The Risk Landscape Is Converging

Cybersecurity, Artificial Intelligence, Capital Investment and Operational Resilience Can No Longer be Managed as Separate Concerns.

Utilities and critical-infrastructure organizations are entering a period in which previously separate risks are becoming increasingly interconnected. Artificial intelligence is accelerating cyberattacks against operational technology. Data centers and other large computational loads are straining electric, water and communications infrastructure. And utilities are being asked to deliver more complex capital programs while managing affordability, compliance, aging assets and public expectations — all at once.

The thread connecting all four is simple: risk that lives in a silo doesn’t stay contained. Effective risk management now requires a single, integrated view of technology, assets, projects, vendors, compliance obligations and organizational objectives. Here are four developments critical-infrastructure leaders should be watching and what an integrated risk platform does differently about each one.

1. AI-Assisted Cyberattacks Are Becoming an Operational Technology Risk

The use of artificial intelligence by cyber threat actors is no longer theoretical. On August 19, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on active threats against Siemens S7 programmable logic controllers. According to CISA, threat actors are using AI assistance to generate exploitation scripts from publicly available information — lowering the skill and time required to attack industrial control systems.

These controllers run across energy, water, wastewater, manufacturing and other critical-infrastructure environments. A successful attack could disrupt operations, damage equipment, compromise safety or trigger cascading service interruptions.

CISA’s recommendations is to identify affected assets, limit internet exposure, strengthen authentication, segment networks, monitor anomalous activity, maintain backups and incident-response capability are the right controls. But implementing them is only part of the response. Leaders still need to answer:

• Which operational assets are potentially exposed?
• How critical are those assets to service delivery?
• Which safeguards are fully implemented and sustainable?
• What is the potential operational, financial and safety impact?
• Who owns each corrective action, and which investments should be funded first?

An asset inventory doesn’t answer those questions. Neither does a compliance checklist. Someone has to connect technical vulnerabilities to asset criticality, business consequence and remediation priority — and keep that connection current as new advisories land.

The CISA advisory should prompt every utility to revisit its operational-technology risk assessment — particularly for internet-accessible industrial control systems.

2. Large Computational Loads Are Creating a New Category of Utility Risk

The rapid growth of data centers, AI computing facilities and other large electrical loads is changing how utilities plan and operate their systems. The North American Electric Reliability Corporation (NERC) has opened a high-priority standards project addressing the reliability risks these loads introduce — including rapid demand swings and heavy concentration in locations where the existing grid wasn’t built for them. NERC’s public-comment period opened August 19, 2026.

For utilities, the implications go well past load forecasting. A single proposed data center can touch generation and transmission capacity, substation and distribution requirements, capital priorities, interconnection schedules, reliability planning, rate design, water infrastructure, cybersecurity coordination, contractual exposure and community impact simultaneously.

These risks can’t be evaluated in isolation. A utility might have adequate long-term capacity and still face real project-delivery risk from permitting, equipment lead times, financing or workforce constraints. An infrastructure investment that looks financially attractive on its own can expose existing customers if projected demand doesn’t materialize or a large-load customer doesn’t meet its contractual commitments. Before making major service or infrastructure commitments to a large computational-load customer, utilities need a structured, multidisciplinary risk-assessment process not a series of separate departmental reviews.

Supporting research: NERC’s Computational Loads Standards Project and the Large Loads Action Plan.

3. Capital-Project Readiness Must Begin Before Construction

The infrastructure investment needed to support grid modernization, climate resilience and new computational loads is enormous PwC estimates roughly $7.8 trillion in U.S. power-infrastructure investment through 2050. The industry’s delivery record makes that a hard number to feel confident about.

McKinsey’s review of more than 500 large capital projects found average cost and schedule overruns of 30% to 45%, with the most-deviated projects running 79% over budget and 52% behind schedule. EY’s Spotlight on Power and Utility Megaprojects, which analyzed 100 major power and water projects, found that 64% experienced delays and 57% exceeded budget, with average delays of 25 months and average overruns of 35%.

EY identified inadequate understanding of project risk as a root cause one of several internal delivery weaknesses that combine with external pressures like market conditions and regulatory requirements to produce the overruns that eventually become visible in a status report. PwC’s Successful Capital Projects: The Integrated Risk Framework makes the same point from a different angle: risk management has to run through every phase of delivery, not just the ones with a line item for it.

