Illustration: a scan film, in point clouds, of the places an energy or water business runs: a wind farm on a ridge, a grid control room, a substation at night, a solar park, a water pumping station, a gas pipeline at dusk and the Cantic mark. The labels show synthetic readings and addresses.
We break into your control room before a criminal does.
Through your contractors’ remote access to the machines behind your sites. With Fortify, we write the fix within 24 hours.
Energy and utilities
Every remote site is a way in.
Every line to the internet is a door.
Eclipse, our own model trained to attack, keeps going until it can prove full control.
In plain words: an attacker that works for your company.
How far Eclipse goes
- Website
- Apps
- Logins
- Cloud
- Servers
- Internal network
- Machines
What your business runs on
We know what your sites run on. So do criminals.
Outside firms
- Your IT provider
- Control systems integrator
- Wind and solar maintenance
- Telemetry provider
- Equipment makers’ support
Remote access
- VPN
- Remote desktop
- Vendor portals
- 4G routers
- Remote support
-
Control room
- SCADA servers
- Operator screens
- Data historian
- Alarms
-
Substation
- Protection relays
- Remote terminal units
- Communications gateway
-
Wind and solar farm
- Turbine controllers
- Solar inverters
- Remote monitoring portal
-
Water and pumping
- Pump controllers
- Chemical dosing
- Level and flow sensors
- Telemetry outstations
-
Office
- Customer portal
- Billing
- ERP
- Backups
-
Spain
-
Poland
More than 30 wind and solar farms, and a heat and power plant
Attackers damaged controllers and deleted files; the farms lost remote control, but production went on.
Sources CERT Polska Help Net Security
-
Mataró, Catalonia, Spain
Aigües de Mataró, a municipal water company
Corporate systems hit and customer data possibly exposed; the water supply kept running, it said.
Sources The Record (Recorded Future News) Escudo Digital Ara
Compared
This is not a yearly pentest.
| A normal pentest | Cantic |
|---|---|
| Once a year | Day and night, and on every change |
| A PDF weeks later | Proof as it happens, with a replay |
| Stops at the website | From the website to the server and the machine |
| You work out the fix | We write the fix within 24 hours |
| You hope it holds | We attack again to check it holds |
Under your control
Inside the rules you sign.
Guardrails and data privacy for power, water and the sites behind them.
Nothing runs until you sign
An authorisation and rules of engagement, signed by someone entitled to authorise the test.
Inside the limits you set
Your scope, hours and limits. It stops once it can prove control.
Stop it within 60 seconds
Rate-limited and time-boxed, so your systems do not slow down.
Every action on the record
Hashed and timestamped in a ledger you can inspect, and followed live.
A person on every critical finding
A named lead on our team.
No outside AI company sees your data
Eclipse is our own model, on our own servers.
Destroyed when the work is done
Deleted in several steps on our side; we do not keep it. First test reports: 14 days unless you subscribe.
Your IT provider gets the fix
Findings and fixes go to your own team or your IT provider.
Regulation
The rules an energy or water company answers to.
- NIS2 covers energy and water companies with 50 or more staff, or over €10 million in both turnover and balance sheet (Annex I). 1
- They must manage supply chain security and warn of a significant incident within 24 hours (Articles 21 and 23). 1
- In Spain, designated essential operators report incidents that could significantly disrupt the service through their CSIRT (Real Decreto-ley 12/2018). 2
Questions
What buyers ask us
- And the systems that run our sites?
- If a contractor’s login or an open page leads to your control systems, Eclipse tries it.
- Does it help with NIS2?
- Yes: every step is recorded, from the signed scope to the retest, but it does not certify compliance.
- An integrator already looks after our control systems. Why you?
- Your integrator and IT provider run your systems and we attack them: two different jobs.
How it starts
Your results in one day.
You sign the rules
An authorisation and rules of engagement, signed before anything runs.
Eclipse tests what is in scope
From the outside, the way an attacker would. There is nothing to install.
We put the findings on the table
In plain words, with what to do. Every finding comes with proof.
Sources
- EU Official Journal (publications.europa.eu), Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive), . Read on .
- Boletín Oficial del Estado (BOE), Real Decreto-ley 12/2018, de 7 de septiembre, de seguridad de las redes y sistemas de información, . Read on .