Cybersecurity has moved from the compliance desk to the control room. Across gas and liquids pipeline networks, operators now treat cyber resilience as an operational discipline — on par with pressure management, pigging schedules, and overpressure protection — rather than a back-office information-technology concern.

The shift follows a period in which intrusion attempts against industrial control systems have grown in frequency and sophistication. Attackers increasingly target the operational technology layer: SCADA platforms, programmable logic controllers at compressor and pump stations, and the telemetry links that carry valve and pressure data back to dispatch centers. A successful intrusion at that layer does not merely steal data. It can force a shutdown, and a shutdown on a trunkline ripples straight into refinery feedslates, terminal inventories, and nominated volumes.

Where the exposure sits

Pipeline networks present a wide attack surface by their nature. A single system can span thousands of kilometres of right-of-way, dozens of unmanned compressor and pump stations, and hundreds of remote terminal connections. Each remote site is a potential entry point. Many legacy installations still run control hardware and software versions that predate modern security architecture, and retrofitting segmentation onto a live system — without interrupting throughput — demands careful change management and extended maintenance windows.

The industry response has converged on several practices. Network segmentation between corporate IT and operational technology environments limits lateral movement once an attacker gains a foothold. Continuous monitoring of control-system traffic flags anomalous commands before they reach field devices. Strict access control and multi-factor authentication for vendors and remote engineers closes the most commonly abused pathway. And disaster-recovery planning now extends beyond physical incidents to include restoration of control-system configurations from clean backups, with rehearsed manual-operation procedures as the fallback.

Resilience as the design goal

Security vendors and industry bodies frame the objective in one word: resilience. No operator can guarantee that an intrusion attempt never succeeds. The measurable goal is rapid detection, contained impact, and fast restoration of safe operations. That means identifying which assets are mission-critical — mainline valves, compressor controls, metering at custody-transfer points — and hardening those first, rather than spreading investment thinly across every connected device.

The Colonial Pipeline ransomware attack of 2021 remains the reference case for what is at stake. The operator shut down the entire system as a precaution, halting deliveries along a major products artery serving the US East Coast and triggering localized fuel shortages before restart. The lesson operators drew was not only about defense, but about incident response: the speed and confidence with which a company can assess compromise and restart safely determines the commercial and public cost of an event.

Regulators have reinforced the point. In the United States, the Transportation Security Administration has issued successive security directives covering pipeline operators, mandating incident-response plans, vulnerability assessments, and network-design measures. The EU's network and information security regime imposes comparable obligations on energy infrastructure. Compliance deadlines now shape budgeting cycles much as integrity-management regulations once did.

What to watch

The watch items are regulatory and operational. Operators face continuing tightening of security-directive requirements, particularly around control-system segmentation and incident reporting timelines. On the technology side, watch for broader deployment of anomaly-detection tools purpose-built for OT environments and for the slow replacement of legacy control hardware at stations. For midstream companies, cyber resilience is becoming a factor counterparties weigh — insurers in coverage terms, and shippers in counterparty risk — alongside traditional metrics of throughput and tariff.