Grid Security

The Trump administration has effectively closed the division of the Cybersecurity and Infrastructure Security Agency that coordinates critical infrastructure cybersecurity improvements with states and local governments, private businesses and foreign countries.

Sweeping layoffs in mid-October eliminated almost all 95 employees in CISA’s Stakeholder Engagement Division (SED), four people familiar with the matter told Cybersecurity Dive.

After the cuts take effect in early December, they will leave three of the division’s four units without any staff: Council Management, which convenes meetings between government agencies and the operators of U.S. critical infrastructure; Strategic Relations, which partners with and supports small businesses, academic institutions, nonprofit groups and state and local governments; and International Affairs, which coordinates meetings and information sharing with other countries and helps train their cyber experts.

Once the layoffs take effect, the four people said, SED will essentially consist solely of its small Sector Management unit, which oversees CISA’s work as a Sector Risk Management Agency (SRMA) for eight of the 16 critical infrastructure sectors, including chemical facilities, communications and information technology.

“These reductions continue a pattern of weakening the US government’s ability to carry out its cybersecurity responsibilities and hindering its ability to interact with the private sector,” said Michael Daniel, who served as President Barack Obama’s cybersecurity adviser and now leads the Cyber Threat Alliance, an industry information-sharing group.

Daniel said the downsizing “runs the risk of leaving CISA blind to certain threats and trends and will also limit CISA’s ability to influence the private sector and communicate its priorities.”

While CISA will continue working with infrastructure operators on cyber and physical security, the SED cuts could strain those relationships by eliminating longstanding collaboration mechanisms that business leaders have praised as highly valuable. The layoffs are also likely to further isolate CISA from its academic and international partners, potentially depriving the U.S. government of valuable expertise.

The cuts “create a dangerous void,” said Errol Weiss, chief security officer for the Health Information Sharing and Analysis Center. “The health sector is one of the most targeted and vulnerable, and this is exactly the wrong time to be pulling back federal support.”

A natural gas industry executive, who requested anonymity to speak candidly, said their group was concerned that the layoffs could “have negative impacts to our national security,” adding that “a fully functional and staffed CISA is essential to ensuring the continued operation of the key programs and initiatives that pipeline operators rely on to secure their systems.”

CISA declined to answer questions about the layoffs. Marci McCarthy, CISA’s director of public affairs, said the cuts were “part of the ongoing realignment to get the agency back on mission” and said CISA “remains dedicated to safeguarding the nation’s critical infrastructure.”

Pulling back from critical sectors

The loss of staffers in the Council Management office could significantly impede CISA’s relationships with critical infrastructure organizations in healthcare, energy, water, finance and other sectors.

Those employees oversaw groups that brought together government and industry organizations responsible for protecting various infrastructure sectors, as well as committees that advised CISA leadership on emerging trends. These councils and committees provided venues for government and industry leaders to discuss joint security projects and sensitive threats and emerging trends, allowing both sides to benefit from the other’s expertise and resources.

“The analysis, reports, guidance, training, and scenario-based drills developed with our partners help the entire community do their part to raise the security baseline of critical infrastructure’s assets, systems, and networks,” CISA said on its SED web page.

One of the groups, the National Security Telecommunications Advisory Committee (NSTAC), convened corporate executives and federal leaders for what officials in previous administrations described as uniquely productive conversations about how to improve collective cybersecurity resilience. The NSTAC also produced reports on everything from supply chain security to malicious actors’ abuse of U.S. computer infrastructure.

The layoffs of CISA staff supporting the NSTAC are “unfortunate” because telecommunications companies considered the group “a trusted venue” for important discussions, said a U.S. official who requested anonymity to speak freely.

The Trump administration had already frozen the work of these groups by eliminating a key partnership framework in March, but the new SED layoffs indicate that the administration is committed to severing those relationships with critical infrastructure organizations.

“Losing the specialized personnel who manage those deep relationships means we lose institutional knowledge, trust built over years, and the agility needed to respond to sophisticated nation-state and criminal threats,” said Weiss, the Health-ISAC executive.

CISA does not appear to have warned some of its closest critical infrastructure partners about the layoffs.

A security executive in the oil and natural gas subsector did not know about the cuts until Cybersecurity Dive contacted them.

“I’m still trying to fathom this,” said the executive, who requested anonymity given the sensitive nature of the situation.

Weiss also hadn’t heard from CISA about the layoffs, which he said “inevitably increase the cyber risk” for already-struggling hospitals, clinics and other providers.

