Energy Grid Cyber Risk Is Human, Not AI, Security Experts Warn
Security researchers say the biggest threat to power systems remains human error and unpatched infrastructure, even as AI fears dominate the conversation.
The most serious cybersecurity threat to energy systems is still people, not artificial intelligence, according to security experts who track the sector. Joshua Corman, executive in residence for public safety and resilience at the nonprofit I Am The Cavalry, put the situation bluntly in comments reported by The Verge: the grid has long been prey, surviving only on the appetite of its predators. The warning arrives as recent high-profile intrusions have pushed speculation about autonomous AI attacks to the front of public debate.
Corman's point is that the vulnerability predates the current AI boom. Power grids, pipelines and water utilities have spent decades stitching together industrial control systems that were designed for reliability, not defense, and many still run on software that no longer receives patches. Attackers have repeatedly shown they can reach those systems through ordinary means: stolen credentials, phishing emails, unsecured remote access and third-party vendors with weak security. None of that requires an intelligent machine.
The stakes are unusually high because energy is the substrate other critical services sit on. Hospitals, water treatment, communications and transportation all depend on steady power, so an outage that starts at a utility can cascade well beyond it. Researchers have documented intrusions into grid operators in Ukraine and elsewhere that caused real blackouts, and U.S. officials have warned for years that adversaries are positioning themselves inside critical infrastructure for potential wartime use.
Against that backdrop, the AI panic can be a distraction. Security teams have limited budgets, and every dollar spent chasing speculative machine-driven attacks is a dollar not spent on basic hygiene: asset inventories, network segmentation, multi-factor authentication and incident response drills. Corman's framing suggests the industry should treat human operators and their habits as the central problem to solve, because those are the pathways attackers actually use.
The policy picture is moving, but slowly. Regulators have pushed new reporting requirements for critical infrastructure, and utilities face growing pressure to disclose incidents within tight deadlines. Compliance, however, is not the same as resilience, and many operators remain reluctant to admit how exposed they are. The question now is whether the next serious incident will be blamed on AI and obscure the mundane failures that made it possible.
What to watch is whether energy companies redirect spending toward fundamentals or continue treating AI as the headline threat. Watch, too, for regulators to test whether new disclosure rules actually surface attacks quickly enough to help. If the past decade is a guide, the intruder is more likely to be a person with a password than a machine with a mind of its own.