How can utilities modernize the grid without increasing cyber risk?

As energy networks become more digital, utilities are facing a difficult balancing act. Rising electricity demand is accelerating grid modernization, with utilities needing to enable more generation connections and serve growing demand, while operating more efficiently. This is driving greater digitization, information technology and operational technology (IT/OT) convergence and remote access, expanding the potential attack surface across systems not originally designed for today’s level of connectivity. That’s where the biggest challenge sits. Grid modernization is more than an engineering or technology program — it’s also a cyber resilience initiative. 

For many utilities, operational technology cybersecurity has historically been treated as a specialist workstream or something to address once new digital systems are in the process of being designed, procured or deployed. That approach is becoming harder to sustain. The more connected the grid becomes, the more important it is to understand how cybersecurity controls, operational requirements and delivery programs work together. 

The risk is not simply that a system could be exposed to a cyber threat. The larger challenge is that cybersecurity decisions can affect how safely, reliably and efficiently a network operates. Utilities need to protect critical infrastructure without slowing modernization or creating controls that don’t fit the realities of the operational environment. 

 The most successful programs adopt a security-by-design approach, bringing cybersecurity expertise into the conversation from the outset alongside engineering, operations, asset management, digital strategy and program delivery. This embeds cyber resilience into key decisions from the beginning, ensuring controls are effective, practical and maintainable over time. 

 It also avoids a common problem: treating cyber as an afterthought. Addressing security late can add cost, complexity and delay. When cyber resilience is embedded from the start, it becomes an enabler of successful transformation — supporting modernization that’s not only secure but also efficient and sustainable. 

For utility leaders, the message is clear: cyber resilience needs to be a core design principle for the modern grid. This means looking beyond compliance and focusing on the capabilities, skills and operating models needed to ensure that future-ready infrastructure can be delivered reliably and securely. 

Building the skills to deliver secure transformation 

Technology alone won’t solve this challenge — utilities also need access to people with the right mix of cybersecurity, operational technology and energy sector experience. 

That skills gap is one of the biggest issues facing the industry. Modern grid programs not only need people who understand how to implement cybersecurity controls in live operational environments but also those who can manage complex programs and support digital transformation without compromising reliability. 

This is not just a resourcing issue for today. Utilities need to build a stronger pipeline of people who understand both cybersecurity and the realities of operating critical infrastructure. 

Bringing cyber, operations and delivery together 

Jacobs brings a combination of domain expertise and delivery experience as well as cybersecurity capability that’s particularly important in energy and power environments. 

 We already work across the infrastructure, operational and digital challenges utilities are trying to solve. That gives us a practical understanding of how cybersecurity needs to work across real networks and their increasingly complex supply chains, including suppliers, vendors, system integrators and other third parties. 

Together with PA Consulting, we can also bring deeper advisory capability to support clients in shaping strategies, assessing risk, developing operating models and building the skills needed to deliver secure transformation at scale. 

For utilities planning major grid investment programs, cyber resilience can’t sit at the edge of the conversation. It needs to be part of the investment case, the design process and the delivery model from the beginning. That’s how modernization can move forward with confidence.