Grid Defenders Say the Predator Problem Predates AI
Recent hacks have put AI at the center of the cyber debate, but security veteran Joshua Corman argues energy systems were exposed long before — and the risk keeps growing.
Joshua Corman, executive in residence for public safety and resilience, says energy systems were already dangerously exposed to cyberattack before recent high-profile hacks raised fears about AI, telling The Verge: "We were always prey. We were just kind of surviving at the appetite of our predators."
The arrival of capable AI tools in the hands of attackers has given the energy sector a fresh villain to point at. It has not given it a new problem. According to Joshua Corman, executive in residence for public safety and resilience, the grid and the companies that run it were already living on borrowed time long before any model was pointed at an industrial control system.
"We were always prey. We were just kind of surviving at the appetite of our predators," Corman told The Verge. It is a blunt framing, and a deliberately unflattering one. The implication is that the energy sector's safety record on cybersecurity has been less a function of good defense than of attackers choosing, for their own reasons, not to press.
Why the AI framing flatters everyone involved
Recent high-profile breaches have pushed AI to the center of the cybersecurity conversation, and the speculative end of that conversation — machines with agency, machines with intent — tends to crowd out the mundane end. The mundane end is where the damage happens. Unpatched software. Remote access left open for a contractor. Equipment whose vendor stopped shipping security updates a decade ago but which still sits in a substation because replacing it means an outage nobody wants to schedule.
The AI story is attractive because it is exculpatory. If the threat is a novel superhuman capability, then the failure to stop it is forgivable. If the threat is a human being using stolen credentials on a system that should have had multi-factor authentication, the failure belongs to a budget line and the executive who approved it. Corman's point cuts toward the second reading: the exposure predates the tooling, and the tooling mostly makes existing exposure cheaper to exploit at scale.
That distinction matters for how utilities and their regulators respond. A defense posture built around an exotic adversary buys exotic products. A defense posture built around the honest inventory of what is actually connected, and to what, buys asset discovery, network segmentation and patch discipline — less marketable, more effective.
Energy is where cyber risk becomes physical risk
Most industries treat a breach as a data problem: records exposed, notification letters, a regulatory fine, a reputational bruise. Energy does not have that luxury. A successful intrusion into operational technology — the controllers, relays and supervisory systems that actually move electricity and fuel — can end in equipment damage, an outage, or a safety event. The consequence is measured in hours without power and in whatever depends on that power: water treatment, hospital backup capacity, cold storage, heating in winter.
That is also why the energy sector's exposure is growing rather than shrinking, even as spending rises. The grid is being asked to absorb more distributed generation, more storage, more smart metering and more remote control, each addition a new device with a network connection and a firmware update cycle. The attack surface expands as a direct consequence of modernization. The same is true of the surge in large-load interconnections — data centers among them — that puts new, digitally managed infrastructure on the network at speed.
The asymmetry Corman describes is structural. A utility must defend every controller, every vendor relationship and every remote access path continuously. An attacker needs one that was missed. Nothing about AI changes that arithmetic; it simply lowers the cost of searching for the one that was missed.
The spending response and where it actually lands
Grid operators have been raising security budgets for years, and the money increasingly flows through rate cases — meaning ratepayers ultimately fund it, subject to regulators agreeing the spend was prudent. That creates a peculiar dynamic. Cybersecurity investment produces no visible output when it works. Its return is an absence: the outage that did not occur, the substation that did not trip. Regulators are being asked to approve capital against a counterfactual, and utilities are being asked to justify one.
Its return is an absence: the outage that did not occur, the substation that did not trip.
The practical consequence is that the spending tends to concentrate where compliance rules are explicit and auditable, and to thin out where they are not. Bulk power systems carry mandatory reliability standards. Distribution assets, municipal utilities and smaller cooperatives often do not carry the same obligations, and frequently lack dedicated security staff at all. The predator, to use Corman's word, does not respect that jurisdictional line.
For the listed cybersecurity and industrial software vendors that sell into this market, the demand backdrop is durable for exactly the reason the risk is uncomfortable: the exposure is growing faster than remediation. But investors should be careful about reading incident headlines as immediate order flow. Utility procurement cycles are long, capital plans are filed years ahead, and a breach at one operator tends to show up in another's budget several quarters later, if at all.