International cyber programs halted

Meanwhile, the elimination of the International Affairs team could dramatically weaken the U.S. government’s foreign cybersecurity partnerships. SED staffers were overseeing projects to train other governments’ personnel and improve their new technological capabilities, in some cases helping foreign partners build systems that were more resilient to cyberattacks, according to a person familiar with the matter. 

Many of those projects emerged from diplomatic agreements signed by U.S. presidents and foreign heads of state, making them high-profile examples of the U.S.’s security commitments to its international allies. Now, all of that work has stopped.

“The loss of CISA’s international partnership office will undoubtedly make strategic cybersecurity partnerships and agreements with other nations more challenging, with no one really focused on facilitating those engagements anymore,” said the U.S. official.

Even before the layoffs, the government shutdown forced SED to completely sever communications with its international partners, baffling foreign officials who had to read about CISA’s retrenchment in the press, according to a person familiar with the matter.

Megan Stifel, chief strategy officer for the Institute for Security and Technology and a former international cyber policy staffer at the National Security Council, said the cuts would make it harder for the U.S. to enlist foreign help countering threats. “We can’t claim to be leaders internationally without a full bench of experts to help reduce risk across the government and our critical infrastructure.”

CISA as a whole isn’t completely cutting its international ties, however, and it is likely that the agency’s Joint Cyber Defense Collaborative will continue tactical coordination with foreign partners during cyber emergencies such as major hacking campaigns. But that would still represent a significant rollback of CISA’s global ambitions, which the agency once saw as an important part of establishing its legitimacy and value at home and abroad.

“We were very invested [in] the international team, adding personnel to support the mission,” said a second person familiar with the matter, who said the recent layoffs were “not in the best interests of the nation or the world.”

Cyber resilience outreach thwarted

The third SED subdivision to face major cuts, Strategic Relations, has a lower-profile mission but one that likely will be missed nonetheless. It partners with universities and businesses to advance CISA’s nationwide cyber-resilience goals, including through public-messaging campaigns like the agency’s promotion of the ongoing Cybersecurity Awareness Month. It also operates a sensitive homeland-security information-sharing platform, although that platform will continue to exist, according to an email sent to some CISA staffers and seen by Cybersecurity Dive.

The SED layoffs mirror an effort in President Donald Trump’s CISA budget proposal to drastically shrink the division’s responsibilities. The administration said the restructuring “shifts CISA’s mission space to solely support the SRMA efforts and aligns with CISA’s priorities to strengthen critical infrastructure security while optimizing operational effectiveness.” The White House’s summary of its CISA cuts specifically mentioned eliminating “external engagement offices such as international affairs.”

As one of three CISA divisions not explicitly authorized by Congress in the 2018 statute that created the agency, SED found itself in Trump officials’ crosshairs from the beginning of the administration. Many SED employees took the administration’s buyouts, and by the time the latest round of layoffs began, the division had lost nearly all of its 177 staffers.

Prior to the layoffs CISA had begun to transfer SED’s functions to the Infrastructure Security Division, but a person familiar with the matter said it would be impossible to “pass down all of the information on our international agreements and relationships” before the international office closes.

Critical infrastructure leaders bemoaned the potential consequences of the SED layoffs.

“Diminishing the capacity for critical infrastructure collaboration and global partnership ultimately leaves our entire nation — especially resource-constrained sectors like healthcare — more exposed,” Weiss said.

Amid rising threats to operational systems and a chaotic geopolitical environment, electric utilities want Congress to cleanly reauthorize the Cybersecurity Information Sharing Act of 2015, which allows for greater information sharing between the power sector and federal government.

The law lapsed October 1. A temporary extension was included in the government funding bill, which failed and resulted in the current shutdown. A bipartisan Senate bill could bring CISA’s protections back into force.

It is vital that utilities are able to share threat information as the risks are rising, said Kristine Martz, a principal product advisor at cybersecurity firm Dragos. “Adversaries are becoming aware of the impact that they can achieve against easy to access industrial control systems,” or ICS, she said Friday at a conference hosted by Columbia University’s School of International and Public Affairs.

“We’ve seen a consistent rise in threat activity over the years,” Martz said, noting new threat adversaries are focused on operational technology and ICS environments where they can impact the delivery of services.

“They get in through these internet-facing devices and just live off the land for a long time to perform reconnaissance, pulling down things like your GIS data, your network maps,” Martz said. “Living off the land” refers to cyber intruders using legitimate network tools to cover their presence and gain information.

