run by the underground systems. >> reporter: the malicious code identified as having played a role in ukraine's attack is the same code dhs recently admit is in hundreds if not thousands of u.s. computer systems that control critical infrastructure. the code known as black energy has been linked to russia. >> there are companies across the country and this is not just with respect to electricity companies, that don't fully appreciate the nature of the threat. >> reporter: 75% to 80% of the nation's critical infrastructure is owned and operated by private sector companies. despite many warnings, dhs says some companies have failed to take even basic cybersecurity measures. >> ultimately comes down to a business decision for the company. >> reporter: a business decision that could allow attackers not only to turn off the lights but destroy the machinery, as well. i'm standing on the actual testing site of the generator. it was the first test of its kind to prove that a cyberattacker could gain control of a generator and cause it to