A market that has other things on its mind
None of this is currently a market-moving narrative. At the last close on Friday 18 September 2026, the S&P 500 tracker (NYSEARCA: SPY) finished at $761.69, down 0.12% from the prior close of $762.60, with a day range of $757.97 to $762.00. The Nasdaq 100 tracker (QQQ) closed at $721.45, up 0.63% against a prior close of $716.92 and a range of $715.08 to $721.73. The Dow 30 tracker (DIA) ended at $515.88, off 0.48% from $518.35.
That split — technology firm, the industrial-weighted index soft — is a reasonable picture of where attention sits. Infrastructure resilience is not a theme equities price in advance. It gets priced after an event, abruptly, and usually in the wrong names.
What would signal the posture is actually changing
Several things are worth tracking for anyone trying to judge whether the sector is closing the gap Corman describes, rather than simply narrating it.
- Rate case outcomes. Whether regulators approve security capital at the amounts requested, and whether they begin requiring it rather than merely permitting it.
- Coverage of smaller operators. Municipal utilities and cooperatives sit outside much of the mandatory standards regime. Any move to extend obligations, or to fund shared security services for them, would matter more than another enterprise procurement at a large investor-owned utility.
- Legacy equipment replacement. The hardest problem in operational technology is gear that cannot be patched and cannot easily be taken offline. Replacement schedules are the honest measure of intent.
- Vendor and contractor access. Third-party remote access has been a recurring route into industrial environments. Tightening it is unglamorous and highly effective.
The uncomfortable implication of Corman's framing is that the sector's clean stretches were never evidence of adequate defense. They were evidence that nobody with sufficient capability had decided the moment was right. The variable that changed is the attacker's appetite and cost base — not, so far, anything about the prey.
Key facts
- Quoted: Joshua Corman, executive in residence for public safety and resilience
- S&P 500 (SPY): $761.69, -0.12%, close of 18 Sep 2026 20:00 GMT
- Nasdaq 100 (QQQ): $721.45, +0.63% at the same close
- Core claim: Energy systems were already vulnerable before AI-linked hacks, and the risk is growing
Frequently asked questions
What did Joshua Corman actually say about energy cybersecurity?
Corman, executive in residence for public safety and resilience, said of the energy sector's exposure: "We were always prey. We were just kind of surviving at the appetite of our predators." His argument is that energy systems were already dangerously vulnerable to cyberattack before recent high-profile hacks raised concerns about artificial intelligence, and that the underlying risk continues to grow.
Does AI make grid cyberattacks fundamentally different?
On the evidence in this story, no. The vulnerabilities being exploited — unpatched systems, exposed remote access, legacy equipment that cannot be updated — existed before AI tools were widely available. What AI plausibly changes is the cost and speed of finding and exploiting those weaknesses, not their existence. The framing risk is that an exotic threat narrative distracts from basic remediation.
Why is a cyberattack on energy infrastructure worse than a data breach?
Most breaches expose information. An intrusion into operational technology — the controllers and supervisory systems that physically move electricity and fuel — can cause equipment damage, outages or safety incidents. The consequences cascade into water treatment, hospitals, cold storage and heating, so the harm is physical and immediate rather than administrative.
Who pays for utility cybersecurity spending?
In regulated markets, security investment typically flows through rate cases, meaning ratepayers fund it once regulators agree the expenditure was prudent. That creates a difficult approval problem: successful cybersecurity produces no visible output. Its return is the outage that never happened, so utilities must justify capital against a counterfactual that cannot be demonstrated.
Why are smaller utilities considered a weak point?
Bulk power systems in the United States are covered by mandatory reliability standards that are audited. Distribution assets, municipal utilities and rural cooperatives often fall outside the same obligations and frequently have no dedicated security staff. Attackers do not respect that jurisdictional boundary, so coverage gaps at smaller operators represent a meaningful part of the overall exposure.
How did the major index trackers close most recently?
As of the last trade on 18 September 2026 at 20:00 GMT, the S&P 500 tracker SPY closed at $761.69, down 0.12% from a prior close of $762.60. The Nasdaq 100 tracker QQQ closed at $721.45, up 0.63% from $716.92. The Dow 30 tracker DIA finished at $515.88, down 0.48% from $518.35.
