Numbers That Matter
CrowdStrike says an attacker needs, on average, this many minutes to move from a first foothold to other systems.
What is 29 minutes? The fastest recorded was 27 seconds. Source: CrowdStrike 2026 Global Threat Report.
In 2015 and 2016, cyberattacks switched off customers’ power in this European country.
What is Ukraine? Attributed to the Sandworm group (ELECTRUM in Dragos naming).
Criminals use AI-cloned voices and video, known by this name, to impersonate executives and vendors.
What are deepfakes?
Nigeria’s NDPA, passed in 2023, requires notifying of a personal data breach within this many hours.
What is 72? Directly relevant to DisCos holding millions of customer records.
This extra login step, such as a hardware key or app approval, blocks most stolen-password attacks.
What is multi-factor authentication (MFA)?
In CrowdStrike’s 2026 data, about this percentage of vulnerabilities were exploited before they were publicly disclosed.
What is 42 percent? Accept 40 to 45. Source: CrowdStrike 2026 Global Threat Report.
Uganda’s grid operator UETCL suffered a suspected attack in August 2025 by Qilin, a gang known for this kind of file-locking extortion malware.
What is ransomware? Offline backups were the deciding factor in recovery.
The operator states a goal; the model scripts, adapts, and exploits
What is vibe hacking?
The CNII Order 2024 names this sector, which everyone in this room serves, as critical national information infrastructure.
What is Power and Energy?
Before acting on an urgent payment or remote access request, you call back on this kind of number.
What is a number you already hold (on file)?
Poland, December 2025: attackers reached more than this many wind and solar sites.
What is 30? Roughly 1.2 GW, about 5 percent of that grid, was put at risk. Sources: CERT Polska, Dragos.
Dragos called Poland’s December 2025 attack the first major one aimed at these, which include wind farms and solar plants.
What are distributed energy resources (DER)?
Unlike a chatbot that waits for instructions, this kind of AI sets sub-goals, uses tools and adapts when it is blocked.
What is agentic AI (an AI agent)?
This international standard series for industrial control security introduced “zones and conduits”.
What is IEC 62443?
Ransomware cannot encrypt this kind of backup because it is kept disconnected from the network.
What is an offline backup?
IBM’s 2026 breach study puts the global average cost of a data breach at about this many millions of US dollars.
What is about 5 ($4.99 million)? The energy sector average was $5.2 million. Source: IBM and Ponemon, July 2026.
What was the entry point in the Poland grid attack?
What is Internet-exposed FortiGate device?
In the GTG-1002 case disclosed by Anthropic in November 2025, an AI agent did this range of percent of the tactical work.
What is 80 to 90 percent?
The order that mandates the integration of grid-connected generating units into SCADA/EMS
What is Order NERC/2025/057?
Keeping the office network and the control network apart, with controlled paths between them, is called IT/OT this.
What is segmentation?
In Q1 2026, malware was blocked on this percentage of African industrial control computers, against 19.6 percent worldwide.
What is 27.4 percent? Accept 27. Source: Kaspersky ICS CERT.
Attackers settle in with valid credentials and admin tools, an approach known as living off the ___.
What is the land? CrowdStrike found 82 percent of detections were malware-free.
Software that chains the stages of an attack together automatically
What is agentic scaffolding?
Not our NERC: the US body with the same acronym publishes mandatory grid security standards known by these three letters.
What is CIP (Critical Infrastructure Protection)?
NIST CSF 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and this one.
What is Recover?