The Biggest Cybersecurity Risk to Energy Systems Isn't Rogue AI — It's People

The Overhyped AI Threat and the Underestimated Reality

As a series of high-profile hacking incidents has stoked public fears about AI potentially "wiping out humanity," a more sobering truth tends to get overlooked: long before these anxieties emerged, energy systems were already in an unsettlingly fragile state — and that vulnerability continues to grow.

Joshua Corman, a public safety and resilience expert and executive-in-residence, summed up the industry's enduring predicament in a single sentence: "We've always been prey — we've just survived on the appetite of the predator." That observation cuts to the heart of energy infrastructure security: systems aren't safe because defenses are strong enough, but largely because attackers haven't yet chosen to strike.

The Real Risk Is Human, Not Algorithmic

Narratives about "rogue AI" are easy attention-grabbers, but when you look at the actual threat landscape facing energy systems, human factors remain the single greatest security liability. Whether it's misconfigurations, social engineering attacks, insider mistakes, or organized threat groups — what drives these incidents is human decision-making and behavior, not autonomously operating malicious algorithms.

Overfocusing on hypothetical "AI doomsday" scenarios risks diverting resources away from real, present-day threats. Energy systems, as critical infrastructure, directly affect power grids, water supplies, heating networks, and other services essential to public safety and daily life. The consequences of an attack are far more concrete and immediate than any abstract AI-driven panic.

---

Social engineering refers to techniques attackers use to gain access through psychological manipulation rather than technical exploits — common forms include phishing emails, voice phishing (vishing), and supply chain infiltration. In the energy sector, a longstanding cultural divide between operational technology (OT) teams — who prioritize "keeping systems running" — and IT security teams — who emphasize "patch fast" — creates organizational friction that is itself a security liability. According to the U.S. Cybersecurity and Infrastructure Security Agency (CISA), a significant share of successful attacks on critical infrastructure gain their initial foothold through compromised employee credentials or misconfigurations, not zero-day exploits. This means that even where technical defenses are relatively mature, gaps in staff training and process discipline can still become the weakest link in the entire security chain.

---

Why Energy Systems Are So Vulnerable

The fragility of energy infrastructure has deep historical roots. Many industrial control systems (ICS) and supervisory control and data acquisition systems (SCADA) were never designed with networked security threats in mind — they were built to prioritize availability and continuous operation, not to withstand external attacks. As these systems gradually connected to networks and embraced digitalization, the once-isolated "security islands" were breached and the attack surface expanded dramatically.

Corman's "prey" metaphor is an apt description of this condition: systems lack sufficient active defenses, and their security depends largely on the attacker's motivation and capability rather than the defender's strength. It is a passive, precarious equilibrium.

---

ICS and SCADA systems serve as the "central nervous system" of critical infrastructure — energy, water, transportation, and beyond. ICS is a broad term for systems that monitor and control industrial processes; SCADA is a specific architecture that collects field data via remote terminal units (RTUs) and manages it from a central master station. These systems were born in the 1970s and 80s, when network connectivity was never a design premise, and communication protocols such as Modbus and DNP3 have virtually no built-in authentication or encryption. Over the past two decades, operators have introduced large amounts of IP-based remote access and cloud management to cut costs and boost efficiency, connecting systems that were once physically isolated to corporate networks — and even the public internet. The 2010 Stuxnet attack on Iranian nuclear facilities, and the cyberattacks on Ukraine's power grid in 2015 and 2016 that caused widespread blackouts, stand as landmark cases of this vulnerability being exploited in the real world — and they validate Corman's "prey" metaphor with painful clarity.

---

AI Is a Double-Edged Sword, Not a Singular Threat

It's worth getting clear on AI's actual role in cybersecurity: it cuts both ways. On one side, attackers can use AI to increase the automation and scale of their operations. On the other, defenders can equally leverage AI for anomaly detection, threat intelligence analysis, and rapid incident response.

Framing AI simply as "a threat that wants to kill humans" is neither accurate nor helpful. What genuinely deserves attention is how to build a coordinated defense posture that integrates human oversight, sound processes, and technical tooling. No matter how advanced the technology, without proper human operation and governance, the security perimeter will still be broken at its weakest link.

Getting Back to Pragmatic Security Thinking

The core message of this analysis carries a clear warning: rather than chasing AI-fueled science-fiction panic, the industry must confront the long-standing, real-world vulnerabilities of energy systems. Hardening critical infrastructure, improving security awareness among practitioners, and strengthening incident response capabilities — these unglamorous fundamentals are what actually reduce risk.

For energy, utilities, and the broader critical infrastructure sector, directing limited security resources toward the genuine threat surface — the human-centered dynamics of attack and defense — delivers far more practical value than chasing AI apocalypse narratives.