For entrepreneurs with a provocative vision for energy & IT; NGP is the only utility venture & innovation fund that taps into the global network of National Grid, accelerating companies with investment, innovation, incubation & biz dev; realizing the full potential of energy.

National Grid Partners

Utilities are entering a new phase of cybersecurity risk.

As artificial intelligence capabilities advance, attackers may be able to discover vulnerabilities, develop exploits, and navigate complex computing environments faster than traditional cybersecurity tools can respond. For utility OT (operational technology) -- where safety, reliability, and uptime come first -- this creates a very different challenge than in traditional IT (information technology) systems. 

That was the focus of the latest NextGrid Alliance Expert Session, “Preparing for the Claude Mythos/Fable Era: Securing Utility OT Against AI-Driven Cyber Threats.” The webinar featured leaders from startups VulnCheck, Dragos, and Cyolo and was attended by more than 150 utility professionals. 

The session also served as a lead-in to the NGA Summit panel in Boston this September, “Beyond the Air Gap: AI, OT Cybersecurity & the Future of Critical Infrastructure.” 

The core question for utilities is simple: Can OT environments keep pace if attackers move faster than traditional vulnerability management, patching, and incident response? 

OT systems are difficult to patch quickly. Maintenance windows are limited, outdated legacy systems are common, and operational reliability can't be compromised. As AI accelerates vulnerability discovery and exploit development, utilities need a more precise and operationally realistic approach to cyber risk. 

As Anthony Bettini, Founder & CEO of VulnCheck, put it: “You really can’t patch faster than AI can find and exploit, but you can be precise.” 

AI Is Compressing the Cyber Timeline

VulnCheck highlighted a major industry shift: moving from traditional vulnerability management to exploitation prevention. 

Instead of treating every high-severity vulnerability as equally urgent, utilities need to prioritize based on evidence of exploitation, exposure, and operational impact. In OT environments, where patching everything quickly is rarely realistic, exploit intelligence becomes essential. 

The key takeaway: Utilities should focus on the smaller set of vulnerabilities that actually are being exploited or are likely to create real operational risk.

From Vulnerability Management to Exploitation Prevention

Dragos emphasized that OT cybersecurity can't simply copy IT security models. 

A key example was this Mexican water utility case study. In that incident, an unknown adversary compromised the enterprise IT environment of a municipal water and drainage utility. Attackers used Claude and GPT models for reconnaissance, exploitation, and exfiltration. 

The most important lesson was not that artificial intelligence had created a new ICS (Industrial Control System)-specific attack capability. Rather, AI helped the adversary process information, build and refine tooling, identify OT-adjacent infrastructure, and investigate potential attack pathways. 

That matters for utilities because AI can lower the historical knowledge barrier that often made OT attacks more difficult. Public information, vendor references, technical terminology, system context, and internal data gathered after IT compromise can be interpreted and operationalized much more quickly. 

As Phil Tonkin, Field CTO at Dragos, noted: The traditional “security by obscurity” built on requiring deep engineering knowledge is starting to diminish.

But defenders have an advantage if they combine OT asset visibility, threat intelligence, proprietary operational data, and real-world incident response experience. The recent Accenture move to take a majority stake in Dragos is also a strong market signal: OT cybersecurity is becoming a strategic infrastructure priority, not a niche technical function. 

AI Can Make OT More Visible to Attackers

Cyolo reinforced that full OT isolation is no longer realistic for most utilities. Operations require remote access, vendor access, field support, and machine-to-machine connectivity. 

The question is how to secure that connectivity. 

As Almog Apirion, Co-Founder & CEO of Cyolo, said: “Connectivity can act as the security control plane.” 

Key priorities include verified identity, least privilege, and secure remote access, along with blocking unnecessary network discovery and reducing lateral movement. In such an environment, identity and access become core control points for network resilience.

Secure Connectivity Is a Control Point

During Q&A, the speakers also pointed to perimeter and edge devices -- including firewalls, VPNs, and remote access systems -- as likely targets for AI-accelerated attacks. 

The message was clear: While these aren't new attack paths, AI may make them faster and more scalable. Utilities need strong governance, better monitoring, and faster containment. 

One useful concept from the discussion was "mean time to contain." Although utilities may not be able to prevent every attempt, they must be able to contain risk quickly -- while maintaining safe and reliable operations. 

The Edge Is a Critical Risk Area

This session reinforced that OT cybersecurity is now a boardroom, control-room, and field-operations issue. AI-driven cyber risk affects asset visibility,  incident response, reliability, safety, and customer trust. 

The conversation will continue at the NGA Summit in Boston on September 16–17, including the panel “Beyond the Air Gap: AI, OT Cybersecurity & the Future of Critical Infrastructure.” 

The future of utility OT cybersecurity won't be defined by one tool or control. Instead, it will require better visibility, secure connectivity, stronger identity, and trusted collaboration across the utility ecosystem. 

The era of assuming the "air gap" is enough is over. The next phase of OT cybersecurity is about strategies that can move at the speed of the threat, while protecting the reliability and safety utilities are built to deliver. 

Beyond the Air Gap: Why Utility OT Cybersecurity Matters Now