While utility regulations like the North American Electric Reliability Corp.’s Critical Infrastructure Protection standards have helped create a baseline of security and shored up obvious weaknesses, Dragos has identified new threat groups developing operational and ICS-specific malware which take advantage of the extensive knowledge of utility work environments that hackers can gain from their research, Martz said.

Given the threat, and in an environment of rapidly growing electricity demand, it is vital that electric utilities are able to share information with government partners without fear of penalty, experts say.

The Edison Electric Institute, which represents investor-owned utilities, the Interstate Natural Gas Association of America, American Public Power Association, American Gas Association, National Electrical Manufacturers Association and the Electric Power Supply Association signed a letter in September urging a “clean” CISA 2015 reauthorization. The letter was led by the U.S. Chamber of Commerce and included a wide range of organizations.

The law’s lapse means the U.S. will face a “more complex and dangerous security environment,” the groups said. CISA “provides safeguards for businesses regarding public disclosure, regulatory issues, and antitrust concerns to facilitate the timely exchange of information between the public and private sectors. Industry and government have a strong history of protecting privacy and civil liberties under this law,” the groups said.

Reauthorizing the law will “ensure that businesses have legal certainty and protection against frivolous lawsuits when voluntarily sharing and receiving threat indicators and taking steps to mitigate cyberattacks,” the groups said.

Congress failed to reauthorize the program despite broad support among Trump administration officials, lawmakers, industry leaders and cybersecurity experts. Senate Homeland Security Committee Chair Rand Paul, R-Ky., blocked efforts to save the program as he sought new restrictions on the law’s efforts to combat online mis- and disinformation.

Bipartisan legislation introduced by Sens. Gary Peters, D-Mich., and Mike Rounds,  R-S.D., would renew CISA for 10 years and would be retroactive to cover the lapse since the government shutdown began.

“Threat intelligence sharing between the private and public sector is vital in protecting critical infrastructure from cyberattacks,” Dragos CEO Rob Lee said in a statement supporting the bill. “This critical cyber information sharing authority has given private entities the guardrails, and the confidence needed for responsible cooperation with the federal government. Those authorities must be renewed.”

Kate Mabbett, director of security strategy and financial planning for American Electric Power, said during the Columbia panel that the reauthorization of CISA is a top security policy priority right now for the utility sector.

“I need to know I’m not going to be punished for sharing something that can better protect the nation,” Mabbett said.”There needs to be trust both ways — that I can share sensitive information about how I’m operating, and that the government is going to help protect that.”

Sponsored content

By OATI

Over the past few years, distributed energy resource management systems (DERMS) has been the talk of the utility industry. Investor-owned utilities have invested in DERMS pilots and full-scale deployments to capture the reliability and economic value of the both front of the meter and behind the meter  distributed energy resources (DERs) and demand response (DR) assets coming on the power grid, including solar, wind, smart thermostats and battery energy storage assets.

But the growth of DERs and an increasingly diverse power grid, are not challenges exclusive to IOUs. Generation and transmission cooperatives (G&Ts), along with their member distribution rural electric cooperatives, also face these dynamics, in addition to the complexity of collaborating and coordinating with their varying member utility companies. That's why an increasing number of G&T cooperatives are turning to a DERMS solution designed for flexibility.

A GROWING TREND

Out of the ~60 G&Ts serving rural communities in the U.S., 11 have adopted OATI DERMS, a number that expands to more than 220 rural electric cooperatives when including their member cooperatives and that's no coincidence.

OATI's DERMS features the industry's only true multi-tenant architecture catering to multi-company entities, native to the platform, allowing G&Ts to fully orchestrate centralized demand management programs in harmony with their distribution cooperatives, while being able to offer each their own secure and private slot of a shared software layer for their own DR/DER operations.

Moreover, G&T DERMS naturally require more interfaces that any other utility type simply because of their reach into their member cooperatives related infrastructure, e.g. AMI, CIS, MDM, etc. For example, one G&T utilizing OATI's DERMS required the integration of more than 50 interfaces, which OATI's in-house systems integration team implemented.

OATI’s robust in-house integration practice builds and maintains these critical interfaces and provides integration health dashboards to quickly provide DERMS operators with real-time operational status of all integrations.

Another growing trend in rural America is the addition of large, grid-connected battery energy storage sites and microgrids for grid resiliency. OATI is helping  G&Ts with a number of these sites with poignant local site control that seamlessly integrates with OATI DERMS, enabling visibility and control of assets by the G&T for broader grid benefit purposes when the assets are not being used locally. North Carolina Electric Cooperatives, for example, utilizes OATI DERMS and OATI GridMind®, an advanced microgrid and asset controller, to orchestrate multiple microgrid sites along with behind-the-meter and front-of-the-meter DERs.

