Modern power grids are evolving into highly interconnected cyber-physical systems (CPSs), enabling advanced monitoring, automation, and control. While these innovations improve efficiency and reliability, they also introduce new vulnerabilities. A well-devised single cyberattack can cascade across the grid, disrupting essential services to the society and economy. This has been demonstrated in major critical infrastructure attacks, such as the Ukraine power grid hack (2015), and Colonial pipeline attack (2021). Traditional cybersecurity measures alone fall short as threats grow more sophisticated. Artificial intelligence (AI) offers a transformative approach to safeguarding smart distribution systems by enabling proactive detection and self-healing capabilities before the anomalies escalate into major disruptions. By leveraging AI’s ability to learn patterns, anticipate adversarial behavior, and coordinate defense across distributed assets, utilities can enhance resilience against evolving cyber threats. This article explores how AI-driven strategies can become a shield for the future grid security. It highlights their potential to enhance operational resilience and outlines a vision for integrating intelligent defense into the infrastructure of modern electric power distribution systems.
It is the quiet stretch of the night, before the predictable morning load ramp, and control room operators watch a familiar rhythm of telemetry across their displays. Loads are steady, voltages remain within bounds, and system frequency is tightly regulated. Nothing appears out of place. However, deep within the operational environment, an intruder may already be present, quietly mapping communication paths, probing devices, and learning how the system is organized. No breaker has opened, and no alarm has been triggered, yet the most consequential phase of a cyberattack, reconnaissance, may already be complete.
Power grids are currently facing novel and incumbent cybersecurity challenges posed by advanced persistent threats (APTs). They are perpetrated by advanced, often state-sponsored adversaries targeting transmission and distribution system operators. APTs and emerging well-resourced cyberattacks on control centers, digital substations, renewables, and storage technologies can cause distributed contingencies across the power system leading to N-k components being suddenly disconnected from the power grid. Cyberattacks may instigate multiple, unprecedented excitation modes and lead to protection schemes disconnecting other generators and power lines, which result in a fast domino effect called cascading failures. The impact of a cyberattack on power system dynamics can be fundamentally different from the consequences of physical faults or contingencies. APTs can speed up the cascading failure mechanisms, leading to an accelerated point of no return in the cascading failures sequence and potentially cause a blackout much faster than historical blackouts initiated by physical disturbances. This leaves insufficient time for reactive measures to contain the spread of disruptions and may result in an unprecedented large-scale, continental blackout.
This article explores the role of AI in securing IEC61850-based communication protocols within digital substations, emphasizing the potential and challenges of applying AI in this context. It highlights various AI techniques used for cybersecurity of IEC61850 communication, such as machine learning and deep learning, and discusses their strengths and limitations. It highlights both the promise and the limitations of rule-based and current AI approaches. While many machine learning (ML) models achieve impressive results in controlled settings, challenges related to data scarcity, class imbalance, real-time constraints, and explainability need focused efforts to build operators’ confidence for wider deployments. By articulating these challenges and distilling practical lessons from live deployment and comparative benchmarking, this article aims to provide a roadmap for utilities, vendors, and researchers seeking to deploy AI responsibly in safety-critical grid environments.
Power systems are large scale cyber-physical critical infrastructure systems whose electrical reliability and resilience is made possible by numerous interrelated operation and control subsystems that span diverse timescales from subcycle protecton and control to multi-year long-term planning. Threats to power systems are multifold and include myraid sources ranging from weather, to accidental failures, to intentional adversaries. In defending the resilient operation of these systems against such threats, it is crucial to take a holistic resilience-oriented approach: operating through failure. Operating through failure is defined as continuing to sustain the critical functions of the system, to ensuringe the reliable delivery of power to consumers during a disturbance, specifically especially whenduring events that may cause or require the degradation of some systems or non-ideal operation. This includes both cyber-resilience, partially achieved though network segmentation, as well as physical operational reliability, achieved though engineering in planning and operations[1]. Here, we would like to expand upon a particular element of that type of resilience-preserving response of defense: network defense. In particular, since power system communication and control networks are a crucial part of the infrastructure that underpins the resilient monitoring and operation of power systems, we focus in this article on the segmentation of these networks, including the design and deployment of proper firewall rules that enforce who can talk to whom on a network. Firewalls are a crucial element of network defense in these power systems, used to segment informational and operational technology networks, ensuring that only authorized users can remotely access/operate systems. Firewalls are configured with rules to block unwanted traffic, and there may be thousands of rules in a firewall. This type of defense is often referred to as perimeter defense because a firewall traditionally functions like a gatekeeper that decides what traffic to allow. However, recent years have seen a revolution in artificial intelligence (AI) technology, with systems transforming from passive, prompt-driven assistants to agentic AI, which provide capabilities as autonomous systems that can formulate plans, make decisions, and execute actions to achieve a goal. The electric power industry is now at a crucial inflection point, where it must address how these ever-evolving agentic AI capabilities and supporting infrastructures can potentially transform its resilience and defense capabilities. The cyber-physical power system defense ecosystem is a key area of interest, where a crucial element for the safe deployment of these technologies involves carefully assessing and evaluating their limitations, vulnerabilities, and risks. In this article, we explore the question: “How can machine learning help us with network defense?” We consider how network segmentation plays a role, and we offer possibilities for how these technologies can come together to enable more cyber-resilient power system operations.
