The Energy Department’s lead cyber and energy security office is advancing efforts under a new five-year strategic plan to improve resilience across electricity, oil and gas infrastructure.

The Office of Cybersecurity, Energy Security and Emergency Response, or CESER, released its new five-year strategic plan in March. The strategy revolves around three major goals: developing world-class security technologies, hardening U.S. energy infrastructure, and responding to and recovering from incidents.

Andrew McClure, who joined CESER as its new director in August, said the principle tying together the strategy is “delivering timely and actionable either information or support or capability across the stakeholders and across the energy sector.”

“Where can we build capability? That includes our areas of technology development. How do we work across not only the department, the interagency, state and local officials, and other resource-constrained and then investor-owned utilities, to help harden, defend, prepare for, and respond and recover from both physical and cyber events,” McClure said during Federal News Network’s Cyber Leaders Exchange 2026.

Unclassified threat assessments and critical infrastructure policies have long recognized that the energy sector is a major target for U.S. adversaries due to its “enabling function” across all critical sectors. It is among those sectors that have recently been targeted by cyber adversaries to preposition for disruptive or destructive cyberattacks.

McClure pointed out that artificial intelligence is driving even more demand for energy, as the AI infrastructure build out — from data centers and chips to software and models — is “built on top of a substrate of energy.”

“Energy could not be more important today, and we also recognize that because of that, our adversaries have in the past and will continue to hold our critical energy infrastructure at risk,” McClure said, pointing to the Volt Typhoon campaign as a recent example.

CESER’s “hardening” activities include a program called Project Armor, focused on “how we can secure and defend the U.S. energy sector and the grid in particular from cyberattacks and build resilience across the sector, given the importance for national security,” McClure said.

CESER has also recently co-sealed reports with the Cybersecurity and Infrastructure Security Agency, the FBI and the National Security Agency to provide technical guidance based on downgraded intelligence or information from stakeholders.

That guidance is needed, he said, “so that we can provide technical assistance and technical reporting to help our utility partners harden their own networks, build resiliency, compete out or patch different vulnerabilities that they might come across in their system, and then understand how to secure and defend their operational technology networks as well.”

CESER also runs a Rural and Municipal Utility Advanced Cybersecurity program that gears resources toward smaller utilities. To date, McClure said the program has spent $54 million supporting more than 250 utilities.

“There’s a big opportunity to work not just with the largest utilities, the investor-owned utilities, but across rural and municipal utilities,” he said. “Think of smaller co-ops and other publicly owned infrastructure providers. In many cases, the long tail in the market here — those who may not have as ready access to either capital to deploy the latest solutions, the latest secure technology, or even hire for whatever reasons, with cost retirement, the people to manage their security posture. “

McClure said CESER can support those utilities with “a baseline assessment, come in with tools, technology, infrastructure support, return later on with a residual assessment to see where continuing areas for improvement are and then also to help those same organizations respond, recover and maintain a resilient posture.”

“They might need to know who to talk to in a crisis,” he added. “We can build those relationships well before that period arrives.”

Meanwhile, CESER’s efforts to advance resilience also include hosting major exercises, such as this fall’s Liberty Eclipse event. The exercise lets participants work through scenarios in an environment that represents the electric grid, including cybersecurity components found in a real-world substation.

McClure said the annual event brings together several hundred utility partners, vendors, manufacturers, state and local officials and other federal partners.

“Every year hundreds of folks enjoy participating in that, where they can then take back to their parent [organizations], whether utility or manufacturer, lessons learned,” McClure said.

“What are the playbooks if they see certain alerts? How do they respond to certain instances? What are the latest adversary tactics, techniques and procedures that we’re seeing that we’re working with our state and local partners on how to respond to? And then where we can also ensure that our frameworks and our assessments are then shared back, so the utilities can then collectively learn from that, incorporate best practices and then train up their staff to respond and recover.”

Meanwhile, CESER’s goal to develop world-class security technologies is designed to leverage innovations from both the national labs and the commercial sector.

“When you think about where emerging technology is headed, the threats, the challenges that we’re facing across our tech stack look very different than it was 12, 18 or 24 months ago. But in many ways, the foundational architecture is also the same,” McClure said.

“So what’s changing at CESER? What’s changing is that we’re flexible to where emerging technology is going. That includes some of the latest capabilities that we’ve been developing and funding to support out of our national labs, specifically around artificial intelligence. But it also means that CESER recognizes that we shouldn’t be funding or investing in technologies that are already readily available in the marketplace.”

CESER supports 22 AI programs today. There are three chief areas of AI emphasis, McClure said:

• One area of focus for AI is “what are the programs, the technologies that we can fund, that we can invest with, that we can build and that we can partner with industry that allow us to secure our utilities with practical solutions across the OT and the IT space that are artificially intelligent‑enabled.”

• The second focus area is evaluating the security of AI systems.

“We’re very much focused on how we can assess the security of open source systems, of different frontier platforms and capabilities. We do that through the test beds that we already have, where we can bring in capabilities, measure model drift, inference capability, susceptibility to data poising and a number of other activities.”

• The third broad focus is securing AI.

“How can we now use capabilities to measure, assess, identify areas that we might be particularly vulnerable, whether it’s identifying OT systems connected to the IP range? How could we uncover that? How can we use the mountain of OT data that we sit on today, both learn from and build a data repository, and use that as a source of competitive advantage or industry advantage on defending against what are really models that haven’t been built on non-simulated OT data? So there are some advantages that we see in this space.”

Discover more articles and videos now on our Cyber Leaders Exchange 2026 event page.

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.