STARTING SMALL

While G&Ts may face a similar set of challenges as larger IOUs, financial constraints and member collaboration often require a more pragmatic approach to solving them. So, starting small with a single use case, proving it out and adding more assets and programs over time helps with budgeting cycles, member buy-in and stakeholder confidence.

The modularity of OATI's DERMS and a commitment to customer service and flexibility, meets G&Ts at their own stage of the DERMS journey. Hoosier Energy, for example, will initially deploy OATI's DERMS to manage around 1,500 smart thermostats across the territories served by its  member distribution co-ops. This program is anticipated to grow and in the future, their use cases, asset types and program may expand as well.

As a result, OATI now provides its DERMS solution to more G&Ts and their member distribution cooperatives than any other provider. The list now includes G&T’s such as East Kentucky Power Cooperative (16 co-ops), North Carolina Electric Membership Corporation (26 co-ops), PowerSouth Energy Cooperative (10 co-ops), Dairyland Power Cooperative (25 co-ops), East River Electric Power Cooperative (25 co-ops), Tri-State Generation and Transmission Association (39 co-ops), Southern Illinois Power Cooperative (7 member distribution cooperatives and a municipal utility) and Hoosier Energy (17 cooperatives). Most recently, Georgia System Operations Corporation (GSOC) began  its DERMS journey with an OATI DERMS platform. GSOC manages and monitors the electric generation and transmission for 38 of Georgia’s electric membership corporations, covering two-thirds of the state of Georgia and delivering affordable power for more than 4 million Georgians — every day, every hour.

Utility companies have become prime targets for identity-related fraud, yet the true scope of the threat remains largely hidden.

In 2024, the FTC’s Consumer Sentinel Network logged about 28,000 reports of stolen identities used to open new utility accounts and another 2,000 tied to existing ones. Those numbers exceed pre-COVID levels but fall short of a pandemic-era spike.

At first glance, that looks like stabilization. It’s not.

The reality is worse: Utilities are not legally required to report fraud incidents, leaving much of the damage invisible. Instead, companies push customers to file complaints — something many never do, whether because the utility absorbs the loss, the consumer avoids the hassle, or, in the case of synthetic identities, no real victim exists to file at all.

My research shows that the use of both stolen and synthetic identities to defraud utilities is persistent — and growing. Below I explain why utilities are prime targets, the tactics fraudsters use and how these crimes ripple across the broader fraud ecosystem.

Why utilities?

Utility providers are attractive targets for a mix of technical, regulatory and structural reasons.

• Low-friction onboarding: Compared to banks, many utilities still use limited identity verification. In the absence of strong “know your customer” rules, criminals can easily open accounts using stolen or synthetic identities.
• Delayed detection: Billing cycles stretch 30 to 60 days, giving scammers weeks of service before red flags appear. Fraudsters often exploit this delay and abandon accounts before utilities catch on.
• Service protections: Shutoff moratoriums — implemented during extreme weather or for medical “critical care” designations — protect vulnerable populations, but also shield fraudsters from enforcement. Once flagged as critical care, accounts can be nearly impossible to shut off even when fraud is suspected.
• Low legal risk: Utilities are not required to file suspicious activity reports and law enforcement deprioritizes unpaid bill cases. Electricity and gas are essential commodities with resale value, making accounts useful for scams, subleases and identity building.

For criminals, utility fraud offers free service, opportunities to resell or rent accounts and a low-risk testing ground for synthetic identities.

How fraudsters target utility providers

Using basic personal details like name, date of birth and social security number, fraudsters can open accounts, use service and then vanish, leaving the bill to the consumer or utility. Victims often discover the fraud only after collections appear on their credit reports.

Synthetic identities — blends of real and fabricated data — are increasingly used to secure utility accounts. Fraudsters often make small payments to establish legitimacy before running up large balances and disappearing in a classic “bust-out.”

Fraudsters also use stolen credit cards or bank account information to pay delinquent bills. These payments make fraudulent accounts look legitimate, boosting synthetic identities’ credibility. Underground forums openly advertise “bill payment” services at steep discounts, using stolen credentials to launder money through utility portals.

Many utilities run referral programs that reward new signups. Fraudsters create networks of fake accounts, all pointing back to a single “referrer.” The result is real payouts to fake customers and no long-term value for the utility.

