Utility Security

1. ISC East is near. What aspects of this year’s event are you most excited about? Being in New York City right before the holidays always brings its own excitement, but what’s truly important about bringing the industry together at the end of the year is the opportunity to connect in person, discover new technologies, and unveil fresh ideas. This year, we are introducing several new areas on the show floor designed to do more than just keep pace with innovation.

In the utility sector, the most formidable adversaries aren’t always external threats. Often, the biggest hurdles are internal: complacency, misconceptions, and parochialism. In this episode, we dive into the critical need to challenge the “if it ain’t broke, don’t fix it” mindset.

Climate-related disasters are becoming more frequent. In 2024, there were 27 weather and climate disasters that caused at least $1 billion in damage, according to the National Oceanic and Atmospheric Administration’s National Centers for Environmental Information. Some disasters have revealed fragility in utility infrastructure that also presents security issues that can quickly escalate. Recent examples include: The 2025 Texas Hill Country flooding, which claimed more than 100 lives.

For those tasked with securing and protecting utility assets, the most formidable adversaries aren’t always external. While threat actors, cybercrime and infrastructure sabotage are real and constant threats, internal biases and resistance to change are some of the most challenging security obstacles. If not overcome, three specific challenges – complacency, misconceptions and parochialism – will render futile any attempt to enhance security.

Much work has gone into addressing known data cybersecurity threats that impact utilities, and this has been ongoing for quite some time. Yet when we look at the threat of kinetic cyberattacks – which can cause extensive, long-term equipment damage – there is a lack of urgency and insight to address the seriousness of this risk across many sectors.

If you’ve ever had the lights go out in the middle of a Netflix binge, you know just how fragile our utility systems can feel. Now, imagine that same blackout – not caused by a storm, squirrel or clumsy backhoe operator but by a hacker halfway across the globe who thinks it’s hilarious to shut down the power grid. Welcome to the reality of cybersecurity in the utility sector, a mix of legacy technology, patchwork defenses and enough regulatory acronyms to make your head spin. We’re at a crossroads.

What do Iryna Zarutska’s murder in North Carolina, the killing of Charlie Kirk in Utah and the shooting of President Donald Trump in Pennsylvania have in common? They highlight the fallacy of delegated security. Many people don’t grasp the necessity of taking ownership of their personal security.

Leadership isn’t easy. Along with all the responsibilities that come with navigating the organization toward increased success and reduced risk, how leaders interact with others sets the tone for the rest of the company. Great leaders know that a big part of the job is building trust and connection and inspiring their teams to be passionate about the mission.

As threats to critical infrastructure continue to grow in complexity, the divide between physical and cyber security is dissolving, and a unified approach is becoming essential for a robust and proactive risk management security program. Within the utility industry, attacks targeting water supplies, power grids and other vital systems are becoming more sophisticated, underscoring the need for more comprehensive and proactive security measures.

I see a lot of substations every year, and most of them have chain-link fences. I think chain-link fences are obsolete, but don’t take my word for it. IEEE 1402-2021, “IEEE Guide for Physical Security of Electric Power Substations,” includes the following statement: “A standard chain-link fence is easily cut, and most purposeful intruders use this method to gain access.