Utilities
Critical infrastructure security teams use Argu to watch substations, pumping stations and unmanned remote sites along long fence lines. Mekorot, Israel's national water company, is an investor and customer.
Critical infrastructure security teams use Argu to watch substations, pumping stations and unmanned remote sites along long fence lines. Mekorot, Israel's national water company, is an investor and customer.
Explore real-world AI monitoring scenarios tailored to this industry.
Critical infrastructure security for a utility means protecting dozens or hundreds of remote sites, substations, pumping stations, wellheads and transmission towers, that have no one stationed on site to see a break in happen.
Critical infrastructure security for a utility covers every site that keeps power, water or gas moving: generation and pumping stations, substations, wellheads, compressor stations and the towers and fence lines between them. For transmission substations specifically, NERC CIP-014-3 requires utilities to identify their most critical substations and document a physical security plan for each one. Unlike a single large facility with one perimeter, a utility's footprint is dozens or hundreds of small sites spread across a service territory, and each one carries the same exposure as the last with none of the staffing. Intrusion detection and access control have to do the job a guard would do at a site a guard will never actually visit.
Most utility sites are unstaffed by design. A substation or a wellhead does not need a person there day to day, which is exactly why it is the easiest kind of site to breach without being seen. NERC CIP-014-3 only mandates enhanced physical security plans for the subset of substations identified as most critical to grid reliability — the rest of a utility's dozens or hundreds of small sites still need baseline monitoring even without that designation. Security has to come from the site itself, not from a person standing next to the equipment.
Each site type carries its own version of the same exposure: a substation has exposed conductors and transformers behind a chain link fence, a pumping station has valves and controls that can be tampered with, and a wellhead sits even further from any staffed location, often reachable only by a dirt access road. What they share is a fence line that has to be watched continuously with nobody physically present to watch it.
Copper and equipment theft is a recurring problem at unmanned utility sites because the material has resale value and the sites are, by definition, left alone for long stretches. A fence cut and a grounding strap removed can look identical to routine maintenance activity on a still camera frame, which is why the description of the situation, someone at the fence line outside a scheduled maintenance window, matters more than a generic motion trigger, and why a high false alarm rate on that kind of trigger costs a utility more than it costs almost any other industry.
A false alarm at a retail store costs someone a walk to the front door. A false alarm at an unmanned utility site costs a truck roll, a crew pulled off another job and driven out to a remote location, sometimes for an hour or more each way, to find a raccoon or a fallen branch. Utilities tolerate this less than almost any other industry because the cost compounds: the crew that responded to a false alarm is not doing the maintenance work it was scheduled for, and a pattern of false alarms trains dispatchers to treat the next alert, which might be real, with the same skepticism.
Utility sites are also energized, which makes worker safety part of the same security picture rather than a separate concern. A crew or a contractor working inside a live electrical zone without the required PPE falls under OSHA 29 CFR 1910.269, the standard governing electric power generation, transmission and distribution work, which sets PPE requirements for anyone working inside an energized zone. That is a safety failure that intersects with OSHA requirements for energized work, not just a security gap, and a remote site has no supervisor present to catch it the way a factory floor would.
Contractors are a routine part of utility operations, and most unmanned sites cannot staff a guard to check them in. The practical need is a way to know who is on site, when they arrived, and whether they are still there after their scheduled window closes, without adding a staffed checkpoint to a site that was built specifically to not need one.
| Site Type | Primary Exposure | Typical Staffing | What Monitoring Needs to Catch |
|---|---|---|---|
| Substation | Exposed equipment behind a fence | Unstaffed | A person or vehicle at the fence outside a maintenance window |
| Pumping or lift station | Valves and process controls | Unstaffed or periodic visit | Tampering with controls, unscheduled entry |
| Wellhead | Remote, low visibility location | Unstaffed | Any vehicle or person approach at all |
| Transmission tower or corridor | Long, hard to patrol fence lines | Unstaffed | Cutting, climbing or vehicle staging near the base |
| Compressor or generation site | Energized equipment, contractor access | Periodic staffing | Missing PPE, a contractor overstaying a scheduled window |
Utilities sit inside the critical infrastructure sectors CISA tracks — one of the 16 sectors covered in our broader critical infrastructure security overview — and they answer to the same category of procurement rules that ports and federal facilities do, including NDAA compliant hardware requirements under Section 889. Utilities that also run SCADA or other BES cyber systems typically layer NERC CIP-006 physical security requirements on top of CIP-014-3's substation-specific rules. Many purchasing decisions also run through a public utility commission or a government owned entity rather than a straightforward private sale. Mekorot, Israel's national water utility, is both an investor in Argu and a customer, and the technology it uses is in operation with critical infrastructure operators across four continents.
Argu treats each unmanned site the way a utility security team actually thinks about it: describe the situation, a vehicle idling at a substation fence after hours, a contractor still on site an hour past a scheduled window, someone near a wellhead access road, and an agent built from that description watches the existing camera feed continuously, with no dataset and no engineer needed to build it, live in about 30 seconds. Utilities already invest in perimeter intrusion detection, automatic number plate recognition for vehicles approaching a site, and facial recognition for the sites that need it; an agent adds the situation each utility actually cares about on top of cameras already in place. To see it against your own site list, contact Argu.
Last updated: September 2026
A utility operates many small, unstaffed sites, substations, pumping stations and wellheads, spread across a wide service territory, instead of one large site with a single perimeter. Under NERC CIP-014-3, utilities must formally identify their most critical transmission substations and document a physical security plan for each one — a scale problem CIP-014-3 tries to bound by focusing enhanced requirements on that subset rather than every site equally. Each site carries the same exposure as the others but none of them have a person stationed there day to day.
At an unmanned utility site, responding to an alert usually means dispatching a crew by vehicle, sometimes for an hour or more each way, which pulls that crew off other scheduled work. A pattern of false alarms also trains dispatchers to treat the next alert with the same skepticism, even if it turns out to be real. That combination makes alert accuracy matter more for utilities than for almost any other industry.
A crew or contractor working inside a live electrical zone without required PPE falls under OSHA 29 CFR 1910.269, the standard covering electric power generation, transmission and distribution work, and a remote unstaffed site has no supervisor present to catch a violation the way a factory floor would. Monitoring the same site for security purposes can also help confirm that PPE requirements are being followed during a work window. Treating the two as one problem, rather than two separate systems, fits how these sites actually operate.
Copper and equipment theft remains a recurring issue at unmanned utility sites because the material has resale value and the sites are left alone for long stretches by design. A cut fence or a removed grounding strap can look similar to routine maintenance activity on a still frame, which is why describing the specific situation, a person at the fence outside a scheduled window, matters more than a generic motion alert and its accompanying false alarm rate.
Yes. Utilities generally answer to the same category of procurement rules as other critical infrastructure operators, including NDAA Section 889 hardware compliance, and purchasing decisions often run through a public utility commission or a government owned entity. This adds a layer of vendor vetting that a standard commercial security purchase does not require.
Yes, for the subset of transmission substations a utility identifies as most critical. NERC CIP-014-3 requires transmission owners to identify those substations and implement a physical security plan for each one, while NERC CIP-006 separately governs physical security of BES (Bulk Electric System) cyber systems at the facilities that house them. Utilities running both physical substations and SCADA or other BES cyber systems typically have to satisfy both standards, not just one.
By submitting this form, you agree to our Privacy Policy. Your data is encrypted.
