Small Utilities Get a Free OT Shield, but the Access Gap Remains

A new effort to put industrial cybersecurity tools into small utilities, announced alongside a wave of attacks on water systems, highlights a widening gap in operational technology (OT) protection. The same week, regulators and industry bodies pointed to access control and remote-control risks in the systems that run control rooms and field equipment. For SCADA and control-room teams, the question is less about whether a monitoring platform exists and more about who can reach the control layer, and through which components.

A free defence layer for under-resourced utilities

Accenture, Dragos and the SANS Institute have launched a $10 million initiative to strengthen cyber defences for under-resourced U.S. water, electric and natural gas utilities, as reported by Industrial Cyber. In its first phase, the initiative will provide cybersecurity software, hardware, deployment services and SANS training free of charge to up to 500 under-resourced utilities. Elastic is supplying the primary log storage and query engine within the Dragos Platform, which is the technical base for delivering the software at scale.

The announcement cites a recent surge in cyberattacks targeting more than 100 U.S. water systems across more than a dozen states. The initiative's framing is specific to OT: the pumps, valves, substations and distribution networks that support essential services are described as vulnerable where smaller operators lack funding, workforce and modern technology. The foundation builds on the Dragos Community Defense Program, which already gives more than 100 utilities free access to the Dragos Platform.

The scale is meaningful, but so is the scope limit. Tens of thousands of small utilities exist in the U.S. alone, and a first phase reaching up to 500 covers only a fraction of them. The initiative also addresses tooling and training. It does not, on its own, change the architecture of legacy SCADA networks, remote access arrangements or vendor maintenance paths.

Access control is the recurring weak point

The governance signals from regulators point at the same surface. Utility Dive reports that the Federal Energy Regulatory Commission released a cybersecurity audit of critical infrastructure entities that found "increasing use of super intelligence" tools, warning that their "evolving capabilities may introduce access control risks." The same report cites a review of federal regulatory filings by Guardrail Technologies, which found that roughly 70% of energy and utility companies identified AI as a cybersecurity risk, but only 23% of utilities and 9% of energy companies documented a process for managing that risk.

For OT environments, this matters because AI tools that ingest operational data or connect to engineering systems extend the set of identities and integrations that can touch the control layer. The reporting also notes that most AI deployments in the sector remain niche tools that support human decisions on load forecasting and vegetation management, and that regulators in New York and Connecticut are moving to examine utility AI use. The access question therefore sits alongside the audit question: a utility needs to know what can reach its control systems before it can reconstruct what those systems did.

At the federal level, the U.S. Government Accountability Office has outlined a 2027-2032 agenda for congressional oversight of federal cyber defences, critical infrastructure protection and AI risks, as covered by Industrial Cyber. The public summary signals sustained oversight attention, though the detailed requirements sit in the full agenda.

Supply chain trust reaches the grid edge

OT risk is not limited to software and credentials. IEEE Spectrum reports that from 1 November, the EU will no longer pay for power inverters from "high-risk" suppliers on EU-funded grid projects, although member states may still fund them. The EU has assessed that such equipment can enable backdoors to remotely control or shut down grid infrastructure. Companies across the EU are reviewing supply chains and preparing to build with fewer Chinese components. The U.S. response is referenced in the same coverage, though the available detail is limited here.

Inverters are control-adjacent devices. They sit in the path of distributed generation and storage, and their remote management channels are part of the same attack surface that SCADA teams already defend. Treating them as ordinary electrical hardware, outside the OT security review, is the gap this policy move exposes.

What it means for utilities

Small and mid-sized utilities gain a funded route to OT monitoring, but the initiative provides tools and training rather than a complete control-system programme. Larger utilities should treat the access-control warnings as a prompt to inventory every remote path into SCADA, historian and engineering environments, including vendor logins and AI-enabled integrations. Procurement teams should extend supply chain review to inverters, gateways and any device with remote management capability, since regulators are now treating those as grid-security questions. Control-room leaders should also expect that audit evidence for OT security will be requested in the same way as audit evidence for AI systems.

Key takeaways

• A $10 million Accenture, Dragos and SANS initiative will offer free OT security tools and training to up to 500 under-resourced U.S. utilities in its first phase.
• The initiative responds to attacks on more than 100 U.S. water systems, and it targets pumps, valves, substations and distribution networks.
• FERC's audit warning on access control risks from AI tools points to identity and integration governance as a core OT issue.
• Only a minority of utilities documented a process for managing AI-related cyber risk, according to the cited filings review.
• The EU's restriction on high-risk inverters from 1 November shows that remote-control capability in grid hardware is now a supply chain security matter.
• Utilities should map remote access paths and include inverters and gateways in OT security reviews.

Sources

• Accenture, Dragos and SANS Institute launch $10 million initiative to strengthen cybersecurity at US utilities
• GAO outlines 2027-2032 agenda for congressional oversight of federal cyber defenses, critical infrastructure, AI risks
• Utilities turn to AI to manage rising power demand — from AI
• EU and U.S. Power Firms Scrutinize Supply Chains for Chinese Parts