From Orlando to the front lines of cybersecurity, last week reinforced a critical reality: protecting critical infrastructure requires more than traditional defenses.
This week, CrunchAtlas joined more than 1,000 cybersecurity professionals, utility operators, government representatives and industry leaders in Orlando, Florida, for GridSecCon 2026, North America's largest grid security conference.
Hosted by the North American Electric Reliability Corporation (NERC), the Electricity Information Sharing and Analysis Center (E-ISAC) and SERC Reliability Corporation, the four-day event brought together the people responsible for protecting one of our nation's most essential assets: the electric grid.
As a Silver Sponsor, CrunchAtlas was proud to participate, showcase our AtlasCyber platform at Booth 220 and engage with the professionals working every day to secure operational technology (OT) environments.
But while the industry gathered to discuss the future of cybersecurity, the threats we face continued to evolve.
And last week's cybersecurity headlines provided a timely reminder of what is at stake.
Cyber Threats Don't Take a Week Off
The cybersecurity landscape doesn't slow down for conferences. During the same week that GridSecCon brought industry leaders together, several significant cybersecurity developments underscored the persistent risks facing businesses and critical infrastructure operators.
Ransomware remains a major threat to critical infrastructure.
On October 20, CISA, the FBI, the U.S. Secret Service, and international partners issued a joint advisory on SafePay ransomware. According to the advisory, the group has affected at least 600 organizations across multiple critical infrastructure sectors since August 2024.
The advisory highlighted techniques including compromised credentials, exposed VPN access, exploitation of vulnerable internet-facing systems, data theft and deliberate interference with recovery capabilities.
The significance extends beyond ransomware itself. Attackers continue to exploit weaknesses in access management, network visibility and incident response readiness.
Software vulnerabilities continue to create opportunities for attackers.
October's security developments also highlighted the importance of identifying and addressing vulnerabilities in widely deployed enterprise software and network infrastructure.
For utilities, the challenge is particularly complex. OT systems often have operational requirements that make patching, maintenance and downtime more difficult than in conventional IT environments.
Organizations must therefore balance vulnerability management with continuous monitoring, detection and the ability to investigate suspicious activity without disrupting essential operations.
Cyber incidents are increasingly becoming operational incidents.
The recent malicious activity affecting Ahold Delhaize grocery brands, including Stop & Shop, Hannaford and Food Lion, illustrated how cybersecurity incidents can interrupt essential business services.
Although the incident was initially disclosed before GridSecCon, further details emerged during conference week about disruptions to websites, applications and online ordering services.
The lesson is relevant far beyond retail.
When cyber incidents disrupt the systems that support daily operations, the consequences can extend to customers, suppliers and communities.
For electric utilities, water systems, and other critical infrastructure operators, that relationship between cybersecurity and operational continuity is particularly important.
GridSecCon 2026: Moving Beyond Compliance
One of the most important themes surrounding this year's GridSecCon was the need to move beyond cybersecurity as a compliance exercise and toward cybersecurity as a continuous operational capability.
Compliance remains essential. Standards provide important baselines and help organizations establish consistent security practices.
But compliance alone does not guarantee that an organization can identify, investigate and respond to an active threat.
For electric utilities, the continued evolution of NERC CIP requirements, including internal network security monitoring under CIP-015, reflects a growing emphasis on visibility inside operational environments.
The traditional approach of protecting the network perimeter is no longer sufficient.
Organizations need to understand what is happening inside their networks, identify unusual behavior, investigate potential compromises and share actionable threat intelligence.
The question is no longer simply whether a network is protected.
The question is whether an organization can recognize when that protection has failed.
Why Operational Technology Requires a Different Approach
Protecting OT environments presents challenges that traditional enterprise cybersecurity tools were not necessarily designed to address.
Electric utilities, municipal power providers, water treatment facilities and other critical infrastructure operators depend on systems that must remain available and reliable.
Many of these environments include legacy equipment, specialized industrial protocols, interconnected operational networks and assets that cannot simply be taken offline for maintenance.
That makes threat detection and investigation especially important.
Security teams need solutions that understand the realities of industrial environments while providing the visibility necessary to identify potentially malicious activity.
They also need the ability to collaborate and exchange threat intelligence without unnecessarily exposing sensitive operational data.
At CrunchAtlas, these challenges are central to why we built AtlasCyber.
CrunchAtlas at GridSecCon: Turning Visibility Into Action
Throughout GridSecCon, our team showcased how AtlasCyber supports proactive cyber threat hunting and collaborative threat investigation.
Our approach emphasizes several critical capabilities:
· Proactive threat hunting: Helping security teams investigate suspicious activity rather than relying exclusively on automated alerts.
· OT-focused visibility: Supporting the detection and investigation of threats across operational environments.
· Collaborative threat intelligence: Enabling teams to share indicators of compromise and relevant findings to improve collective defense.
· Privacy-conscious deployment: Supporting on-premises processing so organizations can retain control over sensitive operational data.
· Operational efficiency: Helping security teams reduce repetitive investigative work and focus on the threats that matter most.
Our conversations throughout the week reinforced the importance of practical solutions that fit into existing security operations.
Utilities need capabilities that support their teams, integrate into their environments and help them make better security decisions.
For CrunchAtlas, GridSecCon was an opportunity to contribute to that discussion and connect with organizations working to strengthen critical infrastructure defenses.
The Next Phase of Critical Infrastructure Security
Three priorities stand out as the industry looks ahead.
First, visibility must extend beyond the perimeter.
Attackers can exploit credentials, trusted connections, vulnerable devices, and third-party access to enter environments that appear well protected. Detecting what happens after initial access is essential.
Second, threat intelligence must become actionable.
Information sharing is valuable, but its impact depends on whether security teams can translate indicators, techniques, and findings into effective investigations and defensive action.
Third, cybersecurity must support operational resilience.
The objective is not simply to identify every possible threat. It is to reduce risk, protect essential services, and enable organizations to continue operating when incidents occur.
These priorities require collaboration among utilities, technology providers, government agencies, and industry partners.
That collaborative spirit was a defining feature of GridSecCon 2026.
Leaving Orlando With a Clear Mission
As GridSecCon 2026 came to a close, we left Orlando encouraged by the commitment of the cybersecurity and utility professionals working to protect North America's critical infrastructure.
The challenges are significant, but so are the opportunities to strengthen collective defense.
Last week's developments reinforced an important lesson: cyber threats are persistent, increasingly sophisticated and capable of creating consequences far beyond the digital environment.
The industry cannot afford to rely solely on yesterday's defensive approaches.
At CrunchAtlas, we believe the future of critical infrastructure security depends on proactive threat hunting, meaningful collaboration and giving defenders the tools they need to act before threats become operational crises.
The threats aren't slowing down. Neither should our defenses.
Thank you to NERC, E-ISAC, SERC, our industry partners, and everyone who connected with the CrunchAtlas Team at GridSecCon 2026.
We look forward to continuing the conversation.
Learn more about CrunchAtlas and AtlasCyber at www.crunchatlas.com.
CrunchAtlas | Agentic Threat Hunting. Collaborative Defense. Critical Infrastructure Resilience.