Critical infrastructure and energy
For managing directors, heads of IT and information security officers at energy suppliers, grid operators and other critical infrastructure operators. We test how far an attacker would get through Active Directory, Entra ID, Microsoft 365 and Azure, harden admin accounts, remote access and logging, and evidence every measure. At the end you know your attack paths and have evidence that auditors can follow.
Threat situation
The attacks in Poland show that well-known weaknesses are enough: exposed remote access, default passwords and compromised admin accounts.
When a grid or a combined heat and power plant fails, households, businesses and other critical services feel it immediately. Anyone who wants to put pressure on a country or a company finds the greatest leverage here.
In February 2024, US agencies warned that a state-sponsored group was establishing itself in the IT networks of critical infrastructure, including energy, to be able to disrupt or destroy in a crisis. In some networks it stayed undetected for at least five years.
On 29 December 2025, attackers in Poland targeted at least 30 wind and solar farms and a combined heat and power plant that supplies heat to almost half a million customers. The sole aim was to destroy data and devices.
Many small installations need remote access. In Poland, the VPN access points of the farms were reachable from the internet without MFA, devices ran with default passwords, and the same credentials were often used at several sites.
At the Polish heat and power plant, the attackers took over privileged Active Directory accounts and distributed their malware via Group Policy. The first traces dated back months. The EDR solution stopped the attack there.
Between July 2024 and June 2025, critical infrastructure operators in the German energy sector reported 153 disruptions to the BSI, more than almost any other sector. Not every disruption is an attack, but each one shows how closely operations and IT are linked.
Case studies
White-box penetration test of Azure, Entra ID and Active Directory from the perspective of an ordinary employee account: 5 critical and 10 high findings, prioritised by exploitability, with a management summary for leadership.
Read the case studySecurity principles, access controls and secure integration patterns for a central enterprise platform, translating the controls from group policies into architecture decisions.
Read the case studyThe first step is the fixed-price Security Assessment or a penetration test. Afterwards you decide whether we implement and operate, or your IT takes over.
How far would an attacker get with an ordinary account? As a white-box test for hybrid environments with Active Directory, Entra ID and Azure.
More on: Penetration testService accounts, delegations, certificate services, Group Policy, tiering and Entra Connect from an attacker's perspective.
More on: Active Directory Security AssessmentMicrosoft 365, Entra ID, Intune and Azure reviewed read-only, every finding mapped to NIS2, ISO/IEC 27001 and BSI IT-Grundschutz.
More on: Security AssessmentTarget architecture for identities and privileged access based on Zero Trust principles, with a staged implementation plan.
More on: Security architectureMonitoring with Defender XDR and Microsoft Sentinel, incident response and monthly evidence per control.
More on: Managed securityWenske Cyber Solutions (WCS) reviews and hardens Active Directory, Entra ID, Microsoft 365, Intune and Azure at critical infrastructure operators. For a gas grid operator with 1,500 users, WCS carried out a white-box penetration test of the hybrid environment, and for a transmission system operator it helped shape the security architecture of an enterprise platform.
Because an outage affects many people at the same time and so creates pressure. State-sponsored groups therefore establish themselves in networks in advance, as US agencies reported in February 2024. In December 2025, wind and solar farms and a heat and power plant in Poland were deliberately sabotaged. On top of that come many decentralised installations with remote access, which are often less well protected than headquarters.
The revised German BSI Act (BSIG) has applied since 6 December 2025. For energy supply networks and energy installations, the Federal Network Agency sets the requirements in IT security catalogues under § 5c of the Energy Industry Act (EnWG). Other critical infrastructure operators implement the measures under §§ 30 and 31 BSIG and evidence them every three years under § 39 BSIG. We assess which rule applies to your installations based on your information; this does not replace a legal review.
A white-box penetration test answers that. With full insight into architecture and configuration, we check which paths lead from an ordinary user or service account to domain admin, Global Administrator or Azure subscriptions. Every finding is rated by exploitability and comes with a recommendation.
With separate admin accounts without a mailbox, phishing-resistant sign-in, admin roles only on a time-limited basis through Privileged Identity Management, and a dedicated, hardened device for administration: the privileged access workstation. Whether physical or via Azure Virtual Desktop is covered in our blog article on privileged access workstations.
Our focus is the IT side: Active Directory, Entra ID, Microsoft 365 and Azure. Many attacks on operations start there, for example through remote access, admin accounts and Group Policy. Which transitions between the office network and operations we include is agreed with you before the test.
In a 30-minute introductory call we clarify the scope, followed by a fixed-price proposal for the Security Assessment or the penetration test.