Test the grid
without tripping it.

Yes — and that constraint shapes the engagement from day one. On the operational technology side (substation bay-level IEDs, generating-unit DCS, pipeline RTUs, distribution feeder automation) the default posture is passive: span-port packet capture against IEC 61850 GOOSE / MMS, DNP3, Modbus TCP and OPC UA flows, vendor-manual review, configuration-export analysis from engineering workstations and HMI servers, and asset enumeration from the historian. Active testing is reserved for digital-substation test bays, factory-acceptance-test rigs, hardware-in-the-loop simulators, or planned outage windows agreed with the system operator and (where required) the load dispatcher. Rules of Engagement explicitly exclude anything that could trip a protection relay, mis-operate a breaker, drift a generation setpoint, or interfere with a safety-instrumented system on a hydrocarbon facility.

NERC CIP is the mandatory standard for the North-American Bulk Electric System — CIP-002 through CIP-014 with auditable controls per BES Cyber System impact rating (High / Medium / Low), enforced by the regional entities under FERC oversight. The engagement maps findings per CIP requirement: CIP-005 Electronic Security Perimeter, CIP-007 Systems Security Management, CIP-010 Configuration Change and Vulnerability Assessments (which itself mandates an active vulnerability assessment every 15 calendar months on High-impact BES Cyber Systems), CIP-011 Information Protection, CIP-013 Supply Chain Risk Management. IEC 62443 is the international standard used outside North America (and increasingly inside it as a technical reference) — zone-and-conduit modelling, Foundation Requirements FR1–FR7, Security Levels SL1–SL4 per zone. India's CEA Cyber Security in Power Sector Guidelines 2021 plus the CEA (Cyber Security in Power Sector) Regulations 2024 layer Indian-specific requirements on top — designated CISO, mandatory cyber crisis management plan, CERT-In incident reporting within six hours under the 2022 directions, and conformance audit against the CEA framework. We map findings to whichever set the asset owner is regulated under, and to ATT&CK for ICS regardless.

End-to-end. The meter (hardware tamper review of the metrology board, JTAG / UART / SWD exposure, firmware extraction via NAND or SPI dump, signed-firmware bypass attempts, optical-port (IEC 62056-21) and DLMS/COSEM authentication review, key-management review). The neighbourhood-area network (RF-mesh or PLC layer protocol analysis, key-derivation and join-process testing on Wi-SUN / 6LoWPAN / G3-PLC / Prime). The headend system (web and API testing against the AMI vendor stack — Itron, Landis+Gyr, Honeywell Elster, Secure Meters, HPL, Genus). The Meter Data Management System (authorisation between the DSO, the third-party MDM-as-a-service operator, and downstream billing). India-specific: alignment to the Smart Meter National Programme rollout, BIS IS 16444 / IS 15959 meter standards, and the Ministry of Power model technical specifications.

This is the dominant engagement driver today. The pattern: IT-side initial access (commodity phishing, exposed RDP, Citrix or VPN appliance CVE, public-record stolen-credential reuse) plus lateral movement through shared Active Directory, shared file servers, shared backup infrastructure, dual-homed engineering workstations and operator stations, vendor jump hosts with always-on access. The Colonial Pipeline 2021 incident, the Ukrainian power-grid attacks (BlackEnergy 2015, Industroyer 2016, Industroyer2 2022), the Saudi Aramco wiper events and Pipedream / Incontroller toolkit demonstrate the exact paths an adversary takes. AxVeil exercises that path against your environment under controlled conditions: no real ransomware payload, no destructive actions, but the full enumeration and pivot chain to a defined point in the OT estate, with detection-quality testing at every hop. The deliverable is a kill-chain reconstruction with prioritised segmentation, identity and detection-engineering remediations.

Renewables and DER assets sit at the awkward intersection of high deployment velocity, internet-exposed vendor cloud, OEM remote-access requirements and rapidly-evolving standards. We map the inverter and battery-management-system fleet (SMA, Sungrow, Huawei, Fronius, Enphase, Tesla, Fluence, Wartsila) and test the vendor cloud APIs that own remote control of those assets — historically a recurring source of fleet-wide compromise on the public record. EV-charging infrastructure is tested against OCPP 1.6 and 2.0.1, ISO 15118 (Plug-and-Charge) and the operator's CPO / CSMS stack. For UK / EU operators we map to NIS2 essential-entity obligations and ENISA guidance; for US-listed operators we add the SEC cyber-disclosure rule materiality assessment; for Indian DISCOMs and DER aggregators we map to CEA 2024, CERT-In and the Smart Meter National Programme alignment.