Utility bills also serve as proof of address in broader fraud schemes. Once an account — real or fake — is opened, the bill becomes a useful artifact to apply for loans, rent apartments or onboard with fintechs. Fake bills are also widely sold online, complete with logos and billing histories.

Fraudsters even showcase stolen or forged utility bills in underground markets to prove their inventory’s quality. Investigators have traced these documents to synthetic identities later used in bank or credit applications. In one case, a fake utility bill dated October 2022 was linked to a neo-bank application filed the same month.

Why it matters

Utility fraud doesn’t just lead to unpaid bills. It acts as a gateway crime enabling fraudsters to simulate legitimate behavior, build credit histories or establish synthetic identities that later infiltrate banks, fintechs and government programs. Every fraudulent utility account is both a direct loss for providers and a stepping stone for larger crimes.

Meeting this challenge requires utilities take a layered, proactive approach:

• Stronger onboarding verification: Adopt tools such as device fingerprinting, phone/email risk scoring and identity-link analysis to detect anomalies at account opening.
• Synthetic identity monitoring: Watch for payment patterns consistent with bust-outs.
• Audit referral programs: Limit exploitation by tightening controls and monitoring for duplicate or suspicious accounts.
• Post-onboarding monitoring: Flag unusual usage or payment patterns that suggest fraud.
• Cross-provider data sharing: Collaborate across utilities to identify repeat offenders and track broader fraud trends.

Fraud is evolving, and utilities are increasingly in the crosshairs. What appears at first to be a modest rise in FTC-reported complaints is in reality a hidden, systemic problem, magnified by underreporting and the absence of regulatory oversight. Stolen and synthetic identities are flowing through utility systems not just for free electricity or gas, but to fuel broader fraud schemes that ripple across the financial sector. 

Utilities need to evolve just as quickly — tightening verification, monitoring patterns and sharing intelligence — to protect both their own operations and the consumers who depend on them.

Fraudsters already see utility accounts as valuable financial infrastructure. The question is whether utilities will act before the problem grows even bigger.

Nearly 35,000 solar power devices are remotely manageable and openly accessible to anyone from anywhere in the world, according to a report from industrial cybersecurity firm Forescout.

These exposed devices with internet-accessible management interfaces, which are made by 42 different companies, include equipment that is essential for operating solar energy infrastructure, according to the report.

Some of the management interfaces may include password protections, but Forescout said that virtually none of them needed to be online and that any exceptions should be placed behind VPNs.

The 10 vendors with the greatest number of exposed devices have each disclosed vulnerabilities in the past decade, increasing the risk of their sitting exposed on the public internet. 

The transition to renewable energy sources and the increasing digitization of the power grid have combined to create serious cybersecurity risks. Forescout’s latest findings illustrate how the absence of secure design practices in critical infrastructure devices also can endanger people’s lives and present opportunities to destabilize entire regions.

Forescout’s report — based on a scan of public IP addresses using the Shodan search engine — contains details about the distribution of solar equipment with internet-accessible management interfaces. For example, these devices are more prevalent in Europe and Asia than elsewhere, with three-quarters of the devices residing in Europe and 17% in Asia. Germany and Greece each have one-fifth of the total number of exposed devices. In addition, the 10 vendors with the most exposed devices were not the same as the 10 vendors with the biggest market shares; global titan Huawei, for example, is not on Forescout’s list.

SMA’s Sunny WebBox, a device that collects and reports information about the performance of solar inverters, was the most commonly observed piece of equipment left remotely accessible, followed by Fronius International inverters. The Sunny WebBox, which was discontinued in 2015, has “always been among the most often exposed solar devices,” Forescout said — even though researchers disclosed a hard-coded vulnerability in the product in September 2015. In fact, while the number of exposed devices dropped from 80,000 in December 2014 to 9,500 by the time of the vulnerability’s disclosure, it was back up to 13,000 last month, according to Forescout.

Discontinued internet-exposed infrastructure with known vulnerabilities constitute a recipe for disaster, according to cybersecurity experts.

“We see threat groups aggressively and opportunistically accessing internet-connected [infrastructure],” said Rob Lee, the chief executive of the industrial cyber firm Dragos. “Solar farms and other distributed energy resources require connectivity. But that connectivity should be properly secured and an assume-breach mindset must be taken for how attractive these systems are to adversaries.”

Some of the devices may be remotely accessible because their operators don’t even know they exist amid a sea of hard-to-manage infrastructure.

