The grid is evolving rapidly, but cyber security visibility is struggling to keep pace. (Image: Fortinet) South Africa is well on its way to 500 days without load-shedding. It is the kind of number that gets read as good news, and it is – but it also marks a system that has changed faster than almost anyone watching it can keep track of. Nearly 7.5GW of private power has been added to the grid since regulatory reform opened the door to it, worth an estimated R158 billion. Eskom has rolled out at least 500 000 smart meters, with 6 million more coming. A R1 trillion infrastructure programme is under way to carry all of it. The grid that has kept the lights on this long is not the grid South Africa had five years ago.But that doesn’t necessarily mean the various custodians of each part of the grid can see every part they need to. Eight in 10 of South Africa's own energy security leaders acknowledged in a live poll by Fortinet this July that they don't have full visibility into their own operational technology (OT) environment.I work on the OT side of this problem, which means my job is to worry about the industrial control systems and physical infrastructure underneath the headline numbers. The thing is, every one of those additions is also a doorway that expands the attack surface – an inadvertently exposed entry point for cyber attackers. From a rooftop solar installation reporting back to a monitoring platform, to a smart meter phoning home twice a day, or an independent power producer's control system talking to the national operator – each is a new point where the physical grid now touches the internet.I put that question to a room of security leaders directly, alongside independent energy analyst Chris Yelland and OT veteran Thapelo Seepe, on a webinar panel in July. Only 21% had real-time, integrated visibility into their own environment. Eighteen percent had none at all.A turbine that can be reached remotely is a physical object and not a data set living on an intangible digital island – and the same is true of a substation, a pump station or a dam wall. What may start as a network intrusion can these days quickly end as a fault on a transformer or a town without water. Widen the lens further and the exposure becomes operational, then national: a grid built to decentralise generation across hundreds of independent producers and prosumers has, in the same move, decentralised its own attack surface. By Yelland's estimate on the panel, that's two to three orders of magnitude more entry points than the grid carried a decade ago. South Africa has energy regulation, but it does not have a single body responsible for the cyber security of that energy system. The National Energy Regulator (NERSA) is, in its own design, an economic regulator, not a cyber authority, and any new mandate for it would have to move through Parliament before it existed – a regulator, as Yelland put it on the panel, is a creature of statute, which makes it a slow-moving one by nature. There is no mandatory OT asset inventory, and neither is there a fixed timeline for reporting an incident yet. What does currently exist is a collection of individual organisations, each securing their own piece of the system to their own standard, with no one yet clearly accountable for where those pieces join.The skills to close that gap are also in short supply. The CSIR's most recent national survey puts 63% of cyber security roles at South African organisations as partially or fully unfilled. For a sector already asking its people to secure systems that were – as Seepe pointed out with nearly two decades of insight from inside Eskom's OT environment – built without cyber security in mind, that is a structural issue resulting in a shortfall that is very difficult to manage. How many other organisations are living with exactly this uncertainty is one of the things our new research project is built to find out.When I asked the room in July who's held accountable for the cyber security of their industrial control systems, just over one in four – 26% – told me the honest answer was nobody in particular. Not the CISO, IT or engineering, and if you read that and immediately thought of your own environment, you’re not the only one, and that's precisely what our Digital Fault Lines survey is trying to map properly on a bigger scale.It takes about five minutes, every response is anonymous and everyone who takes part is first in line for the full, finished report, ahead of its public release. Contribute here.