Operational Technology Cybersecurity: A Strategic and Priority for EDF
As these systems increasingly connect with IT, enable remote supervision, and harness data analytics, they open up new possibilities—while also becoming more exposed to cyber threats. This IT/OT convergence brings operational benefits, but it also expands the attack surface. A concrete example of managed interconnection: we have connected certain OT supervisory systems to secure IT platforms to optimize predictive maintenance—while upholding strict segmentation and monitoring requirements. The result: tangible operational gains without compromising security. Cyber threats are now real, persistent, and sometimes invisible. They target industrial environments that are essential to our daily lives.
In response, EDF is structuring a tailored, comprehensive approach, grounded in local presence. A dedicated OT governance model has been implemented, built around an active professional community and the Cyber Excellence Center (CEC), which unifies the group’s initiatives, expertise, and tools. The goal: to build a robust security foundation aligned with international standards (IEC 62443, Purdue model, etc.), while respecting on-the-ground operational constraints. This approach is also deployed internationally. We work closely with our subsidiaries (Luminus, Edison, EDF UK, EDF Renewables, PEI, etc.) to harmonize OT requirements, while accounting for local regulatory and operational specificities.
Participating in the InCyber Forum for regions allows us to share our convictions and strengthen collaboration. OT cybersecurity is not just a technical challenge—it is strategic, collective, and regional. It requires continuous dialogue among industry players, suppliers, institutions, and local authorities. Only through this joint effort can we build a secure, sustainable, and trusted cybersecurity model.
Our Key Priorities in the Coming Years:
- Strengthen monitoring of our OT environments
- Integrate security from the design phase of industrial projects
- Support the upskilling of our teams
- Anticipate the impact of emerging regulations such as REC, NIS2, and the Cyber Resilience Act
We are also evolving our training programs to include emerging topics like AI, physical/logical security, and post-quantum cybersecurity, to equip our teams against future threats. The upcoming Group Cyber OT Seminar—with participation from Framatome and Arabelle Solutions—will be a valuable opportunity to strengthen these partnerships through hands-on workshops and knowledge sharing.
Cyber Crisis Preparedness is another key pillar of resilience. We are exploring emerging technologies—such as embedded AI for behavioral detection, industrial network micro-segmentation, and post-quantum cryptography—to anticipate tomorrow’s threats while ensuring the robustness of critical systems.
Operational Technology cybersecurity has become an industrial imperative. It is central to performance, to the energy transition, and to the trust we must earn from our customers, partners, and society at large.
Interview: Jean-Marc Autret, Group OT CISO, EDF
InCyber News: OT systems control critical infrastructure. Can you remind us of the specific cybersecurity challenges they pose for a group like EDF?
Jean-Marc Autret: OT systems control our industrial infrastructure—production, transmission, distribution. Their security is directly tied to safety, service continuity, and human protection. These systems, once isolated, are now increasingly interconnected, exposing our critical infrastructure to growing cyber risks. We must ensure end-to-end resilience, integrating cybersecurity from design through to operations—across the entire lifecycle.
InCyber News: How is EDF structuring its response to these challenges?
Jean-Marc Autret: We have established a dedicated OT governance framework, led by a community of experts and organized along industrial business lines. It relies on the Cyber Excellence Center (CEC), which plays a central role in standardizing practices, sharing tools, and supporting our entities. The objective is to build a shared security foundation for our OT systems, while accounting for their local specificities.
InCyber News: You’re attending the InCyber Forum for territories—what value do you see in these events for a major group like EDF?
Jean-Marc Autret: These events facilitate dialogue between institutions, industry players, and local authorities. For a large industrial group like ours, it’s a chance to share our practices, hear feedback from the field, and strengthen collaboration. OT cybersecurity cannot be tackled in isolation. It requires ongoing exchanges with partners, suppliers, and regional stakeholders—especially when we share infrastructure or supply chains.
InCyber News: What are your current priorities for advancing OT cybersecurity?
Jean-Marc Autret: We’re working on several key areas:
- Adapting our frameworks to comply with new European regulations (such as NIS2, REC, and the Cyber Resilience Act), which raise the bar and drive innovation
- Enhancing OT detection and monitoring
- Embedding cybersecurity in our industrial projects
- Developing team capabilities
Cyber resilience also depends on active crisis preparedness—in coordination with both internal and external partners. We’ve also deployed a unified IT/OT cyber monitoring foundation, capable of analyzing industrial data flows in real time. This system, developed with the CEC, respects the unique operational and regulatory constraints of each business line while providing unified detection and response capabilities.
InCyber News: Any final thoughts on the future of OT cybersecurity?
Jean-Marc Autret: The future lies in embedded security—owned by the business, supported by experts, and fully integrated into industrial strategy. OT cybersecurity is no longer optional: it’s a collective imperative, central to performance and trust. It must be viewed from the outset as a strategic enabler.