manipulation, end-of-meter fraud.
Digital substation
IEC 61850, GOOSE, Sampled Values, bus segregation.
Social engineering via OT
Targeted phishing against operators and field engineers.
/methodology
Genuinely manual pentest
Automated scanners find what's documented. Real attackers find what isn't. 90% of the work is manual — performed by specialists holding OSCP, CISSP, CRTO and GPEN.
01 · Reconnaissance
Target mapping, OSINT, footprint, sector-specific threat modeling.
02 · Discovery
Deep enumeration, complementary scanning, manual exposure identification.
03 · Exploitation
Manual validation with controlled PoC, finding chaining, escalation.
04 · Report
Executive + technical, step-by-step replication, mapped to applicable regulation.
/why-trust
Who has trusted our work
Team trained in IEC 62443 and SP 800-82.
Technical assessment recognized in highly regulated, mission-critical environments — the pentest that finds what nobody had found before.
Douglas Lopes
Founder · CEO · intrus.io
/faq
FAQ — Energy & Utilities
Do you touch live OT?
Not without a homologation environment. We work first on replicas/simulators and only touch production within windows approved by operations engineering.
Do you cover ONS/ANEEL?
Yes. We cover network procedures and ANEEL REH 22/2022 for the electric sector.
/contact
Ready for a serious pentest in energy & utilities?
Schedule a confidential meeting. Within 48h we'll send a proposal with scope, timeline and pricing.