Cybersecurity as a Precondition for the Carbon-Neutral Grid: An Investment Framework for U.S. Utility Cybersecurity Capital Allocation

The electric grid is the vast, invisible nervous system that powers modern life, but it is undergoing a radical transformation. For decades, electricity flowed in one direction: from massive power plants to homes and businesses. Today, that flow is changing. Millions of solar panels on rooftops and batteries in garages are being added to the system, turning consumers into small-scale power generators. This shift is essential for a carbon-neutral future, yet it creates a new vulnerability. Every new solar panel and battery is a potential entry point for a cyberattack. As these devices multiply, the "attack surface"—the total number of places a hacker could try to break in—grows faster than the rules designed to protect the grid.

Protecting this system requires spending money, but utility companies face a difficult puzzle. They must follow strict federal rules that set a minimum level of security, known as a compliance floor. However, these rules do not cover the new, rapidly growing network of rooftop solar and batteries. For those parts of the grid, companies must decide on their own how much to spend and when. They have no clear guide on whether a proposed security upgrade is worth the cost, or if they should wait to see how the technology evolves. Without a method to weigh these decisions, utilities risk either overspending on unnecessary protections or underinvesting and leaving the grid exposed.

A team of researchers from Brandeis University, Emory University, and Georgia State University has proposed a new way to solve this problem. They developed a four-step framework to help utility companies decide how to allocate their cybersecurity budgets. Their work does not rely on new data from a specific power company or a computer simulation of a hack. Instead, it is a methodological guide that brings together four existing ideas that have never been used together before: mandatory rules, economic limits, timing flexibility, and financial incentives. The authors argue that by combining these elements, utilities can make smarter, more defensible decisions about where to spend their money to keep the grid safe as it transitions to renewable energy.

The first step in their framework is to identify the non-negotiable spending. Federal regulators have established mandatory standards that utilities must meet, such as managing risks from the supply chain of computer parts and monitoring their internal computer networks. The researchers call this the "compliance floor." It is the baseline amount a utility must spend, regardless of how much they think they might lose from a hack. This money is not optional; it is the price of doing business. However, this floor stops at the edge of the main power lines. It does not cover the millions of distributed solar panels and batteries that are now connecting to the grid. Protecting these new assets is a discretionary choice, and that is where the real challenge begins.

For the spending that goes beyond the mandatory rules, the researchers suggest applying a second step: an economic ceiling. They draw on a well-known economic model that argues organizations should never spend more on security than the amount of money they expect to lose if a breach occurs. If a potential security upgrade costs more than the damage it would prevent, the investment does not make sense. This step acts as a guardrail, preventing companies from overspending on security out of fear or habit. It forces planners to ask a hard question: does this specific investment actually reduce the risk of a financial loss that is greater than the cost of the fix?

The third step introduces the element of time. The world of cyber threats and renewable energy technology is changing rapidly. A decision made today might be obsolete in two years. The researchers propose using a method called "real options" to handle this uncertainty. Instead of committing all the money at once, a utility could choose to spend in stages. They might start with a small pilot project to test the technology. If the threat landscape changes or the technology improves, they can expand the investment. If the situation changes in a different direction, they can pause or stop. This flexibility adds value, allowing companies to wait for more information before locking in large sums of money.

The final step in the framework looks at the financial incentives created by recent federal regulations. A new order from the Federal Energy Regulatory Commission allows utilities to recover the costs of certain advanced cybersecurity investments more easily than other projects. This creates a financial advantage for spending on security that goes beyond the minimum requirements. The researchers suggest that utilities should factor this advantage into their calculations. When comparing a security project to other needs, like upgrading power lines or building new substations, the security project should be evaluated with this lower effective cost in mind. This ensures that valuable security upgrades are not overlooked simply because they look expensive on paper.

To test how this framework might work in the real world, the authors looked at a historical example from California. In the early 2010s, a program called CES-21 funded research into grid cybersecurity and renewable energy integration. The program's budget was eventually cut by roughly 77 percent after legislators decided the original request lacked a clear justification for its size. The researchers use this event to illustrate the danger of making large security investments without a structured way to determine the right amount. They argue that if the framework they proposed had been available then, the utility might have been able to justify the spending more clearly, or perhaps realized that a smaller, staged approach was more appropriate.

The paper makes it clear that this framework is a tool for thinking, not a finished product ready for immediate use. The authors point out significant gaps in the data needed to make the system work perfectly. For instance, there are no precise estimates for how much money a cyberattack on a solar farm or a battery aggregator would actually cost. Utilities also struggle to share sensitive information about their risks, which makes it hard to calculate the "expected loss" that drives the second step of the framework. Furthermore, no utility has yet taken advantage of the new federal incentive program, so there is no real-world data on how that part of the equation plays out.

Despite these limitations, the researchers believe their work fills a critical void. For years, the conversation around grid security has been split between those who focus on following the rules and those who focus on the economics of risk. This paper suggests that the future of a safe, carbon-neutral grid depends on weaving these threads together. By providing a structured way to combine mandatory rules, economic limits, timing flexibility, and financial incentives, the framework offers a path forward for utility planners. It does not promise to eliminate cyber threats, but it offers a clearer, more logical way to decide how to spend the money needed to fight them. As the grid continues to change, having a method to navigate these complex choices may be just as important as the technology itself.