Bethesda, MD, Oct. 15, 2026 (GLOBE NEWSWIRE) -- Brian Harrell, Vice President and Chief Security Officer at FirstEnergy, told attendees of the 2026 SANS ICS Security Summit that defenders should assume an adversary may already be inside the environment. On October 27, he joins three other industrial security leaders in a free SANS Institute executive roundtable on what critical infrastructure organizations should prioritize before a nation-state campaign tests their plans.
“We all depend on electricity, we all depend on clean drinking water, we want the ability to pull cash out of the ATMs,” said Harrell, “and as our nation-state adversaries decide that they want to prepare for war, they are also prepping the battlefield.”
Critical infrastructure organizations have built their cybersecurity strategies around two expectations: that communications stay available during an incident and that recovery is measured in days. The webcast, “The New Priorities for Critical Infrastructure Preparedness: Responding to a New Era of Nation-State Threats,” looks at how they can keep operating when those expectations no longer hold. It runs Tuesday, October 27, from 2 to 3 p.m. EDT, and the four speakers will cover decision-making under degraded conditions and coordination across the enterprise.
For leaders who are unsure whether they have the right tools in place, Harrell said, “now is the opportunity under blue sky conditions, so to speak, to ask for the budget dollars for next year.” Harrell, a former U.S. Department of Homeland Security Assistant Secretary for Infrastructure Protection, is joined by Robert M. Lee, SANS Fellow and CEO of Dragos, Inc. Lee is the author of ICS515: ICS Visibility, Detection, and Response. The roundtable also includes Mark Bristow, SANS Principal Instructor and Director at MITRE’s Cyber-Physical Systems Division, and Tim Conway, SANS ICS Curriculum Lead and SANS Fellow.
“A coordinated campaign can strain the same responders and mutual aid that many organizations are counting on at the same time,” said Conway. “That puts more weight on what each organization can do for itself, so we want operations and security teams working from the same priorities ahead of time.”
An Executive Discussion Brief follows the webcast, summarizing the priorities discussed and mapping them to relevant SANS learning paths. Of unique interest to Electric utilities joining the webcast, the SANS ICS Curriculum has also updated ICS456: Essentials for NERC Critical Infrastructure Protection, aligning the course with current requirements for the Bulk Electric System set by the North American Electric Reliability Corporation (NERC). The update adds coverage of internal network monitoring (CIP-015), virtualization, and lower-risk sites, with rebuilt labs on the RELICS virtual machine and new audit trend analysis from SANS.
The course is built for electric-sector security and compliance teams, and Conway is one of its co-authors. The course has always focused on requirements currently in effect, however, there are a number of forthcoming Standards and updates with future enforcement dates which need attention now. The course better balances what utilities should be focused on currently with future priorities.
Across critical infrastructure sectors, leaders and teams often look to their peers to determine benchmarks and identify data sets to base decisions on. Industry-led surveys and reports provide these insights on a larger scale, helping organizations build more resilient programs. The 2026 State of ICS/OT Security Report follows the webcast, going live November 10, extending the conversation with accompanying data.
To register for the October 27 webcast, visit go.sans.org/h3H1Hd. To learn more about the updated ICS456 course, visit sans.org/cyber-security-courses/essentials-for-nerc-critical-infrastructure-protection.
About SANS
The SANS Institute was established in 1989 as a cooperative research and education organization. Today, SANS is the most trusted and, by far, the largest provider of cybersecurity training and certification to professionals in government and commercial institutions worldwide. Renowned SANS instructors teach more than 85 courses at in-person and virtual cybersecurity events and OnDemand. GIAC, an affiliate of the SANS Institute, validates practitioner skills through more than 50 hands-on technical certifications in cybersecurity. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master’s and bachelor’s degrees, graduate certificates, and an undergraduate certificate in cybersecurity. SANS also delivers a wide variety of free resources to the InfoSec community, including consensus projects, research reports, webcasts, podcasts, and newsletters; it also operates the Internet’s early warning system, the Internet Storm Center. At the heart of SANS are the many security practitioners representing varied global organizations, from corporations to universities, working together to support and educate the global information security community. www.sans.org
Meg Cafferty SANS Institute 301-654-7267 press@sans.org
