Power utilities have spent years building visibility across enterprise IT, operational technology, identities, and the systems that support substations, solar facilities, data centers, and other critical operations. But those systems don’t necessarily describe the wireless communications happening around them. Cellular devices, Wi-Fi access points, Bluetooth and BLE devices, IoT systems, radios, and other wireless technologies can operate in and around utility facilities without necessarily appearing in the telemetry generated by managed IT and OT infrastructure.
The harder problem is not detecting a wireless device. It is deciding whether that device belongs there, understanding what it means in the context of utility operations, and knowing what to do next. Operational RF monitoring goes well beyond placing sensors. It includes site planning, defined collection objectives, performance measures, post-deployment review, asset reconciliation, risk-based site selection, and integration with existing security operations. Together, these practices turn RF monitoring from a one-time assessment into a routine part of security operations.
Start With the Utility Environment, Not the Sensor
Utilities should start wireless security with the site and the questions they need to answer. A substation, solar facility, data center, LNG facility, or AMI lab may have different operating conditions, approved technologies, and security priorities. The work starts with site-owner requirements, network topology, physical layouts, planned sensor locations, and clear data-collection goals.
Those goals include identifying unauthorized RF transmissions, rogue access points, Bluetooth and BLE devices, and cellular signals. Teams also collect device identifiers, signal types, timestamps, and location data so they have the context needed when a detection requires follow-up. That changes the question from “Can we detect wireless devices?” to “What should be communicating here, what is actually present, and does anything require a closer look?”
A wireless device isn’t suspicious just because it exists. A cellular modem may be approved equipment. A Bluetooth device may be expected at that site. A detected device may belong to an authorized contractor or visitor. The important part is knowing enough about the device and its context to determine whether it belongs there.
“Unauthorized or Unknown wireless connections can expose the systems to new AI threats without the ability to protect them. Vendor products do not consider the cyber threat.”
— A CIO of a large New England utility
Measure Security Outcomes, Not Device Counts
The number of wireless devices detected may describe a site, but it says little about whether the security program works. More useful measures include detection-to-alert time, alert-to-action time, RF coverage, blind spots, physical location accuracy, time to locate a device, system reliability, and false-positive and false-negative rates.
The point is not how much RF data the system collects. It is whether the utility can use that data to investigate and respond. If an unexpected wireless device appears at a sensitive site, the team needs to determine what it is, where it is operating, whether it is expected, and whether it matches approved equipment. If those answers come quickly enough to support an investigation, the utility is getting more than another source of RF data.
Compare What Should Be Installed With What Is Actually Operating
Asset inventories matter in utility environments because internal teams, vendors, contractors, and other third parties can introduce equipment. In practice, that means maintaining a central record of approved RF technologies, including radios, sensors, LTE modems, IoT devices, vendor equipment, lifecycle status, implementation notes, and site information. It also means comparing detected devices with that inventory, distinguishing the expected environment from the observed environment.
Expected environment: What engineering records, asset inventories, and approved architecture say should be present.
Observed environment: What is actually communicating at the site.
A difference between the two does not automatically mean there is a security incident. It may point to outdated documentation, temporary contractor equipment, an undocumented modem, an operational change, or something else that deserves review. For utilities, that distinction matters. A network or OT asset inventory can be accurate and still incomplete if it omits independently communicating wireless equipment.
“You can only protect what you know. When devices are deployed outside of normal IT Procedures, then the inventory will be wrong and normal hardening procedures would not have been applied.”
— A CIO of a large New England utility
Wireless Security Requires Context Beyond the SOC
Utility cybersecurity rarely operates alone. Physical security may know who entered a substation or another critical facility. Networking may know which infrastructure has been approved. OT engineering may know which radios, gateways, sensors, modems, and other equipment should be present. Cybersecurity may be the first team to see an unexpected wireless device.
Those sources don’t tell the whole story. Access logs and visitor schedules can add context to wireless observations, while approved equipment inventories and network baselines can help determine whether a detected device is expected.
Consider a substation where an unfamiliar wireless device appears while contractors are onsite. Wireless monitoring shows that the device is present and where it is operating. Access records show who entered the facility, while OT and networking records show whether corresponding equipment was approved. Together, that information can help the utility decide whether it’s expected work, an inventory gap, or something that needs investigation.
That also makes wireless security a cross-functional issue. The picture becomes much clearer when cybersecurity, OT engineering, networking, physical security, and technology leaders can compare what each of them knows about the same event.
Prioritize Monitoring by Utility Risk
Not every utility facility needs the same monitoring approach. Utilities should prioritize sites based on factors such as criticality, RF activity, operational impact, and recent security concerns. Higher-risk locations may warrant more attention, while other facilities may only need periodic assessments.
Deployment duration can also vary by environment. Shorter deployments may help when contractor activity or temporary projects create changing conditions. Longer deployments can help establish patterns at more stable locations. Permanent monitoring may make sense at critical sites with known RF concerns or elevated risk.
For utility leaders, the question is not simply where monitoring can be installed. It is where risk justifies persistent monitoring and where periodic monitoring is sufficient. That makes deployment strategy a risk decision, not a technology rollout.
Bring Wireless Intelligence into the Security Stack
Wireless data becomes more valuable when integrated into existing security operations. RF information can feed into enterprise security platforms and correlate with privileged-access events, broader telemetry streams, and OT asset intelligence.
The goal is not to create another alert stream for the SOC. It is to give analysts and technology leaders additional evidence when the existing data does not tell the whole story. Was an unexpected device physically present during an event? Where was it operating? Did it match an approved asset? Did its presence align with authorized personnel, maintenance work, or other expected activity? Wireless information can help answer those questions when other systems cannot.
“Wireless technologies can be set up with OT assets and may connect directly to the internet. Stand-Alone wireless connections bypass normal cyber controls. Detection is critical for securing the environment.”
— A CIO of a large New England utility
From RF Monitoring to Utility Security Operations
Power utilities will continue to operate in environments where cellular, Wi-Fi, Bluetooth, IoT devices, radios, sensors, and other wireless technologies are part of the operational landscape. The security challenge is not to treat every wireless communication as a threat. It is to understand the environment well enough to distinguish expected operations from exceptions.
Wireless security is becoming less about finding radios and more about understanding what those radios mean in the context of the power grid. When wireless observations become part of asset management, physical security, OT operations, and incident investigation, utilities gain a more accurate picture of what is actually operating across their critical environments. The result is a shift from treating RF monitoring as a technical capability to treating wireless security as an operational discipline.