Humans, not rogue AI, are still the biggest cybersecurity risk to energy systems

In an era increasingly dominated by discussions around advanced artificial intelligence and its potential existential risks, a critical, often overlooked truth persists: humans, not rogue AI, remain the most significant cybersecurity vulnerability for global energy systems. While recent high-profile hacks and speculative fears about AI possibly 'killing all humans' capture headlines, the foundational fragility of our critical infrastructure to human-driven cyberattacks continues to grow. Joshua Corman, an executive in residence for public safety and resilience at the Institute for Security and Technology (IST), succinctly captured this enduring predicament last year. 'We were always prey. We were just kind of surviving at the appetite of our predators,' he stated, highlighting the perpetual state of vulnerability that predates the current AI discourse. This perspective underscores that the threat landscape has long been shaped by human adversaries, whether they are state-sponsored actors, cybercriminals, or even insiders. Indeed, the focus on human threats is not new. Just last year, concerns were heavily centered on a Department of Homeland Security warning regarding potential cyberattacks from Iranian actors and sympathizers targeting US energy infrastructure. Such warnings serve as a stark reminder that nation-state capabilities and human intent have historically posed, and continue to pose, a tangible and immediate danger. The recent surge in discussions around 'rogue AI' incidents, while warranting attention for future preparedness, risks diverting focus from these established and ongoing human-centric threats. As the author recently discussed with Corman, the allure of a novel, technologically advanced adversary can overshadow the persistent reality that human error, malicious human intent, and sophisticated human-led campaigns are still the primary vectors for compromise in critical sectors like energy. Securing these vital systems demands a continued, robust emphasis on mitigating human vulnerabilities, alongside strategic planning for emerging AI-related risks.