Major Regional Electric Utility

Introduction

A major regional utility provider delivers essential power and water services to millions of residents in the United States. As one of the larger utility organizations in the South Central region, uninterrupted service and safety are mission-critical—making cybersecurity a continuous priority.

This case study explores the utility’s specific security and compliance needs, their selection of Xage Security’s Zero Trust Secure Remote Access platform, and the outcomes of this deployment.

Requirements

The utility sought an advanced secure remote access (SRA) cybersecurity solution for employees and third-party partners that would ensure safe access to critical infrastructure. They required SRA, secure file transfer, and granular access control for operational technology (OT) assets. The solution also needed to support strict regulatory compliance requirements such as NERC CIP.

They additionally sought to improve user experience for employees and contractors. Their legacy setup involved complex configurations, multiple jump-box authentications, and unnecessary friction. A key requirement for the new solution was streamlined authentication—including support for multiple Active Directories (AD) and token-based multi-factor authentication (MFA).

Regulatory compliance to NERC CIP requirements remained central to their decision, and they needed a solution that would simplify audits and provide clear, identity-based access logs.

Outcomes

The utility selected Xage Security for its ability to deliver secure OT asset management through secure remote access, secure file transfer, and granular access controls. Xage was integrated into their critical infrastructure and deployed on-premises, with the flexibility to expand into private or hybrid cloud environments in the future. Other SRA solutions did not meet their requirements for on-premises deployment and NERC CIP regulatory compliance.

A VPN solution had been used previously as a temporary measure, but the utility sought to eliminate the cybersecurity risks associated with VPN access into critical environments. Xage provided a rapid, seamless path to Zero Trust-based secure remote access that eliminated the need for the VPN. Users now benefit from simplified authentication and improved operational efficiency, and administrators report fewer help-desk issues.

Xage also helps simplify NERC CIP compliance by offering easy auditability of identity-based access logs, including on devices that traditionally rely on shared credentials.

The decision to adopt Xage Security received broad internal support, including from executive leadership, and has since enabled the utility to enhance its overall cybersecurity posture, streamline operations and improve the user experience, ensure both internal and regulatory compliance, and maintain the high-quality service its communities rely on.