“Without full visibility into how these exposed assets communicate across environments, operators can’t properly control them,” Gary Kneeland, senior product manager at industrial cyber firm Claroty, told Cybersecurity Dive via email. “As this becomes a more prevalent attack pathway, things like asset visibility and communication mapping will be a key requirement for protecting critical infrastructure.”

Kneeland said vulnerabilities in devices accidentally left online “remain a persistent pain point for sectors racing to digitalize, especially in the energy sector.”

“Attackers don’t need sophisticated tools,” he said, “just access.”

Bipartisan legislation proposed in the Senate would allocate $50 million from fiscal year 2025 to 2029 to improve cyber security information sharing across the U.S. energy sector. Experts say the private sector would welcome the new initiative. 

U.S. and Canadian electric grids face a growing threat from hackers and physical attacks, and greater communication, coordination and advance planning are required to counter them, officials at the North American Electric Reliability Corp. have warned.

The Energy Threat Analysis Program Act would authorize the U.S. Department of Energy’s Energy Threat Analysis Center to coordinate information sharing on threat assessments and mitigation measures between the DOE, the Cybersecurity and Infrastructure Security Agency, the intelligence community and the private sector.

The legislation was introduced by Sens. Jim Risch, R-Idaho, and John Hickenlooper, D-Colo., and has been referred to the Committee on Energy and Natural Resources.

“Increased risk of cyberattacks requires more diligent information sharing to effectively monitor and mitigate threats to America’s energy sector,” Risch said in a statement. The new legislation “will support these efforts and better protect the U.S. from future cyberattacks.”

According to the legislation, the energy threat analysis program aims to support public-private operational collaboration by developing “actionable operational information” relating to energy sector threats and offering threat mitigation advice and actions.

The new program will improve “understanding of national security risks associated with the energy sector that are or could be exploited by adversaries, including nation-states,” and achieve a deeper understanding “of the tactics, capabilities, and activities of threat actors that have the potential to impact systemic risks to the energy sector,” the legislation says.

The program would be directed by the Secretary of Energy, managed by the DOE’s Office of Cybersecurity, Energy Security, and Emergency Response, and supported by its Office of Intelligence and Counterintelligence.

Energy storage and other distributed energy resources could be particularly vulnerable to cyberattack, security experts say.

“Our national security depends on a resilient and secure energy grid,” Hickenlooper said. “We need to address our vulnerabilities and modernize our grid to protect our energy future.”

The legislation “would be a welcome public/private partnership,” Chris Rouland, CEO of Phosphorus Cybersecurity, said in an email.

“Nation-states threat actors are actively targeting U.S. critical infrastructure,” Rouland said. “To reach true national cyber resilience, our government and private sector will need to come together and share information with the goal of reinforcing our critical infrastructure.”

“With new devices being introduced in areas like renewable energy, basic security compliance issues are still paramount, including password management and maintaining a regular patching cadence — which is not happening today,” Rouland warned.

The United States’ electric grid is entering a period of unprecedented stress. Aging infrastructure, rising energy demand and global supply-chain constraints are converging to create a dangerous vulnerability: a critical shortage of functioning power transformers. These silent workhorses of the grid, numbering between 60 and 80 million nationwide, are increasingly at risk of failure. And when they do fail, replacing them can take years, not months.

Lead times for new transformer deliveries now stretch from 80 to 210 weeks, according to an April 2024 report by Wood Mackenzie. This is a staggering increase in wait times, driven by raw material shortages, manufacturing bottlenecks and now tariffs. That means a single failed transformer today could leave entire communities in the dark for months. In the wake of natural disasters or targeted attacks, the consequences could be catastrophic.

Transformer failure isn’t just a maintenance issue — it’s a security risk

Transformers aren’t just aging — many are operating well beyond their intended lifespan. Over one-third of U.S. units are more than 40 years old, and many are serving load profiles they were never designed for. The rise of electric vehicles, grid-scale batteries, renewable generation and energy-hungry data centers is creating dynamic, high-stress operating conditions that strain these aging assets to the breaking point.

Add to that the growing threat of sabotage and climate disasters:

• In December 2022, coordinated gunfire attacks on two substations in North Carolina left 45,000 people without power for days;
• In early 2025, a man was convicted for plotting attacks on Baltimore-area substations, a plan that could have caused massive regional disruption; and,
• In September 2024, Hurricane Helene damaged transformers at 360 substations across North Carolina, leading to over 4 million outages, some lasting weeks.

These events underscore a stark reality: losing even a small number of transformers can trigger cascading blackouts and we no longer have the spare capacity or supply chains to quickly recover.

