AI usage in energy and utilities sector: Challenges and opportunities

The vast opportunity that AI presents to E&U businesses to increase efficiency and profitability, save costs, and reduce certain risks is clear. Here are some examples of how the technology is already changing how E&U companies operate and make the most of their existing capital and other resources:

• Utilities can use AI to optimise electricity distribution by analysing real-time data on energy demand, weather conditions and electrical grid performance. They can balance supply and demand more efficiently — adjusting the grid proactively to support anticipated demand — thereby reducing energy waste and improving grid stability.
• Renewable energy companies can use AI to help increase profitability by analysing real-time data from solar panels, wind turbines and other sources to maximise energy production. This allows them to increase energy output and to sell surplus energy to the grid or other customers.
• Many oil and gas businesses focused on modernisation have been quick to adopt AI to help reduce risks. For instance, with AI-driven predictive maintenance, they can identify potential equipment failures and reduce unplanned downtime. They can also use AI to analyse data from sensors and video feeds from cameras to monitor safety conditions at refineries, pipelines and drilling sites, and detect safety violations, potential hazards and incidents in real time.

But as with all major technology advancements that bring about transformative change, there are potential downsides to making AI an integral part of everyday business operations in an E&U business. This isn’t just about the “garbage in, garbage out” risk associated with training AI models for support in decision-making, or even the challenge of navigating guidelines and requirements for explainable, ethical and responsible AI. Those are certainly top-of-mind concerns — but so, too, is the impact of AI on a long-standing area of risk for the E&U industry: cybersecurity.

E&U companies, on the whole, have only recently started to prioritise cybersecurity — a welcome move from an industry that is responsible for maintaining critical infrastructure. However, as companies seek to embrace new tools like AI before they’ve fully addressed other known risks, such as vulnerabilities in their operational technology (OT) systems, they risk falling further behind in improving cybersecurity before they even have a chance to catch up.

Cybercriminals Are Innovating With AI, Too

For one, AI tools and systems can expand a company’s attack surface, introducing a host of new vulnerabilities and risks that may not be apparent until it’s too late — just as we’ve seen with the Internet of Things (IoT) and shadow IT. Also, the technology is a powerful tool for threat actors, who are using AI to help them develop or enhance attack strategies such as:

• Spoofing: AI-driven text-to-speech and voice synthesis technology can mimic the voice of a specific person or impersonate an official entity. Cybercriminals can use AI voice-cloning tools to create convincing voice recordings for phishing calls or voice commands to bypass voice authentication systems and trick unsuspecting targets.
• Sophisticated phishing and spear-phishing schemes: Malicious actors are using AI to generate convincing and contextually relevant phishing emails, messages or content. Natural language generation models, for example, can create text that mimics the writing style of legitimate senders. AI is also useful for spear-phishing attacks — assisting cybercriminals in identifying high-value targets by analysing data to pinpoint individuals with access to sensitive information or those in key positions within companies.
• Custom malware creation: With AI, adversaries can enable malware to adapt to its environment so it can evade analysis — for example, malware that can detect if it’s running in a sandbox. Another strategy for evasion is to create fileless malware that resides in a system’s memory, which makes it difficult to detect through traditional signature-based antivirus software.
• Encryption-cracking: Cybercriminals were quick to embrace AI in their efforts to gain unauthorised access to sensitive data, including financial data and intellectual property. One common technique is using AI to accelerate brute-force attacks by automating the process of trying all possible combinations of keys or passwords until the correct one is found. Machine learning algorithms can also learn from previous decryption attempts and optimise the order in which combinations are tried, making these attacks more efficient than ever.

The above uses of AI to further cyber threat activity aren’t just risks for the E&U sector, of course. To help create a clearer picture of the risks that AI presents to energy companies and utilities, here is a quick overview of how the technology’s application in four specific areas can create opportunities for E&U businesses — as well as cybercriminals.

Operations

AI opportunities for E&U companies:

• Enhanced offline mobile apps capable of running AI on the edge
• Remote monitoring and control
• Optimisation of oil and gas processing
• Automated review of contracts and assessment of vendor risks

AI opportunities for threat actors:

• Increased connectivity (via IoT) and an expanded attack surface
• Resiliency of attack impact, with the potential for operational shutdown
• Data breaches, including unauthorised access to sensitive operational data

Safety

AI opportunities for E&U companies:

• Leak and hazard detection and response
• Deployment of intelligent, unmanned equipment in high-risk environments
• Preventive maintenance

AI opportunities for threat actors:

• Compromise of OT systems
• Safety event triggering
• Spoofing attacks designed to ignore safety responses

Trading and Marketing

AI opportunities for E&U companies:

• Automated demand forecasting
• Oil and gas supply optimisation
• Real-time data analysis to support trading decisions

AI opportunities for threat actors:

• Market manipulation (e.g., through the use of deepfake AI)
• Compromise of financial data and trade secrets

Governance, Risk and Compliance (GRC)/Environmental, Social and Governance (ESG)

AI opportunities for E&U companies:

• Monitoring of environmental parameters
• Identifying opportunities to decrease carbon footprint
• Making reporting faster, easier, and more data-driven, accurate and complete

AI opportunities for threat actors:

• Data breaches, including the theft or release of sensitive environmental information
• Manipulation of data to over- or underreport the impacts of environmental incidents or progress toward reducing carbon footprint

Silver Lining: AI Can Also Help E&U Companies Take Their Cybersecurity to the Next Level

E&U businesses can leverage AI capabilities to fortify security and gain an edge on adversaries using the technology to attempt to breach their defenses to steal data, disrupt operations, or create other mischief or harm. AI has a vital role to play in these companies’ security operations centers (SOCs) by helping analysts to enhance their ability to detect, respond to and mitigate security threats.

AI can be used to automate threat detection and analysis and tirelessly monitor network traffic, logs and data from various sources in real time to identify suspicious activities, malware and anomalies — including insider threat behavior. AI can detect patterns indicative of known threats or emerging attacks that traditional approaches may miss. The technology can help to improve threat hunting by helping SOC analysts to identify and mitigate cybersecurity threats within the network more proactively.

And when a cyberattack inevitably occurs, AI-driven automated incident response can greatly enhance an E&U company’s response efforts, including by classifying the threat and recommending how and which SOC analysts should take action based on their skills and availability.

AI presents a wealth of opportunity for energy companies and utilities — and for the cybercriminals and other bad actors who seek to target them. In the race against cyber adversaries, E&U companies have every opportunity to get ahead by making AI central to their efforts to improve cybersecurity, both in terms of understanding the risks AI presents and using the technology to create security advantages.