POINT

Feroz Khan, Head of IT Security, Compliance and Projects, TotalEnergies, on securing the energy sector in an AI-driven world.

Feroz Khan, Head of IT Security, Compliance and Projects, TotalEnergies

Ransomware groups, state-aligned actors, supply chain attacks and AIenabled fraud are all contributing to a more complex risk environment. For organisations responsible for critical infrastructure, cybersecurity is therefore no longer just about protecting data. It is about ensuring that essential services remain safe, reliable and resilient.

Our priorities reflect this shift. Protecting critical services remains fundamental, but we must also secure identities, reduce vulnerabilities, strengthen IT and OT segmentation, manage third-party risk and improve recovery readiness. Cybersecurity success is not measured only by whether an attack is prevented. It is also measured by how effectively an organisation limits the impact and continues operating safely.

Digital innovation is another important part of this discussion. Security should not be seen as an obstacle to transformation. In fact, innovation and cybersecurity should reinforce each other.

The most effective approach is to involve cybersecurity, OT engineering, operations, HSE and business teams from the design stage. Security controls are far more effective when they are integrated into digital programmes from the beginning rather than introduced shortly before deployment.

Risk-based controls such as segmentation, secure remote access, privileged access management, asset visibility and continuous monitoring can help organisations innovate while maintaining an appropriate level of protection. It is equally important to test degraded operating scenarios, so teams understand how systems will behave during disruption.

The aim is not to slow down innovation but to ensure that digital systems can fail safely, contain disruption and recover predictably.

The same principle applies to data and AI programmes. Cybersecurity and data protection need to be embedded from the start. Organisations should consider data classification, ownership, access, retention, privacy, architecture, supplier risk and secure operations throughout the lifecycle of every programme.

AI introduces new considerations. We need to understand how data is used, whether outputs can be trusted, which actions can be automated and where human oversight is required. At the same time, AI environments themselves must be protected, including data, models, prompts, APIs, agents and machine identities.

This broader risk landscape is also changing the role of the CISO. Prevention remains essential, but security leaders are increasingly expected to help organisations prepare for disruption, respond decisively, maintain critical services and recover securely.

Cybersecurity should therefore be assessed through three outcomes: reducing the frequency of incidents, limiting their impact and accelerating recovery.

However, resilience cannot belong to the CISO alone. It needs shared ownership across business, IT, OT, HSE, continuity, communications and executive leadership.

One of the most significant challenges is hidden resilience risk. Thirdparty dependencies, identity compromise, concentration risk and untested recovery assumptions can all become serious vulnerabilities.

Many organisations have backups and incident response plans, but fewer have tested whether they can restore operations at scale during a real crisis. Recovery plans are credible only when they have been exercised under realistic conditions, including the failure of key suppliers, technologies, people or communications.

AI is adding another dimension by increasing the speed of cyber threats. Machine-speed threats cannot be addressed using only human-speed processes. AI can support faster detection, correlation, investigation and containment, but accountable people must remain in control of decisions affecting critical operations.

Looking ahead, the energy industry will face deeper IT and OT convergence, AI-enabled attacks, supply chain concentration, identity risk, evolving regulation and continued skills shortages.

At TotalEnergies, we are addressing these challenges through stronger asset visibility, identity protection, segmentation, vulnerability and supplier risk management, secure-by-design transformation, AI governance, employee awareness and regular resilience exercises.

WWW. INTELLIGENTCISO. COM / MIDDLE-EAST 19