Critical Infrastructure and Electric Utilities: The 2026 AI Physical Security Sector Playbook for Substations, Generation Plants, and Control Centers

Critical infrastructure physical security is no longer a low-frequency, low-consequence problem managed at the substation fence line. It is a regulated, federally examined, increasingly contested operating risk that sits at the convergence of national security, reliability standards, and routine asset management. The 2022 Moore County substation attack in North Carolina, the multi-state pattern of substation incidents documented in 2022 and 2023, and the 2026 Boulder City power-substation ramming investigated as a possible terrorism event have collectively pushed grid physical security from the operations layer to the C-suite. Federal regulators have responded with a CIP-014 reliability standard rewrite, increased E-ISAC reporting expectations, and a sustained CISA focus on the energy sector as the load-bearing element of every other critical infrastructure function.

This sector playbook is written for the security director, risk officer, plant manager, and corporate counsel responsible for physical protection of generation, transmission, and distribution assets. It is grounded in primary sources: NERC CIP-014-3 and the in-development CIP-014-4, FERC's order directing NERC to evaluate the standard, the U.S. Department of Energy's OE-417 electric disturbance database, FBI and federal court records on the Moore County and Baltimore-plot investigations, and CISA's critical infrastructure security guidance. The goal is to give utility leaders a defensible reference for how the threat surface has shifted, what the regulatory posture now expects, and where AI-assisted computer vision changes the detection-to-engagement math at substations, transmission yards, generation plants, and control centers.

LIVE CAM-04 · PERIMETER ZONE

What the DOE OE-417 record actually says about grid physical attacks

The first calibration any utility risk discussion needs is a primary-source baseline of physical attack frequency. That baseline lives in the U.S. Department of Energy's Form OE-417 Electric Disturbance Events database, the federal reporting vehicle that grid operators are required to use when an incident meets defined disturbance criteria.

According to the OE-417 annual summaries, U.S. grid operators reported 185 instances of mostly physical attacks or threats against critical grid infrastructure in 2023, the largest annual count in the database's history at the time and roughly double the 2021 figure. The 2023 reporting year also recorded 200 instances of vandalism, suspicious activity, sabotage or physical attacks across all reportable categories, a number that comprised 58% of all reported electric-disturbance incidents that year. The trend line is the operationally relevant data point: in 2017, just 9.3% of reported disturbances noted suspicious circumstances; in 2023, that share approached six in ten.

The OE-417 record is conservative by design. It captures only events that meet the federal reporting threshold for disturbance, suspected sabotage, or physical security breach. The North American Electric Reliability Corporation's Electricity Information Sharing and Analysis Center (E-ISAC), which operates the voluntary industry information-sharing channel, tracks a much larger pool. NERC's 2025 E-ISAC end-of-year report cites more than 3,500 physical security incidents shared in calendar year 2024, with roughly 3% disrupting electricity service. The 2023 E-ISAC report had documented more than 2,800 events at a similar 3% disruption rate. Together the two data streams describe a threat environment with four characteristics: a multi-year increase in absolute volume, a high share of suspicious-activity coding, a consistent disruption rate, and a long tail of low-severity events that build the operational picture even when no single incident reaches federal thresholds.

Moore County and the operational reality of a successful substation attack

The single event most often cited in 2026 utility security planning is the December 3, 2022 attack on two Duke Energy distribution substations in Moore County, North Carolina. The attack is a useful reference because it has primary-source documentation across the FBI investigation, the Moore County Sheriff's Department, the North Carolina State Bureau of Investigation, and the eleven municipal police departments that participated in the response.

