Dragos Report: Remote Access Weakens Upstream Oil and Gas Security

Remote access vulnerabilities pose a critical security risk to upstream oil and gas operations, according to a report by Industrial Cyber. The outlet highlights that the sector’s reliance on unattended sites and remote connectivity creates significant exposure for control systems and operational data.

Industrial cybersecurity firm Dragos released its 2026 OT/ICS review, which identified remote access as a primary weak point. The report noted that 29% of oil and gas cases exhibited poor IT/OT segmentation. This figure represents the highest proportion of segmentation failures recorded across all industrial sectors in the review.

Context and Background

The upstream sector operates in remote and harsh environments, often relying on satellite, cellular, and radio links for communication. Wellheads, gathering systems, and offshore platforms frequently function with minimal on-site personnel or no staff at all. These communication pathways expand the attack surface for potential adversaries.

If a communication link is compromised, SCADA traffic and field devices can be intercepted, manipulated, or disrupted. Because few people are present on-site to notice anomalies, such intrusions can persist undetected for extended periods. The interconnections necessary for remote operation thus introduce significant security challenges.

Who Is Affected

Vendors and contractors require remote connections to maintain operations at unattended sites. Each session, whether through shared credentials, standing VPNs, or unmonitored third-party connections, creates a potential route into the control environment. Dragos observed that the VOLTZITE threat actor exploited these weaknesses by compromising cellular gateways throughout U.S. oil and gas infrastructure.

VOLTZITE subsequently moved undetected into engineering workstations, demonstrating the ease with which attackers can traverse poorly segmented networks. Centralized control further amplifies this risk. As local staff presence decreases, remote operations centers and their gateways become prime targets for adversaries seeking broad access.

A single point of access compromise can affect numerous wells simultaneously, magnifying the impact of any breach. The concentration of control functions in remote centers creates a high-value target for threat actors aiming to disrupt production or steal data.

What should you do?

Security leaders should prioritize strengthening remote access controls and improving network segmentation. Dragos recommends using authentication methods that are resistant to phishing attacks. Organizations should also ensure that remote connections pass through monitored and separated zones rather than connecting directly to OT networks.

Continuous monitoring is essential for detecting breaches quickly. However, a survey by Tosi of 100 U.S. upstream and midstream OT leaders revealed a gap between confidence and capability. While 87% of respondents were confident they could detect a breach within 24 hours, only 16% attributed that confidence to continuous OT monitoring.

This discrepancy suggests that many organizations may overestimate their detection capabilities. Relying on intermittent checks rather than continuous visibility leaves gaps that attackers like VOLTZITE can exploit. Implementing robust monitoring solutions can help close these visibility gaps.

What to do and how to stay safe: Dragos

• Implement phishing-resistant authentication for all remote access sessions to prevent credential theft.
• Ensure remote connections route through monitored, segmented zones rather than direct links to OT networks.
• Deploy continuous OT monitoring to improve breach detection capabilities and reduce reliance on manual checks.
• Review and restrict standing VPNs and shared credentials to minimize persistent access vectors.

Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What percentage of oil and gas cases had poor IT/OT segmentation?

Dragos found that 29% of oil and gas cases had poor IT/OT segmentation, the highest proportion among all sectors.

How did VOLTZITE compromise U.S. oil and gas infrastructure?

VOLTZITE compromised cellular gateways and moved undetected into engineering workstations within the infrastructure.

Do leaders feel confident in their breach detection abilities?

Yes, 87% of surveyed leaders were confident they could detect a breach within 24 hours, though few cited continuous monitoring.