Powering Cyber Resilience: Expert Insights from Energy Sector CISO Vishnu Murali

Interview with Vishnu Murali | Cybersecurity leader at a large regulated U.S. electric utility | 15+ years in cybersecurity, including CISO and critical infrastructure leadership roles

Published: July 2025 · Reviewed to correct regulatory terminology and remove operational details. The article reflects the expert's views and does not describe the security controls of any specific organization.

Stuxnet proved in 2010 that an air gap is not a defense strategy. Vishnu Murali, who has spent more than 15 years in cybersecurity for regulated and critical infrastructure, sees the same lesson repeating with AI: the systems that look isolated are often the ones least prepared for what reaches them.

Stuxnet Changed the Job

Murali's view of security was shaped by Stuxnet, the worm discovered in 2010 that spread through infected USB drives, exploited several zero-day vulnerabilities and manipulated industrial controllers to cause physical damage. It showed that air-gapped industrial control systems were not safe by default.

"That was the moment cybersecurity for air-gapped systems evolved from a compliance checkbox to a mission-critical function for the energy sector's OT and ICS/SCADA systems," Murali recalls. "Incident response stopped being a contingency. It became the foundation for resilience."

The experience still shapes how he builds defense in depth: real-time threat detection, zero-trust segmentation and operational resilience, even for the most "isolated" operational technology.

Keep Grid Data Out of the Model

Regulated utilities need strict rules on how data is classified, compartmentalized and shared, and AI raises the stakes. In the North American electric sector, the NERC Critical Infrastructure Protection (CIP) standards require utilities to protect BES Cyber System Information (BCSI), meaning information about the systems that operate the Bulk Electric System that could be used to gain unauthorized access or pose a security threat. Keeping BCSI out of large language model training data and prompts is both a security and a compliance issue.

In Murali's experience, proposals for stricter access controls and AI usage policies often meet early resistance, and audits of shared content tend to surface sensitive operational data in places it should not be. The fix requires policy, process and tooling to line up across data governance, cybersecurity and AI teams. Research on training-data extraction has also shown that language models can memorize and reproduce parts of their training data verbatim, including personal information.

Murali's Advice for Rising Security Leaders

Classic lessons that still apply:

• Enforce zero trust, even on "air-gapped" OT. Publicly disclosed ICS vulnerabilities have grown sharply in recent years.
• Harden the software supply chain. SolarWinds disclosed that up to about 18,000 customers downloaded the compromised Orion update in 2020, including several U.S. federal agencies.
• Make security a company-wide mandate. Cross-department training and information sharing shorten detection time and reduce incident cost.
• Engineer for the digitized smart grid. The U.S. Department of Energy's Smart Grid System Report notes that more connected devices and data flows expand the attack surface. Segmentation, real-time OT visibility and secure-by-design procurement follow from that.

New lessons for AI in operational technology:

• Audit AI pipelines for data leakage. AI tools embedded in SCADA and HMI layers may ingest or infer protected operational data.
• Secure autonomous agents. AI tools that take corrective action on their own, such as fault isolation or feeder switching, must be hardened against model manipulation and logic poisoning.
• Test AI-driven decisions adversarially. Control logic for predictive maintenance or load shedding should be tested against compromised inputs.
• Control model updates and drift. Without versioning, rollback and approval workflows, a corrupted model can spread across control zones.
• Prepare for automation bias. Operators who rely too heavily on AI may miss overrides when a model is tampered with or hallucinates.

AI on Both Sides of the Fight

Murali sees cybersecurity investment in the energy sector growing, driven by AI threats, regulation and modernization, with much of it going to tooling rather than headcount. "We're modernizing faster than ever before. Defensive tooling has to scale with that."

That spending goes two ways: protecting AI systems from misused data, injection attacks and unintended training, and using AI to improve defense through real-time detection, automated response and smarter vulnerability scanning. "It's not about blocking AI. It's about structuring how it learns and what it sees." And: "AI helps us patch faster, see more clearly and respond in seconds. It's not just an enabler. It's essential now."

What He Looks for in a Security Vendor

• Breadth of attack-surface coverage
• Proven performance in energy environments
• Transparent, explainable model behavior
• Interoperability with regulatory and OEM ecosystems
• A record of zero-day disclosure and collaboration with government threat intelligence

Vishnu Murali is a cybersecurity leader with more than 15 years of experience, including CISO and critical infrastructure leadership roles in regulated and unregulated industries. He currently works at one of the largest regulated electric utilities in the United States, where he oversees cyber defense operations.

Sources

• NERC CIP standards, including CIP-004 and CIP-011 on BES Cyber System Information
• SolarWinds Form 8-K, December 2020
• U.S. Department of Energy, Smart Grid System Report

Related on the Community Hub

• Reframing Cybersecurity in Private Equity Transactions
• Governing AI at Scale with ISO/IEC 42001
• Rethinking Channel Partnerships in the Age of XDR and AI

‍