The attackers fired into the West End and Carthage substations from outside the fence line, leaving roughly two dozen high-powered rifle shell casings recovered at the scene according to investigators. The two substations sit approximately ten miles apart. The shooting damaged transformer equipment severely enough that Duke Energy reported up to 40,000 customer accounts without power, and full restoration required four days. On August 30, 2023, the North Carolina Office of the Chief Medical Examiner ruled the death of Karin Zoanelli, an 87-year-old Pinehurst resident dependent on an oxygen concentrator, a homicide attributable to the outage. As of 2026, no arrests have been announced; the FBI continues to seek information through its Shooting of Electrical Substations case page.

The reason the Moore County attack reframed the sector's planning posture is not the headline outage figure. It is the architectural simplicity of the attack. Two coordinated shooters, standing outside a chain-link fence, defeated the physical protection of two substations using common rifles and the absence of detection capability at the perimeter. The attack pattern was intelligible, repeatable, and well within the capability profile of a small, motivated group. CIP-014 had been in force since 2014. Both Moore County substations were distribution-level rather than the bulk-power transmission stations subject to CIP-014's mandatory criteria, which is itself one of the framework's documented gaps.

The NERC CIP-014 framework and what FERC has now ordered NERC to fix

The federally enforceable physical security floor for U.S. transmission assets is NERC CIP-014, the Physical Security Reliability Standard, originally approved in 2014 and now operating in its CIP-014-3 enforced version with a CIP-014-4 revision in development. CIP-014's purpose, in NERC's own framing, is to identify and protect transmission stations, transmission substations, and their associated primary control centers that, if rendered inoperable or damaged through a physical attack, could result in widespread instability, uncontrolled separation, or cascading within an Interconnection.

The standard's six requirements, in operational order:

1. R1 — Risk assessment. Each Transmission Owner must, at least once every 30 to 60 calendar months depending on prior assessment results, identify each Transmission station and Transmission substation that meets the applicability criteria and could, if attacked, cause Interconnection-level instability. The applicability criteria capture 500 kV substations and most 200-499 kV substations that are connected to three or more other 200 kV-or-higher substations.
2. R2 — Third-party verification. The R1 risk assessment must be reviewed by an unaffiliated third party with industry-recognized physical security expertise. NERC requires this third-party verification on the same multi-year cycle.
3. R3 — Notification of identified facilities. Owners must notify any Transmission Operator they do not control that operates a primary control center associated with a CIP-014-applicable facility.
4. R4 — Threat and vulnerability evaluation. For each identified facility, the owner must perform an evaluation of potential threats and vulnerabilities to the facility, including events such as physical attacks targeting transformers, control buildings, and incoming transmission lines.
5. R5 — Physical security plan. Each identified facility must have a documented physical security plan addressing the threats and vulnerabilities identified in R4, with the plan implemented within timeframes specified in the standard.
6. R6 — Third-party plan review. The R5 plan must be reviewed by an unaffiliated third party with industry-recognized physical security expertise, on the same multi-year refresh cycle.

The most consequential 2024 development for CIP-014 is the federal review FERC ordered NERC to conduct following the 2022 Moore County attack and the broader uptick in physical incidents. FERC directed NERC to evaluate three specific dimensions of the standard: the adequacy of the applicability criteria, the adequacy of the required risk assessment methodology, and whether a minimum level of physical security protection should be required for all bulk-power-system substations and their associated primary control centers, regardless of whether they meet the existing applicability thresholds. NERC's evaluation report and the resulting CIP-014-4 development project, with the most recent draft posted in mid-2025, are the regulatory artifacts security directors should be tracking. The direction of travel is consistent: more substations in scope, more rigorous risk assessment expectations, and more prescriptive physical security protections layered onto the current performance-based framework.

The five utility asset classes and where the perimeter actually fails

Critical infrastructure physical security planning is often discussed at the substation level, but the threat surface and the response architecture differ across five distinct asset classes. Each has its own regulatory floor, its own intrusion pattern, and its own compatibility with AI-assisted detection. Understanding the differences is the first step in mapping a defensible CIP-014 R5 physical security plan to the specific assets in scope.

