From Predictive to Prescriptive Security: How LLMs Transform Smart Grid Cyber Defense

Smart grids are evolving into highly distributed, data-rich cyber-physical systems where conventional cybersecurity approaches are increasingly insufficient. Most machine-learning–based defenses remain fundamentally predictive: they detect anomalies, estimate risks, and issue alerts. While valuable, these systems stop short of supporting the rapid, context-aware decisions required during active cyber-physical events.

Large Language Models (LLMs) enable a transition toward prescriptive security, security that not only detects threats, but also reasons over system context, evaluates response options, and generates actionable guidance. By synthesizing heterogeneous inputs, including grid telemetry, system logs, operator annotations, threat intelligence, and distributed energy resource (DER) behavior, LLMs can produce structured threat explanations, prioritize mitigation strategies, and assist in coordinated response planning. This elevates cybersecurity from reactive pattern recognition to continuous, decision-centric defense.

This talk presents an LLM-enabled prescriptive security architecture that integrates reasoning engines, agentic coordination frameworks, and safety-constrained action layers to ensure operational integrity. We illustrate how such systems enhance situational awareness, support real-time mitigation planning, and enable adaptive cyber-physical defense across DER-rich environments. The result is a pathway toward more autonomous, resilient, and operationally aligned smart grid security.

Bio

Dr. Mostafa Mohammadpourfard is an Assistant Professor at Texas Tech University specializing in cybersecurity and artificial intelligence for smart grids and renewable energy systems. His research develops resilient, learning-enabled defense architectures for distributed energy resources and critical energy infrastructure. He has authored more than 50 peer-reviewed publications in leading AI, cybersecurity, and smart grid conferences and journals. Prior to joining Texas Tech, he was a Postdoctoral Researcher at Arizona State University and a Marie Skłodowska-Curie Fellow at Istanbul Technical University. His work has been supported by the European Commission and industry partners, and he contributes to federally funded initiatives advancing cyber resilience in critical infrastructure.