FERC Flags Power Sector Cyber Compliance Gaps, AI Tool and Vendor Risks

A federal regulator has flagged cybersecurity compliance gaps across the US power sector, and the list now includes risks tied to artificial intelligence tools and to third-party control systems. The Federal Energy Regulatory Commission, or FERC, oversees the bulk electric system, so its assessment carries weight with the utilities and grid operators it regulates. The finding surfaced in the October 16, 2026 edition of Security Boulevard's Daily OT Security News, a daily industrial security digest. USA 24 has not yet reviewed the full FERC document, so this story relies on that secondary summary.

The summary describes audit observations and voluntary practices. It does not say the whole sector failed compliance, and it does not describe an attack. That distinction shapes everything else about this story. This is a report about regulatory posture, not a confirmed breach or a blackout.

What the FERC assessment reports

The coverage reviewed for this story makes a short list of points:

• FERC's assessment identifies cybersecurity compliance gaps across the US power sector.
• The findings draw on audit observations and voluntary industry practices.
• The assessment flags risks from AI tools and from third-party control systems.
• The reporting names no specific utility, grid operator or incident.
• It cites no CVE identifiers, CVSS scores, affected product versions or product fixes.

The details that are missing matter as much as the findings. The table below shows what the reviewed sources do and do not establish.

Without those details, readers cannot tell whether the gaps cluster among small cooperatives, large investor-owned utilities or the vendors that serve both. Those are the questions the full report should answer first.

Why AI tools and third-party control systems stand out

The assessment pairs AI tools with third-party control systems, and the pairing is telling. Both widen the set of people, software and network paths that can reach sensitive systems. An AI tool that reads operational data, drafts engineering documents or connects to ticketing and monitoring platforms creates a new access point, even if the tool never touches the grid's control loop. A third-party control system adds a vendor, often with remote access, to the chain of trust that a utility must protect.

The digest does not say which AI tools or vendors it has in mind. The risk logic, however, matches recent cases that USA 24 has covered. The first is a zero-day in BeyondTrust's remote support software, a category of product built to reach systems from outside the network. The second is a compromised ConnectWise credential that opened 173 Microsoft 365 tenants. Separately, CISA's warning about six Eclipse Milo OPC UA flaws in industrial software points to the software layer that many industrial systems depend on.

Compliance gaps are not the same as a grid outage

Readers who see the phrase power sector may picture a blackout. The reported findings concern compliance and voluntary practices. They are not a confirmed breach, a grid disruption or evidence that an attacker is inside a utility network, and the reporting reviewed here ties the assessment to no specific event.

Ratepayers are affected indirectly. If the gaps are not closed, the possible consequences include service disruption or exposure of customer data. The reviewed material does not estimate how likely either outcome is, and it would be a mistake to treat either one as a prediction.

The compliance framing also matters because attackers have recently reached utilities through business systems. Recent utility incidents, including the CenterPoint breach that USA 24 has already covered, suggest that data and billing systems are part of the attack surface alongside operational technology. A review centered only on control networks would miss that path.

How the power sector's cyber rules work

Most of FERC's authority over grid cybersecurity runs through the CIP standards. The North American Electric Reliability Corporation, or NERC, develops these mandatory reliability standards, and FERC approves them. The standards apply to entities that own or operate parts of the bulk electric system, and compliance is checked through audits and enforcement. This background comes from the general regulatory framework rather than from the digest, so the full FERC report should confirm how the assessment relates to it.

That structure helps explain the report's language about voluntary practices. Audit observations can lead to corrective action, while voluntary practices reach beyond what the mandatory standards require. A document that discusses both is likely assessing where the required baseline ends and where companies go further. The digest does not spell out that relationship, so readers should not read more into it than the summary supports.

What utility customers and energy IT teams can do

Most customers cannot change how a utility secures its networks, but they can take practical steps.

• Check whether your utility publishes a cybersecurity commitment or incident-response page, and note how it says it will notify customers after an incident.
• Save the official outage-reporting number and app for your utility, so you can tell real notices from impersonation.
• Treat unexpected calls, texts or emails that ask for account numbers, payments or login details with suspicion, even when they name a real utility.

Energy-sector IT teams have more to do once the full report is in hand.

• Inventory every vendor and contractor account with remote access to operational or business systems, and require multifactor authentication and session logging for each one.
• List every AI tool that touches operational data, customer records or engineering files, and document what each tool can read, write or send.
• Map existing controls against the risk areas the full FERC report names, starting with third-party control systems and AI tool access.

What to watch next

Several open questions will determine how much this assessment changes the sector. The first is the exact release date, the docket number and the full list of findings, which should appear in FERC's own document. The second is whether FERC plans follow-up audits, enforcement or new requirements aimed at AI tool access and vendor connections. The third is how NERC and individual utilities respond, and whether they publicly commit to act on the areas the report flags.

If the report leads to tighter expectations, the earliest visible changes will probably show up in vendor contracts and in how utilities describe their AI deployments to regulators. Customers are unlikely to see much of that work directly. For now, a federal regulator has identified gaps, the scale of those gaps is not established in the reporting reviewed here, and the document that matters most is the one FERC publishes itself.