The Federal Energy Regulatory Commission has warned that coordinated attacks on just nine critical substations could cause a nationwide blackout lasting weeks or even months. In that context, transformer reliability is no longer a back-office maintenance issue — it’s a frontline national security concern.

Conventional methods of transformer monitoring are no longer enough

Traditional monitoring techniques like periodic Dissolved Gas Analysis, infrared scanning and Sweep Frequency Response Analysis are helpful but fundamentally reactive. They often identify issues only after damage has occurred.

To keep up with today’s risks, utilities need continuous, predictive and non-invasive monitoring. Advanced AI-powered systems, equipped with smart sensors and cloud-based diagnostics, can detect subtle signs of electrical, thermal or mechanical degradation months before traditional methods would catch them.

These tools don’t just improve reliability, they buy time, extend asset life and provide early warnings that can prevent catastrophic failures.

How advanced transformer monitoring technologies can help protect the grid

Next-generation transformer monitoring tools use external sensors to continuously analyze micro-vibrations and temperature fluctuations, and produce a detailed internal health signature of each transformer while the unit is operating, like a real-time EKG. 

These advanced tools quickly identify hidden faults and early signs of common transformer problems, such as arcing, insulation breakdown and winding degradation to help operators maintain transformer health and avoid failure.

These early warnings enable proactive maintenance that prioritizes high-risk units, optimizes capital planning and reduces the frequency and cost of unplanned outages and emergency repairs.

Using advanced technologies to improve transformer monitoring and maintenance helps strengthen grid reliability in the face of extreme weather events and attack scenarios, while extending the useful life of each transformer, maximizing cost savings. 

Maintaining the health of aging transformers contributes to a more resilient and secure electric grid, a mission-critical goal for national defense and emergency preparedness.

Transformer reliability is no longer just an operational issue for utilities — it’s a national imperative. As the U.S. grid continues to modernize, and as global risks intensify, power market participants must equip themselves with technologies that prevent failures before they happen.

U.S. officials have discovered undisclosed communication devices on the power inverters of some Chinese-manufactured solar panels, Reuters reported based on anonymous sources within the federal government. 

The inverters are part of the hardware package connecting solar arrays to the power grid. The package includes communication devices so technicians can monitor performance and have remote access for maintenance. These devices are disclosed in what’s called a software bill of materials – a listing of the components that comprise the package. The communication devices uncovered by the government are considered rogue because they’re undisclosed. 

These devices “provide additional, undocumented communication channels that could allow firewalls to be circumvented remotely, with potentially catastrophic consequences,” Reuters reported the sources as saying. 

Inverters are also included in other types of energy hardware, including batteries and heat pumps, and officials have found undisclosed devices in some of those as well. 

“Over the past nine months, undocumented communication devices, including cellular radios, have … been found in some batteries from multiple Chinese suppliers,” the report said.

Security risk

Chinese companies are the biggest manufacturers of power inverters, used by manufacturers of solar panels, wind turbines and other types of renewable power components around the world. 

The devices raise security concerns because Chinese companies are required by law to cooperate with their government’s intelligence agencies, giving those agencies control over Chinese-made inverters that connect to foreign grids, security experts told Reuters. 

That could enable the Chinese government to skirt firewalls and switch off the inverters remotely, or change their settings, destabilizing power grids, damaging energy infrastructure and triggering blackouts, the Reuters report said. 

"That effectively means there is a built-in way to physically destroy the grid," one of the unnamed sources told Reuters. 

One such incident occurred in November, when solar power inverters in the U.S. and elsewhere were disabled from China, highlighting the risk of foreign influence over local electricity supplies, sources told Reuters.  

A spokesperson for the Chinese government pushed back against the accusation it would use the devices to cause disruption to power grids. 

"We oppose the generalisation of the concept of national security, distorting and smearing China's infrastructure achievements," the spokesperson told Reuters.

Stepped-up restrictions

Congress has been concerned for years with the security issues posed by China’s dominance in strategic infrastructure manufacturing. Earlier this year, Sens. Rick Scott, R-Fla., and Maggie Hassan, D-N.H., introduced the Decoupling from Foreign Adversarial Battery Dependence Act, which would prohibit the Department of Homeland Security from purchasing batteries from some Chinese entities. 

“With our nation currently sourcing a majority of its batteries from Chinese-linked manufacturers, we’re subject to a major, unnecessary risk to our national security,” Scott said when the bill was introduced. 

