GridEx Highlights Drone Risks to Power Grids

In the fictional nation of Beryllia, the 2026 World Chalice Games were set to begin as the country faced a relentless heatwave. The network, already strained by circumstances, suffered another blow when a series of coordinated attacks including vandalism, drones, and ballistic attacks by an adversary, Crimsonia, crippled the network’s physical infrastructure.

This scenario, inspired by the upcoming 2026 World Cup and the 2028 Olympic Games in Los Angeles, was an exercise to study how utilities can prevent and mitigate, among other dangers, physical attacks on power grids. Called GridEx, the exercise was organized by the Electricity Information Sharing and Analysis Center (E-ISAC) from November 18 to 20, 2025. GridEx has taken place every two years since 2011.

“We know that threat actors seek to exploit certain circumstances,” says Michael BallCEO of E-ISAC, which is a program of North American Electrical Reliability Society (NERC), on the design of the Beryllia scenario. “The Chalice Games became a good example of how we could build a storyline around a threatening actor. »

Physical attacks on the grid are on the rise in the United States, and GridEx ridership increased in November as utilities grapple with how to prevent and mitigate attacks. Participation in the exercise was at its highest level since 2019, according to a report released March 2. Considering the number of organizations present, GridEx estimates that more than 28,000 individual stakeholders participated, including utility workers and government partners, an unprecedented record since the beginning of the exercise.

Growing physical threats to power grids

U.S. and Canadian networks face growing security concerns related to physical threats, including vandalism, assaults on utility employees, trespassing on property, and theft of components, such as copper wiring. NERC E-ISAC 2025 End of Year report cites more than 3,500 physical security breaches during the calendar year, about 3% of which disrupted electricity. This represents an increase from 2,800 events quoted in the 2023 report (3% of these also resulted in power outages). Yet despite a number of high-profile attacks in the United States, physical attacks against the network are occurring around the world.

“It’s not an American specificity,” says Danielle Russoexecutive director of the Center for Grid Security Securing America’s Energy Futurea nonpartisan organization focused on promoting national energy security. Russo says that while attacks are common in places like Ukrainethey are not limited to war scenarios. “Other countries that are not experiencing direct conflict are increasingly experiencing physical attacks on their energy infrastructure,” she says. Take the example of Germany: on January 3, a arson by left-wing activists in Berlin caused a five-day power outage, affecting 45,000 homes. This comes after a suspected arson on two pylons in September 2025 left 50,000 Berlin homes without electricity. Some German officials cite domestic extremism and fears of Russian sabotage in recent years to justify their decision. increased security concerns on critical infrastructure.

The increase in attacks against the American network can be explained by a number of incidents in recent years. In December 2025, an engineer from San Jose, California was sentenced to 10 years in prison for bombing of electrical transformers in 2022 and 2023. A Tennessee man was arrested in November 2024 for attempt to attack a Nashville substation using a drone armed with explosives. And in 2023, a neo-Nazi leader was among two arrested in a plot to attacks five substations around Baltimore with firearms, being part of a upward trend in white supremacist groups planning to attack the American energy sector.

“From [E-ISAC] “We started publishing data in 2016, and we’ve seen a significant and steady increase in the number of physical security incidents reported each year,” says Michael Coevice president of physical security and cybersecurity programs at American Public Power Associationa professional group that works with E-ISAC to plan GridEx. While not all data is publicly available, Coe says there has been a tenfold increase over the past decade in the number of physical attacks reported on the network.

Drone attacks: a growing security challenge

During the fictional World Chalice Games storyline, drone attacks destroyed equipment at the Beryllia Substation, highlighting a threat that is gaining ground as more drones enter the airspace.

“The question we ask ourselves all the time is: how do we know if it’s a bad actor or if it’s a 12-year-old who received the drone for his birthday?” said Erika Willisthe program manager of the substation team at Electric Power Research Institute (EPRI).

One strategy for tracking and alerting utilities to potential threats such as drones is called sensor fusion. The system includes a pan, tilt and zoom camera capable of 360 degree movement, mounted on a tripod or pole with four radars installed. The radars combine with the camera to form a dual system that can track the drones even if they are obstructed, Willis says. For example, if a nearby drone flies behind a tree, hidden from the camera, the radars will still detect it. The technology is currently being tested at EPRI’s laboratories in Charlotte, North Carolina and Lenox, Massachusetts.

EPRI is also exploring how robotics and AI can improve security systems, says Willis. One approach is to integrate AI analysis into robotic technology that already monitors substation perimeters. Using AI can improve detection of break-ins and damage to fences around substations, says Willis. “Instead of a human having to go through 200 images of a fence, you can have the AI ​​overlays run some of these algorithms… If the robot has inspected the substation 100 times, then it can tell you there’s an anomaly,” says Willis.

Prisma Photonics deploys fiber sensing technology that uses reflected optical signals to detect disturbances from vehicles and other sources near an underground fiber cable.Prisma Photonics

A number of utilities in the United States are already using AI integrations in their security and surveillance processes. That’s in part thanks to the Tel Aviv, Israel-based organization. Prisma Photonicsa software company that launched in 2017 and has since deployed its fiber sensing technology across thousands of miles of transmission infrastructure across the United States, Canada, Europe and Israel. A unit the size of a filing cabinet plugs into a substation and sends pulses of light downward. fiber optic cables 30 miles in each direction. As the pulses travel through the cables, a tiny fraction of the light is reflected back to the substation. An AI model processes the results and can classify events based on patterns in the optical signal resulting from disturbances occurring around the fiber optic cable.

“If we identify an event that we don’t have a classification for and we get feedback from a customer saying, ‘oh, it was a car accident,’ then we can classify it in the model to say that’s actually what happened,” explains Tiffany Menhornvice president of Prisma Photonics for North America.

As preparations begin for the ninth GridEx in 2027, Ball says participation in the exercises alone is not enough to strengthen grid security. Instead, he wants utilities to take what they learned from the training and apply it in their own operations. “It’s the action of doing it, versus our statistic of saying, ‘Here’s what our growth has been.’ This growth is expected to be linked to industry readiness and capacity.

I changed the tense on this because the following sentences use the past tense. It seemed weird to go from the present tense in the first sentence to the past tense in the rest of the paragraph, but I could be wrong.