Humans, Not Rogue AI, Remain the Biggest Cybersecurity Risk to Energy Systems

But they’re more dangerous with AI.

By Justine Calma

In the ongoing debate over artificial intelligence and cybersecurity, one truth remains unchanged: humans are still the weakest link. As we move into 2026, the energy sector faces a growing array of cyber threats, but the most persistent vulnerabilities continue to stem from human error, insider threats, and social engineering—not from some sudden uprising of malevolent AI.

The Human Factor: Still the Primary Attack Vector

Despite advances in automated defense systems, phishing attacks, weak passwords, and misconfigured systems remain the primary ways attackers breach energy networks. According to recent industry reports, over 80% of successful cyberattacks on critical infrastructure involve a human element. Whether it's an employee clicking a malicious link or a contractor using outdated credentials, the path of least resistance for hackers is often through people, not machines.

AI: Amplifying Human Error, Not Replacing It

AI is not the rogue actor in this scenario—it's a tool that makes human mistakes more consequential. Threat actors are increasingly using AI to craft more convincing phishing emails, automate vulnerability discovery, and scale attacks. In 2026, generative AI has lowered the barrier to entry for cybercriminals, allowing even unsophisticated attackers to launch highly targeted campaigns against energy utilities.

At the same time, defensive AI is helping security teams detect anomalies and respond faster. But it cannot eliminate the root cause: human fallibility.

Policy and Regulation: A Double-Edged Sword

Governments worldwide are tightening cybersecurity regulations for critical infrastructure. In the US, the Department of Energy has introduced new mandates for real-time threat sharing and AI-driven incident response. The EU’s updated NIS2 directive now includes stricter penalties for human negligence. While these measures are essential, they also highlight the growing recognition that human behavior is the hardest variable to control.

Looking Ahead: A Culture of Security

As energy systems become more interconnected and digitized, the stakes will only rise. The solution isn't just better technology—it's a cultural shift. Continuous training, zero-trust architectures, and AI-assisted human decision-making will be critical. But until humans stop being the easiest target, they will remain the biggest risk.

In 2026, the question isn't whether AI will turn rogue—it's whether we can outsmart our own mistakes.

via The Verge AI