I spent the better part of last month helping a regional power company patch vulnerabilities in their control systems. Not because they didn’t care about security—they did. But they’d been so focused on modernizing their infrastructure that cybersecurity got pushed to the side. This tension between moving fast and staying secure isn’t unique to that one company. It’s becoming the defining challenge across the utilities sector right now.
The Speed Problem
Utilities are under immense pressure to digitize. Smart grids, remote monitoring, cloud migration, IoT sensors—these upgrades promise efficiency gains and cost savings. The business case is real. But here’s what I’ve seen repeatedly: when you’re moving that fast, security becomes an afterthought rather than a design principle.
I’ve walked into control rooms where critical infrastructure was connected to systems that should never have been exposed to the internet. Not out of negligence, but because the team was focused on getting new capabilities online. They were hitting deadlines and delivering functionality. Security review? That came later. Sometimes much later.
The problem is that “later” might be too late in this industry. We’re not talking about a data breach affecting customer records. A serious breach in a utility’s operational technology could affect power distribution, water treatment, or gas supply to thousands of people. The stakes are fundamentally different than in most other sectors.
Why Traditional Security Approaches Don’t Work Here
Most of the security frameworks we use in software engineering were built for business systems. You can patch a web server. You can take a database offline for maintenance. But critical utility infrastructure often runs on systems that were designed to stay running 24/7 without interruption. Some of that equipment is 10, 15, even 20 years old. You can’t just swap it out.
I worked with a team that inherited SCADA systems running software from the early 2000s. The original vendor was out of business. Patches? Unlikely. Replacing the system meant months of planning, testing, and coordination to avoid downtime. Meanwhile, they had to find ways to secure something that wasn’t designed with modern security in mind.
Add to this the complexity of interconnected systems. Utilities don’t operate in isolation. They’re connected to other utilities, to regulators, to third-party vendors. Each connection is a potential entry point for an attacker. Each integration requires security consideration.
The Resource Reality
Here’s something that doesn’t get discussed enough: most utility companies don’t have cybersecurity talent in abundance. They’re competing with tech companies and financial institutions for skilled engineers. A security architect can make significantly more working at a big tech firm than at a regional utility. So utilities often have smaller, stretched teams trying to cover massive attack surfaces.
I’ve seen brilliant engineers do remarkable work despite being understaffed. But there’s a limit to what one or two people can accomplish when they’re responsible for securing systems that millions of people depend on. You can’t code your way out of a staffing problem.
The costs add up quickly too. Modern security infrastructure—threat detection, vulnerability scanning, security testing, incident response—these things cost money. For utilities operating on thin margins, it’s easy to see security spending as a drag on profitability rather than essential risk management.
What Needs to Change
The utilities that are handling this well treat security as a project requirement from day one, not an afterthought. They’re building security into their digital transformation plans upfront. They’re investing in their people. They’re also being realistic about what they can secure with their current resources and making tough choices about what gets prioritized.
Regulation is helping here too. Compliance requirements force attention on security even when budgets are tight. But compliance is a minimum. The real win comes when organizations see security as an enabler rather than a cost center.
The tension between speed and security in utilities is real and it’s not going away. The infrastructure keeps getting more connected, the threats keep getting more sophisticated, and the expectations keep climbing. Companies that figure out how to move fast without cutting corners on security will be the ones that thrive. The rest will be managing incidents instead of preventing them.
Source: Cybersecurity pressures mount for global utilities
Rachel Adams
Chris Sullivan