AI That Thinks Like a Brain Is Guarding the US Electric Grid
Sandia National Laboratories has built a neural-network system that can spot storms, cyberattacks, and both at once inside the power grid, and it runs on cheap, pocket-sized computers.
Key points
- Sandia National Laboratories developed an AI system that detects physical faults, cyberattacks, and combined attacks on the electric grid simultaneously.
- The system uses an autoencoder neural network, trained only on normal grid behaviour, with no need for labelled attack data.
- Real-world testing began at the Public Service Company of New Mexico's Prosperity solar farm in the summer of 2024.
- The code runs on low-cost single-board computers, about the size of a credit card, and on existing grid security hardware.
- Sandia has filed a patent and is seeking industry partners to deploy the technology more widely.
The US electric grid keeps pharmacy fridges cold, traffic lights green, and hospital ventilators running. It also faces a growing list of threats, from hurricanes to hackers.
Researchers at Sandia National Laboratories, a federally funded science and engineering lab, have built an AI system designed to catch those threats faster than any human operator could. Their paper details a system that can identify a physical fault, a cyberattack, or a co-ordinated attack that combines both, all at the same time.
How does the AI actually work?
At the centre of the system is an autoencoder neural network, a type of AI that learns what "normal" looks like and raises an alarm whenever something deviates from that pattern. Unlike most AI security tools, it does not need to be trained on thousands of labelled examples of past attacks. Feed it enough ordinary operating data and it figures out the rest.
That matters because the grid generates two very different data streams. Physical readings, such as voltage, frequency and electrical current, arrive 60 times every second. Cyber data, the network traffic flowing between control systems, arrives in irregular bursts. Computer scientist Logan Blakely, who led the AI development, said fusing those two streams into a single picture was the hardest part of the project. Collaborators at Texas A&M University helped solve it.
The finished system works at three levels. At the device level it watches a single piece of equipment. At the local network level, nearby devices share alerts so operators can tell whether a problem is isolated or spreading. Between grids owned by different companies, only summary alerts travel, protecting each operator's commercial secrets.
Why does this matter for ordinary people?
Grid operators today can struggle to tell apart a storm-damaged transformer and a hacker spoofing sensor readings. Fixing the wrong problem wastes critical minutes. This system flags which category of threat is happening, and where, so crews respond to the right thing first.
The AI runs on a single-board computer, a small, inexpensive chip roughly the size of a deck of cards, meaning it can protect ageing grid hardware that no one wants to replace yet. It also runs on Binary Armor, an existing cybersecurity device made by Sierra Nevada Corp., giving utilities a path to add the protection without buying new kit.
Real-world testing is under way at PNM's Prosperity solar farm in New Mexico. Early results showed hardware running the autoencoder processed results hundreds to thousands of times faster than a software-only version, according to cybersecurity expert Adrian Chavez.
What comes next?
Sandia has filed a patent and is looking for commercial partners. Cybersecurity project leader Shamina Hossain-McKenzie said the same approach could eventually protect water networks and natural gas infrastructure too.
For now, the team is working to prove the technology in the real world before wider deployment.
Common questions
Could this AI miss a new type of attack it has never seen?
Possibly, though the autoencoder is designed to catch anything that deviates from normal, not just known attack types. Novel attacks that leave no unusual signal in the physical or cyber data would still be hard to detect, which is why the Sandia team is continuing to refine the system in live field conditions.
Does this replace human grid operators?
No. The system feeds faster, clearer alerts to human operators so they can make better decisions more quickly. It is a detection and warning tool, not an autonomous response system.
