Utilities Shift Cyber Budgets to Survival Mode as Mutual Aid Risks Collapse

BETHESDA, MD – October 15, 2026 – For decades, the foundational strategy of North American critical infrastructure defense has rested on a comforting assumption: if a catastrophic cyberattack strikes a power grid or water system, neighboring utilities and federal agencies will rush in to help restore operations. Today, that assumption is being systematically dismantled.

As geopolitical tensions escalate, the cybersecurity paradigm for industrial control systems and operational technology is undergoing a radical, expensive transformation. The focus is no longer merely on keeping hackers out of the network. Instead, corporate boards and security chiefs are increasingly operating under the chilling premise that sophisticated nation-state actors are already inside, quietly mapping substations and control centers in preparation for simultaneous, multi-regional disruptions.

This strategic pivot will be the focal point of a highly anticipated executive roundtable hosted by the SANS Institute on October 27, bringing together security leaders from FirstEnergy, Dragos, MITRE, and SANS. The underlying message of the upcoming session signals a critical shift in business momentum for the energy sector: the era of relying on shared industry mutual aid is ending, and the era of autonomous, degraded-state survival has begun.

"We all depend on electricity, we all depend on clean drinking water, we want the ability to pull cash out of the ATMs," said Brian Harrell, Vice President and Chief Security Officer at FirstEnergy, in a statement preceding the event. "And as our nation-state adversaries decide that they want to prepare for war, they are also prepping the battlefield."

When Mutual Aid Fails: Planning for Total Cyber Isolation

Historically, the utility sector has leaned heavily on frameworks like the Cyber Mutual Assistance program, facilitated by industry groups and supported by the Department of Energy. Modeled after the physical mutual aid networks that deploy fleets of utility trucks across state lines after a hurricane, these programs are designed to pool specialized cybersecurity talent and resources during an incident.

However, the threat vectors have evolved far beyond localized, isolated incidents. Advanced Persistent Threats linked to nation-states possess the capability to execute coordinated campaigns that strike multiple operators simultaneously. In such a scenario, the mutual aid system would face catastrophic bottlenecks. If every major utility in a region is fighting to purge adversaries from their operational networks at the exact same time, external reinforcements will simply be unavailable.

"A coordinated campaign can strain the same responders and mutual aid that many organizations are counting on at the same time," noted Tim Conway, SANS ICS Curriculum Lead and SANS Fellow. "That puts more weight on what each organization can do for itself, so we want operations and security teams working from the same priorities ahead of time."

This stark reality is forcing a rewrite of enterprise incident response playbooks. Infrastructure operators are being urged to engineer systems and train personnel to maintain critical service delivery while completely isolated from external networks and support. This degraded-state operations approach requires facilities to function manually or semi-autonomously for weeks, rather than days, when conventional enterprise communications are severed and digital control systems are compromised.

The CIP-015 Reality Check: Mandating Internal Network Visibility

The strategic shift toward autonomous resilience is not happening in a regulatory vacuum. It is being aggressively accelerated by stringent new compliance mandates that are driving significant capital expenditures across the energy sector. Chief among these is the North American Electric Reliability Corporation Critical Infrastructure Protection standard, specifically the newly introduced CIP-015.

Moving away from the traditional perimeter defense approach, CIP-015 mandates Internal Network Security Monitoring for the Bulk Electric System. The objective is to detect east-west traffic—the lateral movement of an adversary who has already breached the perimeter and is navigating between internal trusted systems to establish persistence.

Regulatory experts warn that the clock is already ticking. CIP-015-1, which targets High Impact and Medium Impact systems with external connectivity at control centers, carries an enforceable compliance deadline of October 1, 2028. Its successor, CIP-015-2, drastically expands the scope to include electronic and physical access control systems, taking effect in October 2029 with phased implementation stretching into 2031.

Complying with these mandates requires a massive financial and operational lift. Traditional IT monitoring tools are notoriously disruptive and often incompatible with sensitive, legacy industrial environments. Utilities are being forced to procure specialized, passive monitoring sensors, upgrade legacy network switches that lack necessary port mirroring capabilities, and navigate the complex installation of fiber optic taps. Furthermore, these technical deployments often necessitate scheduled outages of operational facilities, requiring intricate coordination between security and engineering teams to avoid disrupting the grid.

To bridge the knowledge gap, training organizations are rapidly updating their curricula. The upcoming SANS roundtable coincides with an overhaul of its ICS456: Essentials for NERC Critical Infrastructure Protection course, aligning it with the impending Bulk Electric System requirements. The updated training, co-authored by Conway, specifically addresses internal network monitoring, virtualization, and the management of lower-risk sites, providing rebuilt virtual labs and audit trend analysis to help compliance teams navigate impending federal audits.

Budgeting for the Worst Case: Financing Battlefield Conditions

The intersection of escalating nation-state threats and stringent new regulatory mandates is creating a profound financial challenge for utility executives. Securing the necessary capital to build out internal network visibility and degraded-state operational capabilities requires navigating complex corporate and regulatory bureaucracies.

For investor-owned utilities, capital investments and operating expenses are typically recovered through rate cases presented to State Public Utility Commissions. Historically, these commissions are highly sensitive to consumer rate increases and demand rigorous justification for new expenditures. Security chiefs must now translate geopolitical threat intelligence—such as federal advisories detailing adversary pre-positioning—into compelling business cases that justify unprecedented resilience spending to regulators concerned primarily with local consumer costs.

Within the corporate boardroom, the conversation is equally challenging. Cybersecurity has traditionally been viewed as a cost center focused on preventing breaches. Now, executives must ask for millions of dollars to prepare for the inevitability that breaches will occur and to ensure the business can survive them operationally.

The timing for these budget requests is critical. "Now is the opportunity under blue sky conditions, so to speak, to ask for the budget dollars for next year," Harrell advised leaders who are currently evaluating their defensive toolsets.

Industry analysts anticipate that the 2026 State of ICS/OT Security Report, scheduled for release on November 10, will shed further light on these financial dynamics. Early indicators suggest a growing industry trend toward cyber-informed engineering, which involves embedding security and resilience directly into the physical design and operation of industrial systems from the outset, rather than bolting it on after the fact.

Furthermore, the budgetary strain is compounded by a severe talent shortage. Recent industry workforce data indicates that a majority of organizations view the critical skills gap in operational technology security as a far greater hurdle than simple headcount shortages. Building a resilient infrastructure requires not just new hardware, but heavy investments in specialized training to cultivate personnel capable of operating industrial grids under active, sustained cyber siege.

As the sector braces for a future where digital battlefields overlap directly with physical infrastructure, the financial and strategic momentum is clear. The organizations that will maintain market confidence and operational integrity are those currently leveraging peacetime to secure the budgets, deploy the internal sensors, and train the personnel required to keep the lights on when the network goes dark.