People remain an important pathway into energy-sector cyber risk, but available evidence does not prove that human actions are the biggest risk—or that they outweigh AI-enabled attacks or other technical threats. “Rogue AI” is not one threat category: AI can fail accidentally, be attacked, be used by hostile actors, or be compromised through its software supply chain. The practical answer is to manage people, technology and operational systems together.
What does “human risk” mean in energy cybersecurity?
It can mean several different things, and treating them as one problem leads to poor conclusions and controls:
As an Amazon Associate I earn from qualifying purchases.
- Accidental involvement: someone falls for social engineering, mishandles credentials, or makes an error that creates an opening or disrupts operations.
- Malicious insider activity: a trusted person deliberately misuses authorized access or knowledge.
- External human attackers: people or groups target an organization through phishing, exploited software, stolen credentials, or other means.
- AI-enabled activity: AI may assist an attacker, or an AI system may fail, be manipulated, or be compromised. The actor, method and affected system differ by case.
Verizon’s 2024 Data Breach Investigations Report (DBIR) defines the “human element” broadly: it includes non-malicious involvement such as social-engineering victims and errors. Its finding that 68% of breaches involved a non-malicious human element applies to Verizon’s global breach dataset—not an energy-sector sample and not a measure of the share of energy-system risk attributable to people. It also does not mean that 68% of breaches were caused by malicious employees.
CISA’s insider-threat guidance addresses a different issue: how organizations can identify and mitigate deliberate insider risks. CISA recommends involving human-resources professionals in multidisciplinary threat-management teams, where they can help identify relevant patterns in personnel information. That is a case for coordinated, proportionate risk management, not for treating ordinary employees as presumptively malicious.
#1 Best Overall
Why can’t we say people are the biggest risk?
To call one threat the “biggest,” the comparison needs a consistent measure—such as incident frequency, likelihood of disruption, financial impact, or risk to safety—and comparable evidence for each threat. The available figures do not provide that comparison for energy systems. Verizon’s breach statistics are cross-industry, while the Department of Energy’s (DOE) energy-specific AI assessment catalogs risk categories rather than ranking AI against human error or insider activity.
Verizon’s 2026 DBIR page reports that 31% of breaches started with software vulnerabilities and that mobile social-engineering attacks had a 40% higher click rate than traditional email phishing. These are Verizon’s global, cross-industry figures, not energy-sector measurements. The report covers incidents from November 1, 2024, through October 31, 2025. The two percentages describe different things: one concerns breach starting points, while the other compares click rates. Neither can be set against the 2024 human-element statistic as though all three shared a denominator or ranked competing causes of energy incidents.
Energy organizations also face risks that breach counts alone cannot capture. A compromised corporate account, an exposed operational-technology system, and a failure that affects electricity delivery are not equivalent outcomes. Energy-sector threat assessment must consider operational disruption, reliability and safety alongside data theft.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteHow can human actions affect energy operations?
Electricity organizations span generation, transmission, distribution and marketing, as well as the vendors and other organizations that support those functions. Their environments combine corporate information technology (IT), operational technology (OT) and industrial control systems (ICS), alongside physical access to facilities and equipment. An action that begins in one layer can matter elsewhere, which is why security cannot stop at employee awareness or the corporate network perimeter.
Rank #3
A CISA, FBI and DOE advisory, last revised March 24, 2022, documented state-sponsored campaigns from 2011–2018 against U.S. and international energy organizations. That history shows that capable external actors have targeted the sector; it does not establish that employees were the dominant cause of those campaigns. The advisory recommends measures including IT/ICS segmentation, multifactor authentication (MFA) and management of privileged accounts.
DOE’s electricity-subsector Cybersecurity Risk Management Process guideline, released May 23, 2012 and developed with NIST and NERC, treats cybersecurity as part of enterprise risk management. Its central implication is practical: organizations make informed decisions to manage risk, rather than expecting to eliminate it entirely.
Can “rogue AI” hack the power grid?
“Rogue AI” is too vague to answer safely. DOE’s initial AI assessment, published April 29, 2024, identifies several distinct risk modes for the energy sector:
- Unintentional AI failure: an AI system behaves incorrectly or unreliably in a way that creates operational or security consequences.
- Adversarial attacks against AI: an attacker manipulates or exploits an AI system or its inputs.
- Hostile uses of AI: people use AI as part of an attack or other harmful activity.
- AI software supply-chain compromise: compromised software or components undermine an AI system.
These categories involve different actors, failure modes and safeguards. A system malfunction is not the same as an autonomous system choosing to attack, and an attacker using AI is not evidence that AI itself is acting independently. The 2024 DOE document was described as an initial, interim assessment; its announcement said an updated assessment would follow by the end of that year. It should not be presented as a final assessment or as proof that AI is more—or less—dangerous than human-linked threats.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What protections address both people and technical attack paths?
Energy-sector guidance points toward layered controls rather than a single fix. The measures below address different openings and should be selected and maintained as part of an organization’s risk-management program.
Best Value
- Separate IT from ICS and OT where appropriate. Segmentation can limit how far an intrusion travels between environments and help protect operational systems from compromises elsewhere.
- Use MFA and tightly manage privileged accounts. These measures make stolen credentials less useful and reduce unnecessary or excessive access. Privileged access should be controlled and reviewed, not treated like ordinary day-to-day access.
- Build visibility across OT, IT and physical access. NIST Special Publication 1800-7, published August 7, 2019, describes a modular example utility solution for situational awareness across these areas. NIST expressly does not endorse the example products; the guide is useful as an architectural example, not a product recommendation.
- Assess risk continuously and share relevant information. DOE describes ongoing assessment of threats and vulnerabilities and information sharing as parts of energy-sector preparedness. Its Cybersecurity Risk Management Maturity Model (C2M2) and the public-private Cybersecurity Risk Information Sharing Program (CRISP) are among the mechanisms it identifies. DOE says current CRISP participants provide power to over 75% of continental U.S. electricity-subsector customers; that is a reported program-coverage figure, not a measure of security outcomes or human-risk prevalence.
- Include insider-risk expertise without blaming the workforce. CISA’s guidance supports involving HR and other relevant functions in threat-management teams. Clear processes for escalating concerns should sit alongside fair treatment, appropriate privacy safeguards and technical access controls.
- Train for realistic human-facing attacks, but do not rely on training alone. Social engineering can exploit people, yet segmentation, MFA, account controls and monitoring address the systems and access paths that make a mistake consequential.
How should energy organizations judge the claim?
Ask what “biggest” means before accepting a ranking. Frequency of attempted attacks, successful compromise, operational impact and potential safety consequences are different measures. Then check whether the evidence is specific to energy organizations, which systems and regions it covers, and whether it distinguishes accidental error, malicious insiders, external attackers and AI-related mechanisms.
On the evidence cited here, people are an important part of the energy-sector threat picture, but there is no defensible sector-wide ranking that makes them the single biggest cybersecurity risk or proves that they outweigh AI-related risks. Security decisions should follow the threat pathways and operational consequences an organization can actually assess, using layered protections across people, IT, OT/ICS, AI systems and physical access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
