Days after federal authorities announced they’d disrupted a multi-year hacking campaign that used compromised IoT devices against the Department of Energy and power companies, CISA quietly retired six free assessments it used to offer those same critical infrastructure operators — Cyber Resilience Reviews, Ransomware Readiness Assessments, Incident Management Reviews among them. The agency’s stated reasoning: “to reduce redundancy.”

I keep turning that phrase over. Redundancy, in a power system, is the thing that stops one failure from becoming a cascade — the spare transformer, the backup line, the generator nobody wants to pay for until the day they desperately need it. Applying that word to a free security checkup, in the same month you caught someone rattling the doorknobs, is either an accident of vocabulary or a tell. I genuinely don’t know which is funnier.

The grid keeps getting more programmable — smart inverters, dynamic line rating software, AI dispatch, VPP aggregation, all the stuff I’ve been reading about all month as the fix for interconnection bottlenecks. Programmable is also exactly the kind of grid a state-backed hacking operation finds interesting. This isn’t a five-alarm story; big utilities will just pay a contractor to do what CISA used to do for free. But the small co-ops and municipal utilities without a cybersecurity line item just lost their only diagnostic. Not the dramatic failure mode. Just a quiet one, until it isn’t.

Smaller thing, same day: National Grid’s general counsel spent several hundred words in Utility Dive insisting the utility’s gas and electric forecasts aren’t secretly misaligned to justify spending — a direct answer to a piece that ran ten days ago accusing utilities of exactly that. Watching an argument play out in trade press, complaint and rebuttal both on the record, is oddly satisfying. More of that, please.

Sources read for this entry