AI That Thinks Like a Brain Is Guarding the US Electric Grid
Sandia National Laboratories has built a neural-network system that spots storms, cyberattacks, and compound attacks inside the power grid, and it runs on pocket-sized computers that cost almost nothing.
Key points
- Sandia National Laboratories developed an AI system that detects physical faults, cyberattacks, and compound attacks on the electric grid at the same time.
- The system uses an autoencoder neural network trained only on normal grid behaviour, with no need for labelled attack data.
- Real-world testing began at the Public Service Company of New Mexico's Prosperity solar farm in the summer of 2024.
- The code runs on low-cost single-board computers roughly the size of a credit card, and on existing grid security hardware.
- Sandia has filed a patent and is seeking industry partners to deploy the technology more widely.
The US electric grid keeps pharmacy fridges cold and hospital ventilators running. It also faces threats from hurricanes and hackers, often at the same time.
Researchers at Sandia National Laboratories, a federally funded science and engineering lab, have built an AI system designed to catch those threats faster than any human operator could. Their system can identify a physical fault, a cyberattack, or a coordinated attack that combines both simultaneously. We first covered Sandia's grid-security work on 22 August 2026.
How does the AI actually work?
At the centre of the system is an autoencoder neural network, a type of AI that learns what normal looks like and raises an alarm when something deviates from that pattern. It doesn't need thousands of labelled examples of past attacks. Feed it enough ordinary operating data and it figures out the rest.
That matters because the grid generates two very different data streams. Physical readings such as voltage and electrical current arrive 60 times every second. Cyber data, the network traffic flowing between control systems, arrives in irregular bursts. Computer scientist Logan Blakely, who led the AI development, said fusing those two streams into one picture was the hardest part of the project. Collaborators at Texas A&M University helped solve it.
The finished system works at three levels. At the device level it watches a single piece of equipment. Nearby devices then share alerts so operators can tell whether a problem is isolated or spreading. Between grids owned by different companies, only summary alerts travel, protecting each operator's commercial secrets.
Why does this matter for ordinary people?
Grid operators today can struggle to tell apart a storm-damaged transformer and a hacker spoofing sensor readings. Fixing the wrong problem wastes critical minutes. This system flags which category of threat is happening and where, so crews can respond to the right thing first.
The AI runs on a single-board computer, a small inexpensive chip roughly the size of a credit card, meaning it can protect ageing grid hardware that no one wants to replace yet. It also runs on Binary Armor, an existing cybersecurity device made by Sierra Nevada Corp., giving utilities a path to add protection without buying new kit. That portability is the detail worth watching: most grid-security upgrades fail because they demand expensive hardware swaps.
Real-world testing is under way at PNM's Prosperity solar farm in New Mexico. Adrian Chavez, a cybersecurity expert on the project, said hardware running the autoencoder processed results roughly a hundred to a thousand times faster than a software-only version.
What comes next?
Sandia has filed a patent and is looking for commercial partners. Cybersecurity project leader Shamina Hossain-McKenzie said the same approach could eventually protect water networks and natural gas infrastructure too.
The team is still proving the technology in live field conditions before wider deployment.
Common questions
Could this AI miss a new type of attack it has never seen?
Possibly, though the autoencoder is designed to catch anything that deviates from normal, not just known attack types. Novel attacks that leave no unusual signal in the physical or cyber data would still be hard to detect, which is why the Sandia team is continuing to refine the system in live field conditions.
Does this replace human grid operators?
No. The system feeds faster, clearer alerts to human operators so they can make better decisions more quickly. It's a detection and warning tool, not an autonomous response system.