The five detection modalities a CIP-014 R5 plan can credibly cite

The R5 physical security plan requirement is performance-based, not technology-prescriptive, but the third-party reviewer expectation increasingly compares R5 plans against a known set of detection modalities. The current commercial perimeter-detection market includes five primary architectures, each with a defensible CIP-014 use case and each with documented failure modes. The relevant evaluation question for a security director is which combination compresses the detection-to-engagement gap inside the response window the threat assessment requires.

The reason AI computer vision has become the default detection modality at substation perimeters since 2022 is not that the underlying neural-network architectures are new. Object-detection convolutional networks have been production-grade for nearly a decade. The change is that GPU inference cost has dropped to a level where running a continuous person-detection model on every camera in a substation yard is operationally affordable, and on-premises appliance form factors have matured enough that utilities can run inference inside their own server rooms or remote-control-center racks without sending video to a cloud service. The latter property matters in regulated environments where data residency and cyber security review govern what can leave a CIP-protected network.

For deeper coverage of the underlying detection mechanics, the 2026 Definitive Guide to Proactive Computer Vision walks through the model architectures and the privacy-by-design choices that distinguish object-class detection from facial recognition, and the 90-Second Window perimeter briefing covers the response-time math in detail.

What a defensible substation response architecture looks like in 2026

The architecture pattern most mature utility deployments now follow has three layers: existing camera and sensor infrastructure, an on-premises detection appliance, and an alert-routing layer that connects to whatever response workflow the utility already operates. The CIP-014 R5 plan documentation becomes the formal description of how those three layers interact during a defined incident type.

Existing infrastructure. Most utilities already have substantial IP camera coverage at substation control buildings, switchyard entrances, and primary control centers. The reason AI perimeter detection has displaced rip-and-replace deployments is capital efficiency: a platform that layers onto existing cameras lets the security budget go to detection capability rather than re-cabling. For substations where camera coverage is incomplete, the deployment plan typically combines camera additions at fence-line and gate locations with the AI layer rather than treating the cameras as an independent project.

On-premises detection. The detection model runs on a dedicated appliance inside the utility's own server room, a remote control center, or a CIP-protected enclave depending on the asset class. This matters operationally for two reasons. First, it avoids the cloud-roundtrip latency that would push the detection window outside the response window the CIP-014 R5 plan commits to. Second, it avoids the network-egress and data-residency review that would otherwise gate the deployment under the cyber-physical convergence requirements that NERC's CIP-005 and CIP-007 standards place on perimeter network traffic.

Alert routing. The output of the detection layer is an alert with an object-class identification, a confidence score, and a frame reference. Where the alert goes is configurable per facility: dispatch console, mobile devices for the responding guard force or contracted patrol, paging system, mass notification platform, or directly to public safety via the platform's RapidSOS integration. For utility-specific deployments, the routing layer typically integrates with the SCADA-adjacent SOC tooling that already monitors the cyber side of the asset, which is the operational expression of CISA's recommended cyber-physical convergence posture.

LIVE CAM-12 · YARD ZONE

The economic case for compressing the substation detection-to-response window

The financial logic for AI perimeter detection at critical infrastructure assets rests on three independently quantifiable variables, each of which a utility CFO or risk officer can model against their own loss history and CIP-014 audit posture.

Direct loss avoidance and outage exposure. A successful Moore County-style attack carries restoration costs, customer-impact damages, regulatory penalties under state utility commissions, and downstream civil exposure tested in court following the 2023 ruling that the Pinehurst death attributable to the outage was a homicide. The structural case for upstream detection is that the marginal cost of an AI camera deployment is materially lower than the expected-value cost of the events the detection layer prevents or compresses.

CIP-014 compliance posture. The R6 third-party review requirement creates an audit-defensible value driver that is independent of incident loss. A physical security plan that cites object-class detection, documented integration with the SOC, and specific response-time commitments is materially easier to defend in a CIP-014 audit than a plan that relies on patrolling guard force and fence sensors alone. The reduction in audit risk is itself a P&L line item once the organization absorbs the realistic cost of remediation actions following a finding of insufficient R5 plan implementation.

