Purvi Kay

Purvi Kay is the newly appointed chief information security officer of the National Energy System Operator (NESO).

Career path

In a first-person post published on NESO's own site, Kay wrote that she joined the operator after spending much of her career in national security and defence, and that although the energy sector was new to her, she found the underlying challenge familiar. She said that background taught her an important lesson: technology alone is not enough to secure a system. None of the material published so far names her specific prior employer, unit or title in that earlier career.

Approach to the new role

Kay argued that cyber security has too often been treated as something best left to IT departments to manage quietly, an approach she says is no longer appropriate given how far critical national infrastructure now depends on digital technology. In her words, "cyber resilience is key to operational resilience and is essential to protect the services that underpin our daily lives."

She wrote that organizations she considers best practice are willing to understand their risks in depth, test their assumptions, and prepare for disruption rather than assume it can always be prevented, treating cyber resilience as a shared responsibility built in from the start rather than added later. At NESO, she said the organization is embedding security by design into new technology, services and ways of operating from the earliest stages, and pointed to existing relationships among NESO, government, the energy regulator Ofgem and national security partners as a foundation for that work.

She also referenced a widely reported cyber attack that forced a British electricity generator offline for four days, noting that customers did not lose power and the wider electricity system remained secure, while still cautioning that the incident's significance and the appeal of energy infrastructure to cyber criminals should not be understated.