Grid Modernization’s Hidden Cost: A Growing Attack Surface Few Are Watching

The grid is being rebuilt in real time, with developers on track to add 86 gigawatts of utility-scale capacity this year, the largest single-year capacity addition in over two decades, according to the U.S. Energy Information Administration (EIA).

The problem with such rapid expansion, however, is that every solar array, battery site, and electric vehicle depot introduces networked, protocol-speaking assets that need to be seen and secured. And, historically, network visibility has been a thorn in the side of energy administrators because most still can’t fully see across OT and IT. Case in point: Just 14% of organizations in Fortinet’s 2026 State of OT and Cybersecurity Report signaled full visibility into their OT systems, while roughly a quarter said they can see only half of the operational network.

Bad actors are exploiting these visibility teething pains. In August, five federal agencies warned of an active campaign targeting industrial controllers running power and water systems. Knowing that many energy operators struggle to quickly detect anomalies across connected infrastructure, attackers used AI-written scripts disguised as legitimate monitoring tools to find and probe internet-exposed assets.

This isn’t good enough. Going forward, utilities need to close the modernization-vs-visibility gap and account for every asset under their watch, both existing and incoming.

More assets and a growing attack surface

Across stakeholders, grid modernization outpacing grid visibility is top of mind. The North American Electric Reliability Corporation (NERC) highlighted this concern at the start of the year, recognizing that a more dynamic, interconnected, and digitized grid is exposed in kind to more sophisticated cyber and physical threats. In short, if not properly accounted for, more energy assets can quickly expand the attack surface.

Unfortunately, the energy sector’s track record isn’t particularly strong in overseeing information technology and operational technology. Cultural divisions between the two sides of the network often see long-term legacy infrastructure and control machinery (OT) connected without proper network oversight (IT). Disconnected defenses can and do result in successful breaches, which then spiral into real-world consequences such as production shutdowns, equipment damage, or lateral movement inside the network.

Leaders, too, know this is a problem: 83% of energy, utilities, and resources executives view cyberattacks as a serious or moderate risk (six percentage points higher than other sectors). One of the core reasons? Limited real-time awareness of OT assets. During energy assessments, I’ve seen this all-too-common problem firsthand in the form of unpatched devices, insecure external connections, and incomplete asset inventories.

Energy players need to take ownership and step up their defenses. NERC reinforced this message by finding that, while the Critical Infrastructure Protection (CIP) standards remain the backbone of mandatory security controls for bulk power system operators, the sector’s operating environment is changing faster than the standards’ scope and revision cadence. In this vacuum, all players must not only comply with current standards but also redouble monitoring efforts, build a defensible inventory, and extend oversight to operational assets.

Most operators need to go back to basics

While the immediate reflex to more threats is more defenses, the truth is you can’t secure what you can’t see. The first move to grid visibility is therefore knowing what’s connected, how it talks, and what “normal” looks like.

Similarly, IT and OT can no longer operate independently. I made the case last year that legacy PLCs don’t need ripping out, just proper monitoring. The grid is no different since operators need a single line of sight across control centers, switches and routers, and remote substations. This way, backed by tools that can poll Modbus devices, subscribe to MQTT topics, and clearly display what they see for whoever’s watching, any network problem appears in one shared view instead of multiple disconnected alerts.

Another by-product benefit of watching the grid is that operators can also close the compliance gap alongside the security gap. CIP-015 (NERC’s standard focused on internal network security monitoring) requires historical records and alert logs that back up your documented processes. Continuous monitoring creates a paper trail like this, making evidence-gathering much easier if and when auditors come knocking.

Of course, none of this replaces core tenets of energy security. Operators still need to take controllers off the public internet, agree which team owns each new asset at commissioning, and write security requirements into equipment contracts. Done right, visibility is the supporting layer beneath everything that lets teams act before problems escalate.

Energy network monitoring can’t be an afterthought

One silver lining is that large energy companies are responding and bolstering their cybersecurity. Smaller utilities, however, still struggle to allocate manpower and resources to defend themselves. This is a particular concern because low-impact systems and third-party operators represent a growing share of operational dependency. In this way, adversaries are more often trying to target these smaller systems and aggregate the compromises into large-scale effects.

For operators big and small, closing the gap doesn’t start with a bigger budget or a larger team but with oversight that scales.

Whether added capacity translates into a more vulnerable attack surface ultimately depends on energy leaders. From where I sit, connecting each new asset with visibility that surfaces issues early is the highest-leverage move stretched operators can make right now.

Amperesand Aims to Smooth AI Data Center Power Spikes

EU Project Advances HVDC Grid Operations with Modeling and Simulation

Microgrids and Backup Power: A Perfect Match for Energy Resilience

RELATED TOPICS: CYBERATTACKS, CYBERSECURITY, ENERGY RESILIENCE, NETWORK SECURITY, POWER, SMART GRID

David Montoya is the presales director at Paessler GmbH. He specializes in IT/OT convergence and industrial network monitoring, and also writes for Smart Industry, RCR Wireless, RT Insights, DirectIndustry, Manufacturing.net, and more. Follow David on LinkedIn