TL;DR: The NERC 2025 ERO Reliability Risk Priorities Report says cyber and physical security complexity is now one of the most urgent threats to the North American bulk power system as interconnected digital systems, AI-driven loads, and siloed controls expand the attack surface, according to AlertEnterprise. Unified identity, access, and resilience controls are becoming a reliability requirement, not just a security preference.
At a glance
What this is: AlertEnterprise highlights NERC's view that cyber and physical security complexity is becoming a grid reliability issue as utilities add AI-driven loads and interconnected digital systems.
Why it matters: Utility security teams need to treat cyber, physical and operational access as one governance problem because siloed controls no longer match the way critical infrastructure now operates.
Context
The core problem is not a single control gap but the fragmentation of security governance across cyber, physical and operational domains. In critical infrastructure, that split creates blind spots where identity, access and resilience decisions are made in different systems, with different owners and inconsistent risk thresholds.
As utilities add more connected technology and AI-driven loads, the reliability impact of access control becomes harder to separate from physical security and operational continuity. The article's point is that this is no longer a narrow perimeter-security issue; it is a convergence problem for grid operations, workforce access and contractor governance.
Key questions
Q: What breaks when cyber and physical access are governed separately in critical infrastructure?
A: Separate governance usually breaks at the handoff points. A user, contractor, or system may still hold one form of access after another has been revoked, leaving gaps that audit evidence will not catch quickly. In critical infrastructure, that mismatch can create reliability exposure before anyone notices the control failure. One entitlement view across domains is the safer operating model.
Q: Why do AI-driven loads increase reliability risk for critical infrastructure?
A: AI-driven loads increase reliability risk because they expand the number of connected systems, trust relationships and identities that support operations. Each new dependency adds a place where access can be misused, misconfigured or left unmanaged. For utilities, the issue is not AI alone, but the larger control surface created around it.
Q: How can utilities tell whether converged access governance is working?
A: It is working when cyber, physical and operational access decisions produce one consistent outcome across onboarding, access review and offboarding. If a badge, account or contractor record can be removed in one domain while access persists in another, the programme is not yet converged. The test is whether controls line up around the same person, role or workload.
Q: Which teams should own cyber-physical convergence risk?
A: Accountability should sit with the teams that can see the whole access path, not just one part of it. In practice that means security, identity, physical security and operational owners sharing a governance model with clear decision rights. If each team only owns its own control, convergence risk stays fragmented and unresolved.
Technical breakdown
Why cyber-physical convergence changes grid security assumptions
Cyber-physical convergence means that digital access, physical entry and operational systems now influence the same reliability outcome. In a utility environment, a credential, badge or remote connection can all affect how quickly an attacker reaches operational technology, support systems or sensitive control paths. Siloed governance fails because it treats each access domain as if the risk stops at its own boundary, when the real risk is chained across them. For grid operators, the question is not whether cyber or physical security is stronger, but whether access decisions are coordinated across both.
Practical implication: align access governance across cyber and physical environments so one identity decision does not create an unmonitored path into operations.
How AI-driven loads expand the attack surface for utilities
AI-driven loads increase both demand and dependency on connected digital systems, which broadens the operational blast radius if access or system integrity fails. The article ties this growth to a larger reliability challenge: more connected systems mean more trust relationships, more connected identities and more opportunities for misuse or misconfiguration. For identity teams, this matters because workloads, service accounts and contractor access can become part of operational exposure even when they are not directly visible to traditional utility security processes. The control problem is governance breadth, not just technical hardening.
Practical implication: inventory the identities and access paths that support AI-enabled and connected operational systems before they become reliability blind spots.
Where siloed controls break in critical infrastructure
Siloed controls break when security owners cannot see the combined effect of cyber access, physical access and operational privilege. A badge revocation, account lockout or contractor offboarding step may each appear adequate inside its own program, yet still leave residual access in another domain. That is why the article frames unified governance as a reliability requirement rather than a convenience. In utility settings, the failure mode is inconsistent enforcement across identity systems, not just missing policy. A resilient model needs shared ownership of who can reach what, and under which conditions.
Practical implication: test whether offboarding, access reviews and incident response work across domains, not just inside one security team.
Threat narrative
Attacker objective: The objective is to reach systems or operational pathways where access can disrupt reliability, expose sensitive operations or create broader grid impact.
- Entry begins when an attacker or unauthorized actor gains a foothold through one of several converged paths, such as digital credentials, physical access or contractor trust.
- Escalation follows when siloed governance allows the initial access to extend across cyber, physical or operational systems without a single control view.
- Impact occurs when the combined exposure threatens reliability, operational continuity or the integrity of grid operations.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
- CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Cyber-physical convergence is now an identity governance problem, not just a security architecture problem. The article's most important shift is that access decisions now cross environments that were once managed separately. When identity, badge and operational access are governed in silos, no single team owns the true blast radius. For utilities, the practitioner conclusion is that converged identity governance is becoming part of reliability engineering.
