Quick Take
Most substations run without staff on site, and most of the incidents reported against them are intrusion, theft, and vandalism rather than gunfire. The weak point is the time between detection and a response that changes what happens inside the fence. AI detection at the fence line, immediate on-site deterrence, and agentic escalation shorten that window, and they produce a documented record of what happened while the incident is still in progress.
Unstaffed by Design
A Congressional Research Service report on grid physical security put it plainly: guards aren't often stationed at these facilities under normal operating conditions. The same report counted roughly 2,100 high-voltage substations rated 345 kV and above, and like most of the grid's lower-voltage stations, many sit along rural roads, industrial edges, and open land.
That design works for keeping the lights on. It works poorly for security. A fence, a locked gate, and a few fixed cameras establish a boundary, and in most cases nobody is there to enforce it when someone crosses.
Where Incidents Come From
The headline attacks get the coverage. The daily workload looks different. The Electricity Information Sharing and Analysis Center (E-ISAC) logged nearly 1,700 physical security incidents in 2022 and more than 2,800 in 2023. NERC and FERC describe the common types as vandalism, tampering, theft, intrusion, and ballistic damage. About 97 percent of the 2022 incidents caused no service disruption.
That doesn't make them minor. Copper theft puts intruders inside energized yards. In April 2023, two men died in Gainesville, Georgia while trying to steal copper wiring from a substation that police said had been targeted before. Every intrusion that doesn't cause an outage still leaves a damaged fence, a safety exposure, a field visit, and a question about who comes back next week.
The expensive failures raise the stakes further. The Department of Energy reported in 2024 that lead times for large power transformers commonly run 36 months and can reach 60. A damaged transformer isn't a next-day replacement.
The Response Gap
Most substation security programs are built on detection. Fence sensors, cameras, and door contacts generate alarms that travel to a security operations center or a monitoring provider. Then the manual work begins. An operator pulls up video, decides whether the activity is real, calls a supervisor or law enforcement, and documents the event afterward.
Each handoff adds time, and nuisance alarms from wildlife, weather, and wind-blown debris add doubt. NERC's March 2026 voluntary physical security best practices address both problems directly. The guidance tells utilities to review response timelines from local law enforcement, to design detection that reduces false alarms without missing important data, and to consider analytics-enabled video such as object detection, loitering, and line-crossing where monitoring staff are limited.
That guidance describes the problem well. An alert that waits in a queue while someone climbs a fence at a remote site gives the intruder the time they came for. Detection only matters if something acts on it while the person is still inside the perimeter.
Beyond CIP-014
NERC CIP-014 requires risk assessments, third-party verification, and documented physical security plans for the transmission substations whose loss would matter most to the bulk power system. NERC estimates that covers about 10 percent of substations. FERC approved CIP-014-4 on September 10, 2026, tightening the assessment method and adding review of nearby facilities, with an effective date of October 1, 2028.
The remaining substations sit outside that standard, and their protection depends on each utility's own program. Those are the sites where adding patrol hours or staffed posts rarely pencils out, and where false alarm fatigue erodes confidence in the systems already installed.
Detection That Acts
Closing the response gap means moving the first steps of response to the fence line and automating the ones that follow. RAD's framework runs detection, verification, deterrence, escalation, response, and resolution as one continuous sequence.
Detection at the perimeter. RAD's AI analytics identify human presence, perimeter intrusion, loitering, and vehicles, separating a person at the fence from a deer or a swaying branch. RIO mobile security trailers run on solar and battery power with built-in cellular, so they deploy at remote substations without trenching, networking, or external power. ROSA mounts at fixed positions for 180-degree coverage with Edge AI processing on the device. Sites with existing ONVIF Profile S cameras can add AI to the cameras already installed.
Deterrence in seconds. When a detection rule is met, the device responds on site with 110 dB audio, voice warnings, and LED alerts. A trespasser at a quiet site expects silence, and a challenge delivered while they're still at the fence changes the decision in front of them.
Escalation without a queue. SARA Agentic AI verifies the event, delivers a live talk-down based on what's on camera, and contacts up to three people in parallel, such as a utility security lead, a field supervisor, and a dispatch contact, following the utility's escalation protocol.
A record built in real time. SARA documents every step in a time-stamped incident timeline with video, audio, and actions preserved. That record supports the investigation, the insurance claim, and the incident reporting that follows, without anyone reconstructing events the next morning.
"Utilities have spent a decade building better sensors at the fence. The next decade belongs to the systems that act on what those sensors see. A substation that can verify, challenge, and escalate on its own will be the baseline, and the unstaffed site that only records will look the way an unmonitored alarm panel looks today."
Steve Reinharz
Founder and CEO, Robotic Assistance Devices
What It Won't Do
Autonomous response doesn't replace hardening, and it won't stop a determined attacker firing from outside the fence. For those events, the value is immediate detection, verified escalation to the right people, and a complete record from the first second. For the intrusion, theft, and vandalism that make up most of the incident load, on-site deterrence and fast escalation are what shorten the event and reduce the return visits. The Agentic AI approach to critical infrastructure covers the operating model in more depth.
Where to Start
Pick the substations with repeat intrusion or theft history, the longest response distances, or the most nuisance alarms. Measure time from detection to verified response, the ratio of verified incidents to unverified alarms, and how many events ended after the first challenge. Those three numbers show whether the fence line is enforcing itself or waiting for someone to arrive.
