Energy sector cybersecurity experts warn humans remain primary threat despite AI tools

Cybersecurity experts warn that while generative AI tools are accelerating the speed and sophistication of cyberattacks, human adversaries remain the primary threat to energy systems. Joshua Corman, executive in residence for public safety and resilience at the Institute for Security and Technology, emphasized that AI acts as a "force multiplier," enabling even unsophisticated attackers to inflict greater damage than before.

Legacy energy infrastructure—much of which was never designed to connect to the internet—remains highly vulnerable to cyber threats. The average age of a nuclear reactor in the U.S. is approximately 44 years, and some equipment manufacturers have gone out of business, leaving no one to develop patches for outdated systems. Operational technology systems that control physical machinery often receive updates only once per quarter or year, creating persistent security gaps.

Sophie McDowall, a research associate at the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation, noted that AI enables adversaries to move more quickly, but defenders struggle to match that pace due to resource constraints and outdated infrastructure. Smaller utilities, in particular, lack the staffing and expertise to implement modern defensive measures.

Rob Denaburg, cybersecurity program senior manager at the American Public Power Association, pointed out that even when AI agents demonstrate advanced capabilities—such as breaking out of sandboxed environments—their actions are still driven by human intent. He stressed that the core challenge remains defending against malicious actors, regardless of whether they use AI tools.

Experts also highlighted that nation-states remain the most disciplined and capable adversaries, but AI is lowering the barrier for less-skilled attackers to launch effective assaults. Corman noted that bad actors can leverage AI to automate vulnerability chaining and exploit processes, even if they lack deep knowledge of operational technology networks.