Insurance underwriting. Commercial property and casualty carriers now treat physical security technology as an explicit underwriting input, particularly in the energy sector where reinsurance pricing has hardened. The 2024 cycle saw multiple carriers add questions about AI-assisted detection, video verification, and alarm-response architecture into utility renewal questionnaires. The market intelligence briefing on insurer underwriting covers carrier positioning in detail; the structural finding is that physical security is increasingly priced like a cyber control rather than a building amenity.

For organizations modeling the case alongside other investments, the Four-Variable ROI Framework for AI Physical Security covers the economic model, and the federal and state grant funding briefing documents the procurement vehicles available to utilities and public-power entities.

The critical infrastructure physical security regulatory trajectory utility directors should plan against

The CIP-014-4 development project is the most consequential current regulatory artifact, but it is not the only one. The broader regulatory trajectory has three vectors that security planning should anticipate.

Expanded applicability. FERC's directive that NERC evaluate whether a minimum level of physical security protection should apply to all bulk-power-system substations and primary control centers, not only the high-consequence assets meeting current applicability criteria, is the single most likely structural change. If adopted, the population of substations subject to formal physical security plan requirements would increase materially, which in turn would reset the deployment economics for AI-assisted perimeter detection because the technology would shift from a discretionary investment to a compliance baseline.

Convergence with cyber requirements. NERC's CIP-005 (Electronic Security Perimeters), CIP-007 (Systems Security Management), and CIP-014 (Physical Security) have historically been treated as parallel compliance programs. Increasingly, the integrated audit treatment is converging, particularly where physical detection feeds the SOC and SCADA-adjacent telemetry. The cyber-physical convergence pattern documented in the Agentic Security Operations Center architecture reference is the operational expression of where this regulatory convergence is heading.

State-level overlay. Multiple state utility commissions have added physical security planning expectations to their integrated resource plan and base-rate review processes following the 2022-2023 attack pattern. The state-level layer is non-uniform but increasingly material; the state-by-state AI security legislation tracker documents the parallel legislative dimension, and individual utility regulatory teams should be tracking state PUC docket activity in addition to FERC and NERC filings.

For utilities with cross-border or multinational exposure, the European Union's parallel infrastructure-security framework is moving on a similar trajectory; the EU AI Act compliance briefing covers the AI-specific requirements that increasingly intersect with physical security technology procurement decisions.

Frequently asked questions about AI physical security at electric utilities

Continue the research

This sector playbook covers the utility and critical-infrastructure side of the AI physical security architecture. For deeper reading on the adjacent pieces of the modern utility security posture:

• Perimeter Intrusion: The 90-Second Window That Defines Your Security Posture — the cross-sector primary-source briefing on the detection-to-engagement gap, including FBI UCR data, DOJ alarm-response research, and the Sandia EASI framework.
• AI Physical Security Procurement Compliance: The 2026 Federal and State Regulatory Framework — the procurement-side counterpart to this sector playbook, including federal vehicles, state overlays, and AI-specific procurement requirements.
• The Agentic Security Operations Center: An Architecture Reference — the SOC architecture that physical detection increasingly feeds, including the cyber-physical convergence pattern utility CISO and CSO offices are operationalizing.
• 2026 Definitive Guide to Proactive Computer Vision — the technical reference on object-class detection, the model architectures, and the privacy-by-design choices that distinguish AI computer vision from facial recognition.
• Perimeter control solution page — the platform-level technical reference for IntelliSee's perimeter detection capability, including supported VMS integrations and on-premises deployment patterns.
• Request a critical infrastructure risk assessment — structured conversation with IntelliSee's solutions team to map the CIP-014 detection-and-response math against a specific utility's threat surface, asset class mix, and existing camera infrastructure.