A midstream oil company was increasingly concerned about its exposure to cyber threats, particularly in the wake of high-profile cyber incidents such as the Colonial Pipeline ransomware attack. Through an ongoing strategic partnership with Kroll that included a combined operational technology (OT) and IT security architecture review, Operationally Critical Business Application (OCBA) penetration testing and a cloud security configuration review, the company benefits from enhanced detection capabilities and assured defense against increasing threats to the oil and gas sector. By uncovering both technical vulnerabilities and security architecture issues within a highly complex operational and security environment, and a politically sensitive setting, Kroll has helped to significantly reduce the risk of disruption to critical infrastructure.
Offensive Security
March 3, 2026
Combining Offsec and OT Expertise to Strengthen a Major Oil Pipeline Against Security Attacks
Overview
Industry
- Midstream (Oil & Gas)
Challenges
- Complex OT and IT environment
- Increasing threats to industry
- Limited insight into hidden and potential vulnerabilities
- Lack of actionable steps to address risk
Kroll Services
- OT security architecture review
- Penetration testing
Impact
- Advanced cybersecurity resilience
- Strategic security partnership
- Structured mitigation plan
- Enhanced security operations center (SOC) capabilities
The Challenge
Concerned about increasing disruption to the oil and gas sector by incidents such as the 2021 ransomware attack on Colonial Pipeline, the internal security team at a major oil pipeline company wanted to better understand its existing and potential vulnerabilities. The objective was more complicated to achieve due to an extensive, heterogeneous environment that included remote field assets (physical and online infrastructure), converged OT/IT networks, and a mix of legacy and modern systems. This posed a challenge in accurate inventorying, exposure assessment, and risk prioritization.
With a vital national resource at stake, the company also needed to ensure that any security assessments undertaken would not risk compromising operational stability. They would also need to fully meet all relevant industry regulations and guidelines. The company initially decided that a series of red teaming exercises would be the best first step.
Kroll’s Solution
Kroll worked closely with the client to discuss options and identified that the most beneficial assessment at this stage would be a security architecture review of its OT environment. This niche requirement called for Kroll’s combined expertise in offensive and OT security, including specialist knowledge of cybersecurity requirements for pipelines, such as TSA Cybersecurity Directive, relevant aspects of NIST, and ISA/IEC 62443.
The OT Security Architecture Review, aligned to ISA/IEC 62443, followed a structured assessment of the current OT environment against the standard’s foundational requirements and zone/conduit model. The process included asset and network architecture analysis, review of policies and controls, validation of segmentation and access paths. Key outcomes included identified gaps against 62443 requirements, prioritized remediation actions, and a risk-informed roadmap to strengthen segmentation (micro-segmentation), access control, monitoring and resilience across the OT environment.
Kroll conducted a comprehensive assessment of the client’s internet-facing network to uncover potential security weaknesses. The objective was to determine whether any part of the defined scope could be exploited by malicious actors to gain unauthorized access. This was linked to its Operationally Critical Business Application (OCBA) which integrates with operational measurements for billing and revenue settlement. The application is a feature-rich business platform with a web interface used by customers and select employees to support operational and financial processes.
Kroll also conducted a comprehensive penetration test of the client’s OCBA, taking a significantly deeper approach than a standard black-box assessment. Given the application’s operational and financial importance, the testing methodology was tailored to achieve maximum coverage and meaningful risk insight. Unlike typical assessments that rely solely on external interaction, this engagement incorporated source code-assisted testing, with the Kroll team providing access to both the application’s source code and a live application instance.
By leveraging a structured combination of white-box and grey-box testing techniques, Kroll was able to analyze application logic, authentication workflows, data handling mechanisms and internal trust relationships at a granular level. This approach allowed the team to identify realistic attack paths that could be exploited by external adversaries. The team uncovered systemic weaknesses, including legacy code dependencies and architectural patterns that were effectively undermining or bypassing built-in security controls.
In addition to external testing, Kroll evaluated the application from an internal threat perspective, simulating scenarios in which an employee account or a connected system was compromised. This approach provided insight into how insider threat, privilege escalation, lateral movement, and misuse of trusted access could impact the application’s integrity and business processes. Kroll identified numerous vulnerabilities rooted in legacy components, implicit trust relationships and architectural design patterns that increased systemic risk. Many of the issues were indicative of broader architectural gaps within the client’s codebase and application framework. Addressing these findings required strategic guidance on phased remediation, including architectural hardening, improved access control models and secure coding practices.