Converged access is the named concept utilities need to operationalise. The article points to a world where cyber and physical security cannot be assessed independently because the reliability outcome depends on their interaction. That means access assurance has to follow the person, device or workload across operational technology, facilities and digital systems. The practical conclusion is that convergence should be measured by shared control outcomes, not by whether each team has its own process.
AI-driven load growth turns identity sprawl into an operational risk multiplier. More connected systems create more credentials, more delegation paths and more opportunities for control drift. In a utility environment, that means machine identities, contractor access and operational privileges can all influence resilience even when they sit outside traditional IT review cycles. The practitioner conclusion is to treat identity inventory as part of grid reliability governance.
NERC-style resilience expectations are pushing security teams toward unified control ownership. The report's framing implies that utilities can no longer separate compliance, access governance and operational continuity into isolated workstreams. This aligns with broader critical-infrastructure governance trends where cross-domain accountability matters as much as technical control strength. The practical conclusion is to define one accountable model for converged access risk across cyber and physical programs.
The failure mode is not absence of controls, but absence of shared visibility. Utilities may already have access reviews, badge systems and incident procedures, yet still lack a control plane that shows how those mechanisms interact. That gap matters because reliability failures often emerge when one domain assumes another has already constrained the risk. The practitioner conclusion is to test convergence end to end, not just individual control maturity.
What this signals
Converged access is becoming the right operating model for critical infrastructure. Utilities do not need another isolated access review process. They need a control view that follows identities across cyber, physical and operational boundaries so reliability teams can see where residual access still exists.
The practical signal for readers is that identity governance now has to participate in resilience planning. If your programme cannot answer who can reach a facility, a workload and an operational system in one view, convergence risk is already larger than the access model can show.
For practitioners
- Define a converged access governance model Create one ownership model for cyber, physical and operational identity decisions so that account approval, badge issuance and privileged access are assessed together.
- Map shared access paths across critical operations Inventory where workforce, contractor, service and operational identities can reach facilities, digital systems and control environments, then document the overlaps.
- Test offboarding across all security domains Validate that account disablement, badge revocation and contractor termination all remove access in the same control window.
- Review AI-enabled operational dependencies Identify systems that depend on AI-driven loads or connected digital services and confirm the identity controls governing those dependencies.
- Align reliability and access reviews Bring reliability, security and access owners into the same review cycle so control gaps are visible before they affect operations.
Key takeaways
- The article frames cyber-physical convergence as a reliability issue because fragmented access governance leaves critical infrastructure with blind spots across cyber, physical and operational domains.
- AI-driven loads and interconnected digital systems increase the number of identities, trust paths and dependencies that utilities must govern.
- Utilities should move toward unified access ownership so offboarding, privilege review and resilience planning produce one consistent control outcome.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Utility convergence risk is driven by fragmented access decisions across cyber and physical domains. |
| GV.OC-01 — Organizational Context | The report reframes convergence as a board and executive resilience issue for critical infrastructure. | |
| Recommendation — Align entitlement reviews across cyber and physical systems under PR.AA-05 so one identity does not retain hidden access. Define converged security ownership within GV.OC-01 so reliability and access decisions share one operating model. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centers on unified account lifecycle control for workforce, contractor and operational identities. |
| Recommendation — Consolidate account lifecycle governance under CIS-5 so offboarding and access changes propagate across all control domains. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Converged environments need least privilege applied consistently across operational and physical access paths. |
| Recommendation — Apply AC-6 to limit cross-domain access paths before they create reliability-impacting exposure. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Identity misuse across converged environments can enable privilege extension and movement between domains. |
| Recommendation — Map cross-domain access paths to TA0006 and TA0008 to find where credentials could bridge cyber and physical controls. | ||
Key terms
- Cyber-Physical Convergence: The point where digital security and physical security operate on the same risk surface. In utilities, that includes remote administration, facility access, operational systems, and the identity controls that connect them. Governance has to cover both domains together or gaps will appear at the boundary.
- Converged Access Governance: Converged access governance is a single control model that manages physical access and digital access together. It reduces gaps caused by separate teams and separate logs, and it helps organisations prove that access changes follow the same lifecycle logic across doors, applications, and related systems.
- Grid reliability risk: The chance that a security, operational or access failure will disrupt the continuous delivery of electric service. In utility environments, reliability risk includes failures caused by identity misuse, control gaps, disconnected processes or incomplete offboarding across converged systems.
- AI-driven load: Demand created or amplified by artificial intelligence workloads and related connected services. In infrastructure settings, AI-driven load matters because it expands dependency on digital systems, increases trust relationships and can widen the operational attack surface that security and reliability teams must govern.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps identity and security practitioners build the control discipline needed to govern converged environments.
Published by the NHIMG editorial team on July 11, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org