NERC’s E-ISAC logged more than 3,500 physical security breaches against the North American grid in 2025. That’s up from 2,800 incidents reported in 2023. The Western Interconnection alone saw reported physical security incidents more than double from 107 in 2023 to 220 in 2024, although WECC says much of that increase was driven by a rise in minor incidents reported by a single entity.
About 3% of reported incidents disrupted electricity. That may sound small, but physical attacks have produced serious consequences: a 2022 attack on substations in Moore County, North Carolina, left roughly 45,000 customers without power for several days, while the 2013 attack on PG&E’s Metcalf substation in California damaged 17 transformers and caused an estimated $15 million in damage.
Every trade outlet from IEEE Spectrum to Utility Dive is covering it right now, and they’re right to. But what that reporting can’t capture is where most of these vulnerabilities actually start: not after a substation goes live, but during the 18 to 36 months it takes to build one.
Key Takeaways
- Physical attacks on the grid rose from roughly 2,800 in 2023 to over 3,500 in 2025, and the Western Interconnection alone saw incidents more than double in a single year.
- NERC CIP-014 governs how utilities secure operational substations — but it only applies once a facility is classified as critical and energized. Construction sites building that same substation aren’t covered by it yet.
- Copper and equipment theft, not sabotage, is the daily-grind threat most energy and utility security programs actually deal with — and it’s worst during active construction, when materials are staged and fencing is incomplete.
- Traditional CCTV at these sites records; it doesn’t detect. By the time footage gets reviewed after an incident, the copper’s at a scrap yard and the schedule’s already slipping.
- Data center growth is the biggest driver of new substation and transmission construction right now, which means more energy infrastructure sitting in this unprotected, pre-energization window than at any point in the last decade.
- The fix isn’t more fencing; it’s live visibility paired with AI-based detection that flags an intrusion the moment it happens, not the next morning.
What “Energy Sector Security” Actually Covers
Energy sector security gets used as a catch-all, but it spans a few genuinely different problems, and mixing them up leads to the wrong fix:
- Generation security — power plants, solar farms, and increasingly battery storage sites, where the concern is sabotage, trespassing, and equipment tampering.
- Transmission and substation security — the piece getting the most regulatory attention, governed largely by NERC CIP-014 for critical bulk-electric-system facilities.
- Distribution security — the smaller, more numerous, less-monitored substations and lines that don’t meet CIP-014’s criticality threshold but still get hit by copper theft and vandalism constantly.
- Control center and cyber-physical security — SCADA systems and the physical facilities that house them, covered under CIP-006 and related standards.
- Construction-phase security — the site as it’s being built, before any of the above compliance frameworks apply, and before permanent fencing, live-monitored cameras, or access control are even installed.
That last category is the one almost nobody writes about, and it’s the one I spend the most time on.
Why This Is Accelerating Right Now
Everyone’s talking about AI data centers. Almost nobody’s connecting that to what it takes to power one.
A single hyperscale campus can require hundreds of megawatts, which means new substations, new transmission interconnects, and upgraded distribution, often built on a compressed timeline because the data center behind it has a delivery date to hit. That’s a lot more energy infrastructure under active construction, simultaneously, than the grid has had to build in a long time.
Here’s the thing: none of that new infrastructure is protected by NERC CIP-014 until it’s classified, energized, and operational. During construction, it’s staged materials, open trenches, and a rotating cast of subcontractors; the exact profile copper thieves and vandals look for, with none of the compliance-driven security controls in place yet.
Where Traditional Security Falls Apart on These Sites
- A fence is a delay. It doesn’t detect. Perimeter fencing is step one on almost every energy construction site, and it’s necessary. It’s also not sufficient; a fence buys minutes, not protection, and by itself it tells you nothing about what happened after the fact.
- Cameras that only record aren’t security; they’re a police report. Traditional CCTV on these sites runs the same way it has for twenty years: continuous recording to a local DVR, reviewed only after someone notices something’s wrong. By the time anyone pulls the footage, the copper’s gone and the repair bill is climbing.
