Ampyx Cyber Blog
The Intersection of Regulation & Resilience
UEFI in OT: Hardware Trust, Secure Boot & CE Marking
Most industrial PCs and gateways in Europe run Unified Extensible Firmware Interface (UEFI) firmware that was shipped long before either of today's regulatory clocks started. This third report in the series explains where Secure Boot breaks down under real operational technology (OT) conditions, how the Cyber Resilience Act (CRA) divides responsibility for CE marking between component suppliers, equipment manufacturers, and operators, and what engineering and procurement teams can audit now under the revised Network and Information Security Directive (NIS2).
Firmware and Bootloader: The Verification Gap in OT Infrastructure
Proving that the code running on a field device is what the vendor shipped is one of the hardest problems in industrial security. This second report in the series compares four verification mechanisms, from SHA-256 hashing to remote attestation, and maps them to the revised Network and Information Security Directive (NIS2), the Cyber Resilience Act (CRA), and Germany's BSI Act. It also looks at what US utilities learned under NERC CIP, and which compensating controls work for legacy controllers that cannot verify their own firmware.
The Execution Layer Gap: Why European Critical Infrastructure May Be Looking at the Wrong Regulatory Clock
Many European critical infrastructure operators are planning around December 2027, when the Cyber Resilience Act (CRA) fully applies. Its vulnerability reporting duty under Article 14 took effect on September 11, 2026, and it covers products already deployed in the field. This Foundation report, the first in a six-part series, looks at why regulators are turning to the firmware and bootloader layer below the operating system, how the CRA and the revised Network and Information Security Directive (NIS2) reach it, and what Germany's implementation adds.
![Poland's Energy Sector Attack: When Cyber Sabotage Targets OT [Updated]](https://images.squarespace-cdn.com/content/v1/5f80bdfaeeac37068ed8c60e/1750463988120-77LW8AOEP96E0SZ38CV2/Deep+Dive.png)
Poland's Energy Sector Attack: When Cyber Sabotage Targets OT [Updated]
On December 29, 2025, Poland experienced coordinated destructive cyberattacks across 30+ wind/solar farms, a CHP plant, and manufacturing. Attackers exploited FortiGate devices without MFA, used default credentials on OT equipment, and deployed custom wiper malware designed to damage industrial controls. Every failure was preventable.
Cyber Stress Testing: Strengthening Cyber Resilience in the EU Energy Sector
As cyber threats grow more complex, the EU energy sector is turning to stress testing to bolster its resilience. This post explores ENISA’s 2025 Cyber Stress Test Handbook and how it helps energy providers simulate real-world attacks, uncover vulnerabilities, and strengthen defenses in alignment with NIS2, CER, and the Cyber Solidarity Act.
The European Union's Upgraded NIS2 Cybersecurity Framework
The European Union, with its commitment to digital governance and cyber protection, has recently updated its foundational cybersecurity framework, repealing the previous Network and Information Systems Directive (“NIS”) with the NIS2 Directive. Take a dive into the notable changes, implications, and suggested actions for businesses that fall under its scope.