GridEx VIII Shows Why Substation Security Must Address Both Physical and Drone Threats

Physical attacks on power-grid infrastructure are rising across North America, and utilities are increasingly being forced to think beyond traditional perimeter security. The latest GridEx exercise suggests that the threat picture facing substations now includes not only vandalism and sabotage, but also low-altitude drone activity that can complicate detection, verification, and response.

According to the North American Electric Reliability Corporation’s Electricity Information Sharing and Analysis Center, more than 3,500 physical security breaches were reported in 2025 across the United States and Canada, up from 2,800 such events in 2023. About 3 percent of those 2025 incidents disrupted electricity service, underscoring that physical attacks on grid assets are no longer isolated anomalies for operators to treat as purely local events.

A Broader Threat Picture for Utilities

These trends formed the backdrop to GridEx VIII, the eighth edition of the biennial grid-security exercise organized by NERC’s E-ISAC since 2011. Held from 18 to 20 November 2025, the exercise recorded more than 28,000 participants, including utility personnel and government partners, making it the highest participation level since 2019.

The central scenario in GridEx VIII involved a fictional country hosting a major international sporting event during a heat wave while facing a coordinated campaign of vandalism, drone attacks, and ballistic strikes on physical infrastructure. The scenario was designed to test how utilities and public-sector partners would respond if adversaries exploited a high-visibility moment and a stressed power system at the same time.

The warning is not limited to regions experiencing active war. Recent public reporting has highlighted a January 2026 arson attack in Berlin that caused a five-day blackout affecting 45,000 households, following a suspected arson attack on pylons in September 2025 that reportedly left 50,000 households without power. It has also pointed to recent U.S. criminal cases involving transformer bombings, attempted drone-based attacks on substations, and plots targeting multiple substations with firearms.

For utility operators, the practical implication is straightforward: substations are distributed, exposed, and difficult to secure uniformly at scale. As threat actors adopt more varied methods, a substation security strategy built only around fences, cameras, and traditional intrusion alarms becomes less adequate.

What GridEx VIII Revealed About Drone-Related Risk

One of the most important takeaways from the reporting around GridEx VIII is that drone threats are no longer being treated as a fringe concern. Instead, they are being incorporated into mainstream grid-security planning alongside conventional physical attacks, reflecting a broader recognition that low-altitude security near critical infrastructure has become an operational security domain of its own.

A key challenge identified in public reporting is that security teams need to distinguish a malicious drone from a harmless hobbyist aircraft quickly and reliably. That distinction sounds simple in theory, but in operational settings it is difficult, especially at substations where trees, structures, and equipment can interrupt line of sight and where operators may already be managing multiple sensor feeds at once.

This is why the article’s focus on detection architecture is valuable. Test configurations described publicly combine a 360-degree PTZ camera with four radar units mounted on a single platform, with radar used to maintain tracking when a drone moves behind obstructions and the camera used for visual confirmation. That setup captures the logic behind many modern low-altitude surveillance systems: radar detects and tracks, while optical systems identify and verify.

Integrated Counter-Drone Detection Architecture for Critical Infrastructure

Why Substations Need Fused Radar-Vision Detection

Substations do not have the same surveillance requirements as airports or border zones. They are fixed sites with a relatively compact security perimeter, but they often contain visual clutter, irregular sight lines, and critical equipment that must remain accessible for maintenance and operations.

That means an effective substation drone-detection system typically needs to do five things well:

• Detect low-altitude objects near the perimeter.
• Maintain track continuity through partial obstruction.
• Reduce false alarms from birds or debris.
• Integrate with existing perimeter-security systems.
• Remain economically deployable across a large and diverse asset base.

A fused radar-and-vision approach addresses those needs more effectively than a single-sensor design in many cases. Radar can sustain surveillance in conditions where a camera loses visibility, while PTZ and multi-spectrum optical systems can give operators the visual evidence they need to classify a target and make faster decisions. On sites where unattended monitoring and low false-alarm rates matter, that combination can be significantly more useful than either modality alone.

This broader logic also aligns with Midradar’s published positioning on radar-vision fusion systems and multi-spectrum observation systems. Across infrastructure-protection use cases, the company describes radar as the all-weather detection layer and optical payloads as the identification layer, linked through an auto-cueing workflow that helps create a continuous detect-and-identify loop.

For buyers evaluating substation drone security, it is also important to understand radar cross section (RCS) for drone detection, because small UAVs can present very different detection challenges depending on size, material, flight angle, and radar signature.

Bảo vệ vành đai

Regulation and Response Authority

GridEx VIII also highlighted an issue that goes beyond hardware performance: legal authority. Public reporting notes that NERC’s main recommendation called on U.S. and Canadian government partners to work with industry to identify legally accessible counter-drone technologies and clarify what government support is available, indicating that response authority is still evolving in many jurisdictions.

That distinction matters because detecting a drone and acting against it are not the same thing. A utility may be able to confirm that an unmanned aircraft is behaving suspiciously near a substation, but the authority to jam, disable, or otherwise intercept that aircraft may belong to law-enforcement or government entities rather than to the utility itself. As a result, detection systems must support not only awareness, but also documentation, escalation, and coordination.

For scenarios where authorized response workflows are required, an integrated counter-UAV system can help connect detection, visual verification, command management, and lawful response options within a more complete security architecture.

Regulation and Response Authority

Why This Matters for the Power Sector

For power companies, the value of GridEx VIII lies less in the exercise itself than in whether its lessons are converted into practical changes. Participation alone does not improve security unless utilities use the exercise to update procedures, technologies, and coordination models.

From that perspective, substation security is becoming a layered problem. Ground intrusion, vandalism, sabotage, unauthorized drone activity, and the regulatory limits around counter-drone response all have to be considered together rather than in isolation. Utilities that treat aerial detection as separate from perimeter security may find themselves with fragmented awareness and slower response times.

For vendors and system integrators serving this market, the opportunity is not just to offer a sensor, but to support a workable architecture for low-altitude site awareness. In practical terms, that means systems that can fit substation-scale perimeters, integrate with existing security infrastructure, and help operators move from detection to confirmed situational understanding with minimal delay.

To evaluate how radar, EO/IR cameras, low-altitude detection, and site-specific response workflows can be combined for critical infrastructure protection, utilities and security integrators can contact Midradar’s international team for a project-specific discussion.

Câu hỏi thường gặp

Are physical attacks on power grids actually increasing?

Reported physical security breaches reached more than 3,500 in 2025, up from 2,800 in 2023. Industry commentary has also described a broader increase in incidents over the past decade, although not all underlying data is public.

Was the GridEx VIII drone threat only hypothetical?

No. The exercise scenario was fictional, but public reporting has also cited real-world criminal cases involving attempts to attack substations and grid assets, including one case involving an explosive-laden drone. That is why drone-related risk is increasingly treated as a documented operational issue rather than a purely theoretical concern.

Why is radar-vision fusion relevant to substations?

Radar helps maintain tracking even when a drone moves out of a camera’s direct line of sight, while PTZ and multi-spectrum optical systems provide visual confirmation. The combination supports more reliable detection and identification in complex substation environments.

Can utilities legally respond to hostile drones on their own?

Not always. Public recommendations following GridEx VIII indicate that more clarity is still needed on legally accessible counter-drone technologies and on what support government partners can provide, which suggests that utilities may not always have direct authority to take active countermeasures themselves.