________________________________________________________________________________________________________________________
Most sectors are building AI governance
controls from a standing start, often only after AI deployment has already outrun them. Energy and utilities appear to be doing something different: extending the discipline it already had into a domain
that is new. Representation data in the survey supports this. The sector is showing in the
leadership quadrant, where both dimensions are strong at once, and comes in at 1.38
times the rate one would expect given its share of respondents, meaningfully above
proportional and second only to healthcare among every sector measured.
The exposure that matters
Of course, the relevant risk is not the industrial control system itself. It is what happens to the sensitive information that moves alongside it. Compliance filings, interconnection studies, vendor contracts, and increasingly AI tools summarizing regulatory submissions or forecasting
demand from that same data. The Verizon 2026 Data Breach Investigations Report
found that third party and supply chain related breaches now account for 48 percent of all breaches studied, a rise of 60 percent
year-on-year. A sector built on dense vendor,
contractor, and regulator relationships carries
that exposure as a matter of course, whatever
The energy sector’ s advantage is genuine, but it is a head start on the underlying discipline
the maturity of its control system security.
That is the point worth sitting with. The same discipline that keeps unauthorized access out of a control system needs to extend to the compliance data, vendor
24