The AI revolution now underway marks a tipping point for the energy sector’s approach to cybersecurity. Risk mitigation reflexes that once made companies slow but steady now mean missing out on competitive advantages available through AI. Better predictions and better automation make a big difference for technologies key to the energy transition, like smoothing out solar power’s duck curve with grid-scale batteries or hydrogen fuel cells that store energy when electricity is abundant and supply it where and when demand and congestion make it valuable. AI tools already in pilot projects — predictive maintenance, automated asset inventory, continuous threat monitoring — promise powerful, efficient new ways to securely do business.
The same technology stack that makes energy infrastructure poised to take advantage of impressive AI capabilities make it potentially vulnerable to attacks. The digital revolution retrofitted existing systems with sensors and digital management tools, and the energy transition relies on technologies that can’t function without their digital components. For the physical machinery that sits at the heart of any energy company’s profit engine, reliability without cybersecurity is less and less plausible.
AI lowers the bar for attackers. People who want to cause chaos but lack the skills or knowledge base to target the energy sector can engineer prompts that spit out code, map networks, or draft plausible spearphishing emails. Historically, the energy sector has matured its cybersecurity at the pace of regulation. Most companies remain two steps behind cyber threats, update compliance measures to the minimum standard, and only rethink their cybersecurity approach after the next brand name becomes synonymous with disaster. Even above-average companies with leaders who foresee cyber risks get bogged down in the mix of regulatory uncertainty, technical uncertainty and aversion to risk. The energy sector needs a new way to proceed — one that addresses the valid concerns for safety, compliance, and reliability that are core to the industry, yet can still accelerate innovation cycles that contribute to security and competitive advantages.
How the energy sector should approach the pace of innovation necessary to protect digitally managed infrastructure and leverage AI capabilities is a challenge worth thinking through. How can the industry maintain steadiness, while moving faster? Part of the challenge will be accurately assessing — and reducing — the risks that slow down innovation. To that end, a few concepts might help:
- Public-Private partnerships. One way to de-risk innovation is to lean in on collaboration with the public sector. The U.S. Department of Energy and its national laboratories, for example, have been research hubs and proving grounds for many of the technologies in use today. Working to identify areas that require innovation for next-generation energy systems makes sense. Piloting technologies and practices in public-private collaboration importantly offers opportunities for regulators to observe, understand, and address concerns, shortening the window of regulatory uncertainty for new systems. Even if the only result is that energy companies gain confidence they will not be penalized for deploying new technologies, this helps reduce the overall perceived risks of innovation.
- Pilot projects. Actually implementing new technologies at small scale teaches a lot about what kinds of challenges will crop up when scaling up, and what degree of reward is available once the kinks are worked out. Cautious teams can gain confidence that they know how to safely and securely deploy new physical infrastructure or new software systems.
- Seeking advantages. Some companies will need to shift how they think about change — especially for cybersecurity. Reacting to regulation, which itself is often reacting to high-profile incidents or the past year’s flashiest tech innovations, will always put companies two or three steps behind the evolving risks they hope to mitigate. Innovation isn’t just about loss-avoidance. Even in cybersecurity, innovation can and should be about finding efficiencies and unlocking bottlenecks that enable businesses to perform better. Remote diagnostics mean fewer helicopter trips to offshore windfarms or drilling platforms, because repair crews arrive with the right diagnosis, the right plan, and the right tooling. Drone inspections spot pipeline weak points before they begin leaking. AI analysis predicts bearings need replacement long enough in advance to obtain parts and plan for downtime when other assets can cover the load efficiently. These and other operating advantages are only available to teams that invest in and secure innovation.
- Shared frameworks. Right now, the energy sector does not have a shared framework for innovation, though discussions convened by the World Economic Forum are making progress toward that goal. For leaders faced with tough choices about where to invest limited time and resources, it would help to have guidance about how to prioritize.
Exactly how each of these concepts can contribute to accelerating innovation — and securing energy assets — is certainly open to debate. But what’s not open to debate is the need — the urgent need — to recognize that the game has changed. After decades investing in digitization, AI offers a new round of rewards, if we can keep ahead or keep up with the pace of innovation.