The client had previously worked with another provider on a cloud security assessment. However, they had not provided any actionable steps to enable the client to improve its cloud security posture. After exploring the company’s priorities, Kroll completed a cloud configuration assessment and leveraged the adversarial cloud penetration testing approach to identify multiple realistic exploitable and potential attack paths. This was focused on specific areas, such as evaluating the security of the company’s Azure cloud environment and exploring risks from an account breach perspective, in which an employee or developer's account has been compromised. After the assessment, Kroll provided the company’s executive and security team with advice and actionable next steps along with prioritized short-to-long-term strategic recommendations.
Following the OT security review and cloud security engagement, the pipeline company’s security leadership needed a clear and consolidated view of the risks and recommendations to present to their executive leadership. Kroll partnered with the team to develop a structured mitigation plan. As a result, leadership was equipped with a defensible roadmap—clearly defining near-term controls, medium-term improvements, and long-term modernization priorities—providing confidence that cybersecurity risks across both OT and cloud environments were being managed in a structured and measurable manner.
The pipeline company continues to engage Kroll to mature its overall security posture. Building on earlier engagements, the client engaged Kroll to conduct a C2M2-based OT maturity assessment. This initiative reflects the organization’s commitment to advancing from reactive risk mitigation toward structured, benchmarked cybersecurity capability development. Future engagements under discussion include targeted offensive security testing such as purple teaming across both IT and OT environments, vulnerabilities management and architecture hardening within operational systems, and long-term resilience planning.
The Benefits
Strategic Partnership
Through a structured sequence of OT assessments and penetration testing, mitigation planning, and executive advisory, the pipeline company established a long-term, strategic security partnership with Kroll. Rather than treating cybersecurity as a series of isolated engagements, the organization now operates with a cohesive, forward-looking security program strategy—strengthening resilience in a complex and highly regulated environment.
Integrated Offensive and OT Security Expertise
With Operational Technology at the core of the company’s business, Kroll’s integrated expertise across offensive security, OT security architecture and cloud risk enabled a comprehensive evaluation of both business and control environments. By working closely together, Kroll’s OT architecture and red team experts ensured that recommendations covered both the compliance aspects specific to OT environments and pipeline regulations. It also meant that changes and controls would be effective against advanced threat actors likely to target this infrastructure, and practical to implement within an OT environment.
Actionable, Prioritized Risk Reduction
Kroll translated technical findings into business-relevant insights and prioritized remediation actions to equip the client with a structured roadmap.
Strengthened Detection and Response Readiness
The detailed testing and architectural analysis completed by Kroll enhanced the effectiveness of the company’s Security Operations Center (SOC). With deeper visibility into application, host, OT, and cloud attack paths, the SOC is now better positioned to detect anomalous behavior, investigate incidents more efficiently, and respond with greater precision—reducing potential operational impact.
Learn More About Kroll’s Offensive Security Services and OT Security Services
Stay Ahead with Kroll
Cyber and Data Resilience
Kroll merges elite security and data risk expertise with frontline intelligence from thousands of incident responses and regulatory compliance, financial crime and due diligence engagements to make our clients more cyber- resilient.
Threat Exposure Management
Kroll’s field-proven cyber security assessment and testing solutions help identify, evaluate and prioritize risks to people, data, operations and technologies worldwide.
Penetration Testing Services
Validate your cyber defenses against real-world threats. Kroll’s world-class penetration testing services bring together front-line threat intelligence, thousands of hours of cyber security assessments completed each year and a team of certified cyber experts — the foundation for our sophisticated and scalable approach.
Red Team Security Services
Red team security services from Kroll go beyond traditional penetration testing, leveraging our frontline threat intelligence and the adversarial mindset used by threat actors to push the limits of your information security controls.
Cloud Security Services
Kroll’s multi-layered approach to cloud security consulting services merges our industry-leading team of AWS and Azure-certified architects, cloud security experts and unrivalled incident expertise.
OT Security
Safeguard your most critical systems against cyber threats with Kroll’s comprehensive OT security services, ensuring visibility, business continuity and resilience.