What Energy and Utilities Claims Reveal About Controls That Looked Fine on Paper
Attackers don’t need to defeat your controls if they can work around them. In Resilience’s claims data from oil and energy, utilities, and renewables clients, email compromise, ransomware, and vendor incidents all succeeded against controls that were already switched on, including MFA.
One in five claims started with email compromise, versus one in ten across the rest of our portfolio, and ransomware still drove about 70% of incurred losses. Clients with tested backups recovered without paying, and others kept production running on a segmented network.
Ariana Masole (Lockton) and Brandon Rojas (Resilience) will join moderator Si West (Resilience) to discuss the report’s findings and how to test your own controls against the failures in real claims.
About Speakers
Ariana Masole
Account Executive AVP, Lockton
Ariana Masole is an Assistant Vice President and Account Executive in the Pro Executive Practice at Lockton Companies. She oversees program placement analysis and client advisory analytics, providing assessments that help clients evaluate their insurance limits and coverage compared to industry peers.
Ariana specializes in cyber risk advisory and insurance placement for organizations within various sectors. She focuses on helping organizations navigate the intersection of cyber risk, operational resilience, and strategic risk transfer in an increasingly complex threat landscape shaped by geopolitical tensions, aging infrastructure, and accelerating digitization.
Before joining Lockton, Ariana served as the Energy, Power, and Utilities Cyber Industry Specialist for the U.S. and Canada at Marsh, where she focused on cyber liability for the energy sector. In that role, she collaborated with leading insurers to develop specialized consortiums and coverages tailored to the evolving risks and exposures of energy and power clients.
Ariana is recognized for her ability to influence insurer appetite and expand cyber coverage where exclusions were historically considered immovable.
Brandon Rojas
Technical Security Advisor
Brandon Rojas is a Technical Security Advisor on the Security Risk Services team at Resilience. His career began in utilities, first in the US Marine Corps and then at a water treatment plant, which provided him with an operational perspective before he transitioned into cybersecurity
He then moved into IT, gaining experience in cloud banking, healthcare, and IT auditing, where the primary concern is not simply whether a control exists, but whether it is effective. Brandon is currently a PhD student specializing in critical infrastructure.
Si West
Director of Cyber Resilience
Si West leverages over two decades of global security expertise to bridge the gap between technical risk and business strategy.
He partners directly with risk-focused CISOs to enable better decision-making while assisting brokers in mitigating client exposure. Si’s track record includes building out international security & risk services teams, advising on global underwriting teams, and developing critical incident response frameworks for large-scale, complex books of business. His credentials include 14 years of service in the Royal Marines, an NCSC Assured Instructor status, and an MSc in Cyber Security and Human Factors.
Any company that sells hardware or software with network connectivity into an EU member state has to report vulnerabilities and incidents affecting that product. The regulation calls these products with digital elements, and it applies to the manufacturer regardless of where the manufacturer is based, so a US firm with no EU presence is covered from the moment its first unit ships into the single market.