AI-driven energy buildout raises cybersecurity, supply chain risks | analysis | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

The rapid expansion of artificial intelligence infrastructure could make the U.S. electric grid more resilient, but policymakers must carefully manage cybersecurity and supply chain risks as the country becomes increasingly dependent on digitally connected energy technology, experts said during a panel on AI and industrial strategy.The discussion at an Institute for Critical Infrastructure Technology (ICIT) panel on June 10, 2026, focused on “electrotech,” a broad category of technologies including batteries, virtual power plants and other digitally enabled systems increasingly underpinning energy infrastructure, transportation, communications and defense. Panelists said the same technologies that could improve grid security could also expand its attack surface and increase dependence on components sourced from China.Phoebe Vencill, a fellow at Carnegie Mellon University’s Institute for Strategy and Technology and former director for strategic risk at the White House Office of the National Cyber Director, said digitally native energy systems can offer security advantages over legacy infrastructure. Modern systems can support capabilities such as automated monitoring and patching and provide forensic records when incidents occur.However, Vencill distinguished between several risks posed by reliance on Chinese technology. Cyber threats could have immediate consequences if attackers gained access to grid-connected systems, while economic dependence could hamper future deployments if supplies were disrupted. Vendor access to firmware for diagnostics and updates could create another potential avenue for compromise.David Mussington, a University of Maryland professor and former CISA executive assistant director for infrastructure security, said AI is accelerating vulnerability discovery and exploitation. He urged critical infrastructure operators to address existing cybersecurity weaknesses before attackers can increasingly use AI to exploit them at scale.

Mussington also called for critical infrastructure defenders, including organizations serving rural communities, to receive access to advanced AI models for cybersecurity. Otherwise, poorly resourced operators could face rapidly expanding vulnerabilities without comparable defensive capabilities.Vencill cautioned policymakers against imposing blanket restrictions on Chinese components, arguing that such measures could slow infrastructure development without adequately addressing the technologies posing the greatest security risks.Instead, she advocated prioritizing components according to deployment urgency, technical risk and their importance to U.S. industrial competitiveness. Sensitive control systems could require domestic sourcing, while other technologies could come from allies or be procured globally with appropriate transparency and testing requirements.The outcome of the AI-driven infrastructure buildout remains uncertain, panelists said, with decisions made now determining whether greater digitization ultimately strengthens critical infrastructure or leaves it more exposed.