There’s no similar bill to restrict Chinese-made inverters but some administrative restrictions are in place. Starting in 2019, the federal government began imposing prohibitions on the use of inverters and other infrastructure equipment manufactured by Huawei Technologies, the largest maker of the devices. Other efforts are underway to reduce the reliance on Chinese equipment, a spokesperson for the U.S. Department of Energy told Reuters.

"As more domestic manufacturing takes hold, DOE is working across the federal government … to integrate trusted equipment into the power grid,” the spokesperson said.

Energy storage systems, as well as other newer forms of distributed energy resources, could be particularly vulnerable to cyberattacks and other security risks because of their reliance on cloud-based computer software, experts said during a panel hosted by the Clean Energy States Alliance.

While the panelists said they were not aware of any direct attacks on energy storage systems to date and acknowledged the importance of energy storage to the energy transition, they also said such systems would require greater cybersecurity safeguards than more traditional energy technologies.

Speakers urged regulators and utilities to run a cybersecurity risk assessment and put protocols into place for addressing potential cybersecurity breaches within their energy storage or distributed resource networks.

Energy storage, coupled with other distributed energy resources and cloud computing, represents a major potential boon to the energy transition and utilities, Howard Gugel, senior vice president of regulatory oversight at the North American Electric Reliability Corporation, said during the CESA panel. But while connectivity to the cloud can enable remote repairs at a mass scale and other impressive feats, he said this same capability also gives him some reason for pause.

“It raised a wow factor from two perspectives,” he said of his recent observation of a mass update sent out to an inverter-based resource. “One, wow isn't it great that we are able to respond quickly and fix a problem ... But then the other wow is, if this were to fall into the wrong hands ... this could have been a bad situation.”

Gugel noted that while energy storage isn't unique in this regard, the fact that most energy storage systems are relatively new means they are more likely to integrate some form of Wi-Fi or Bluetooth connection, and to rely on software or data based in the cloud. Those connections open utilities to cybersecurity risks that weren't present in the past. That might include a targeted attack, he said, but it could also involve a simple mistake in a software update that is subsequently distributed en masse to battery systems made by the same vendor.

Sai Ram Ganti, a cybersecurity researcher at the Electric Power Research Institute, explained that the level of risk associated with any one system depends heavily on how it is configured — as well as its size and how much the grid depends on its continued operation.

While most energy storage systems involve some kind of connection to a cloud server managed by the systems' vendor, some systems provide vendors with read-only connections where the vendor can see and collect data about the batteries' operations, but they can't remotely operate the system. Other batteries have a two-way connection to the cloud server that allows the vendor to perform maintenance and install updates remotely — which could also represent a significant threat if the cloud server is compromised, Ganti said.

Energy storage systems can also pose challenges when utilities want to conduct security testing, Ganti said, because most of their on-board systems do not have sufficient bandwidth to complete test-related tasks without malfunctioning. As a result, developing testing protocols in isolated environments that reflect real-world operating conditions can be difficult, he said.

Utilities with battery systems that use these two-way connections should ensure they have access to some kind of override mechanism, Ganti said. He urged utilities to collect baseline operation data on newly installed storage systems so that they can more easily detect signs that a system has been breached or compromised, and he said utilities should run risk assessments on all of their utility-scale storage installations and develop a tailored plan for responding to and mitigating a potential breach of their or their vendors' systems.

Ganti also recommended that utilities avoid buying energy storage systems made outside the U.S. unless those systems arrived free of any silicon chips or controllers as “battery packs without brains” to reduce the odds they could be compromised by foreign actors. But his colleague Xavier Francia, also a cybersecurity researcher at EPRI, disagreed with geography-based bans, arguing that it was impractical to implement and could give utilities a false sense of security when cybersecurity risks could be introduced to energy storage at any point within the system's lifespan.

“The better security strategy here is really about security monitoring and incident response,” Francia said. “When a cyber attack does happen in spite of all your efforts to prevent it ... there still needs to be a good incident response plan to ensure you’re minimizing the scope of the attack and minimizing its impact here

While multiple industry organizations including NERC have or are in the process of developing cybersecurity standards for energy storage systems, Gugel acknowledged that there was nothing in place currently that would prevent a utility or developer from using equipment that does not meet these standards.

Francia said that the interconnection process could provide utilities with an avenue for controlling the quality of systems with access to the grid. But while this is currently a topic of conversation at many utilities, he said he was not yet aware of any utilities that have implemented a cybersecurity review in their interconnection process beyond the broader third-party reviews they already require.