- Unmanned sites at night are the highest-risk window, and almost nobody’s watching them live. Energy construction sites are frequently remote, often unmanned after hours, and spread across acreage that makes physical patrol impractical. That’s precisely when incidents happen.
- Nobody owns the in-between. A superintendent owns the active build. A utility’s security team owns the facility once it’s energized. The months in between; where the site is real, valuable, and vulnerable, but not yet “critical infrastructure” on paper often don’t have a clear owner at all.
Energy & Utility Security Solutions That Actually Hold Up
NERC’s own framework for operational substations breaks physical security into six actions: deter, detect, delay, assess, communicate, and respond. It’s a good model, and it applies just as well to the construction phase, if you build it in from day one instead of waiting for energization to require it.
Deter and detect together, not sequentially. Live, AI-monitored camera coverage does both at once; visible cameras deter opportunistic theft, and motion/AI-based alerting means an intrusion gets flagged in real time instead of discovered the next morning. TrueLook’s TrueShield setup is built around exactly this: a multi-camera, IR-enabled system with 360° site coverage designed to meet builder’s risk insurance requirements, not just check a compliance box.
Assess and communicate faster than a human can drive to the site. Remote live viewing lets a security team or project manager pull up the feed the moment an alert fires, from anywhere, and make the call on dispatch without waiting on someone to physically respond first.
Document everything, continuously. Time-lapse and continuous recording aren’t just a security layer. On energy infrastructure builds, that same footage becomes the record for contractor accountability, change order disputes, and incident documentation if something does go wrong.
Build it for conditions these standard sensors weren’t designed for. Heat, remote power access, weather, and the electromagnetic environment near energized or soon-to-be-energized equipment disqualify a lot of standard security tech. Solar-powered, cellular-connected camera systems solve the power and connectivity problem that’s specific to remote transmission and substation sites — no trenching, no temporary power hookup, and full functionality on sites without grid access yet.
Where It Goes Sideways And What Actually Fixes It
- Copper and ground-grid theft — Thieves cut the fence, strip copper, and are gone in minutes. Fix: AI-based motion detection with real-time alerts, not footage reviewed after the fact.
- Too many remote sites, not enough windshield time — Security personnel can’t physically patrol every substation and transmission segment under construction across a large territory. Fix: Centralized remote monitoring across every active site from one dashboard.
- No power, no connectivity — Rural transmission corridors and greenfield substation sites often have neither. Fix: Solar-powered, cellular-connected systems that don’t depend on site infrastructure that isn’t built yet.
- Documentation gaps after an incident — Without continuous footage, “what happened” becomes a he-said-she-said between contractors, insurers, and the utility. Fix: Continuous recording plus time-lapse, retained and accessible on demand.
- Nobody assigned to own security during the build — The gap between “construction site” and “critical infrastructure” falls through the cracks organizationally. Fix: Bring visibility online at mobilization, not after an incident forces the conversation.
Building energy infrastructure right now?
Let’s talk about what full site-visibility looks like on a project like yours.
FAQ
CIP-014 is the NERC reliability standard requiring utilities to identify critical transmission substations, assess physical security risk, and implement a documented physical security plan covering deterrence, detection, delay, assessment, communication, and response.
No. CIP-014 applies once a facility is classified as a critical transmission station and energized. Sites under active construction fall outside that compliance requirement, even though the physical assets on-site already have real value and real exposure.
Solar-powered, AI-enabled camera systems for construction and utility sites typically run in the range of a few hundred to a few thousand dollars a month depending on site count, camera type, and monitoring needs; a fraction of the cost of a single copper theft incident or transformer replacement, which can run into six figures and 80+ weeks of lead time to replace.
Copper and equipment theft from unmanned, partially fenced sites overnight; not sabotage. It’s the least dramatic risk and the most consistent one.