The problem with traditional project controls is timing: identifying a cost or schedule variance after execution has already begun is often too late to prevent it. Risk has to influence decisions before major commitments are made — and stay influential through the entire project lifecycle.

That is the foundation of Risk-Based Project Management a discipline in which risk assessment is built into planning, estimating, scheduling, funding, contracting and executive decision-making, with risk-based decision gates confirming that scope, cost, schedule, funding, resources and major risks remain aligned before a project is authorized to advance.

Project readiness is ultimately a governance discipline moving from reacting to cost overruns and schedule delays to identifying and managing the risks that create them.

Supporting research: PwC Successful Capital Projects, EY Spotlight on Power and Utility Megaprojects, McKinsey Increasing Transparency in Megaproject Execution and McKinsey Maximizing Value Through Preconstruction Excellence.

4. AI in Risk Management Must Be Governed and Transparent

AI is showing up in governance, risk and compliance platforms everywhere analyzing assessments, flagging inconsistencies, summarizing findings, comparing results, recommending corrective actions and drafting executive reports. Done well, this meaningfully cuts the administrative load that risk and compliance programs carry.

The next stage moves beyond AI-generated summaries toward AI-assisted workflows — systems that review evidence, recommend priorities, prepare remediation plans and monitor corrective actions. That’s real potential, and it comes with real governance responsibility. Organizations adopting AI-assisted risk management need safeguards covering human review and approval, source traceability, data privacy and retention, user access and authorization, accuracy and validation, activity logging, accountability for final decisions, and clear limits on autonomous action.

NIST is currently seeking comment on a draft quick-start guide describing how AI can support Cybersecurity Framework 2.0 analysis and reporting covering AI’s role in planning, implementing and monitoring cybersecurity outcomes. The underlying principle holds regardless of framework: AI should improve the quality and speed of risk decisions without obscuring how those decisions were reached or who remains accountable for them. The right question isn’t just what the technology can generate it’s whether its recommendations are transparent, reviewable, secure and grounded in the organization’s actual risk data.

More information is available through the NIST Cybersecurity Framework Resource Center.

Integrated Risk Management Is Becoming an Operational Necessity

These four developments share one theme: risk doesn’t respect departmental lines.

• An AI-assisted attack on an industrial controller isn’t only a cybersecurity matter it’s an asset, operational, safety, financial and enterprise risk.
• A proposed data center isn’t simply a new customer it can create generation, transmission, capital-project, ratepayer, vendor, regulatory and community risk.
• A major infrastructure project isn’t successful just because construction finishes it has to deliver the required capacity, stay financially sustainable, meet regulatory obligations and support long-term resilience.

Organizations that manage these risks in separate spreadsheets, reports and departmental systems struggle to see the connections between them until those connections become expensive. Integrated risk management gives leadership one complete view of how individual decisions affect the organization as a whole.

How ARETE and RAP Support Integrated Risk Decisions

ARETE built the Risk Assessment Profiler — RAP — to help organizations evaluate and manage risk consistently across every business function that touches it, on a single cloud-native platform hosted on AWS infrastructure certified to SOC 2 Type 2, PCI-DSS and FedRAMP Moderate standards. RAP provides purpose-built applications for:

• Capital-project and portfolio risk (RAP Project)
• Cybersecurity and operational-technology assessments (RAP Cyber)
• Asset condition and criticality (RAP Asset)
• Third-party and vendor risk (RAP Vendor)
• Audit and compliance management (RAP Audit)

RAP’s foundation is qualitative and quantitative risk analytics, a form of predictive AI grounded in risk assessments and simulations that apply a proprietary scoring methodology. Generative AI then complements that foundation, helping users interpret assessment results, identify priorities and prepare decision-ready information. Throughout, the goal is to support professional judgment and accountable management decisions, not replace them.

As cyber threats, infrastructure demands and regulatory expectations continue to converge, organizations need more than isolated assessments. They need a repeatable process for connecting risk information to priorities, investments and actions.

To learn more about ARETE Consulting Services and the RAP platform, visit www.arete-inc.com