CESER director frames energy-sector cyber strategy around utility asymmetry
The five-year plan is coherent. Whether it reaches the rural co-op with one IT person is the test the strategy itself names.
TL;DR
DOE CESER director Andrew McClure, speaking at FNN's Cyber Leaders Exchange, laid out the office's five-year strategic plan and the asymmetry it's built to address: investor-owned utilities have security teams; many rural and municipal utilities don't. The strategy's three pillars (technology development, infrastructure hardening, incident response and recovery) are delivered through programs like Project Armor and the Rural and Municipal Utility Advanced Cybersecurity program, which has spent $54 million across more than 250 smaller utilities to date. McClure cited Volt Typhoon and AI-driven energy demand as raising the stakes for a sector adversaries have long targeted.
Andrew McClure took over CESER in August with a strategy already on the table, the office's first formal five-year plan, released in March. Speaking at Federal News Network's Cyber Leaders Exchange 2026, he spent less time selling the document than describing the gap it's meant to close.
The energy sector splits unevenly. Investor-owned utilities field dedicated security teams. Rural co-ops and municipal providers often rely on one person who covers both IT and operational technology, and who isn't necessarily a cyber specialist. CESER's Rural and Municipal Utility Advanced Cybersecurity program has directed $54 million to more than 250 such utilities, providing baseline assessments, tooling, and follow-up residual assessments. That program is the concrete answer to the asymmetry McClure described: "a big opportunity to work not just with the largest utilities."
The hardening work runs in parallel. Project Armor, McClure's flagship defensive effort, aims to secure the grid against the kind of prepositioning campaigns Volt Typhoon represents. CESER co-seals threat guidance with CISA, FBI, and NSA, downgrading intelligence into technical reporting utilities can act on.
The backdrop is rising demand. AI infrastructure build-out (data centers, chips, models) runs on energy. McClure called it "a substrate" beneath the whole stack. That demand expands the target surface at the same moment adversary activity is documented and active.
What's less clear from the interview is whether the guidance products (the co-sealed reports, the technical assistance) reach the one-person shop in a form that person can absorb. The strategy names the problem. The $54 million says the money is real. The delivery mechanism is where the strategy will prove itself or won't.
Published ·Deep Fathom