Securing the Race for AI, Powering the Race for the Future

Beijing clearly views its early lead in modern energy manufacturing, and its ability to rapidly deliver resilient and abundant electricity, as a strategic asset worth protecting. Chinese President Xi Jinping has repeatedly emphasized the need to coordinate "new energy" development alongside broader national security considerations, fusing its national security and economic impacts.^v As global investment in these digitally-native technologies approaches $2 trillion annually, China has positioned itself at the center of one of history's largest capital opportunities—insulating itself from economic isolation while maintaining leverage over critical supply chains.^vi The United States must signal an equally serious political, financial, and security commitment to leadership in these technologies.

While Washington shouldn't reactively mirror Beijing's every move, it must recognize when our competitors are right: Modern, digitally-native energy technologies are not just trendy nice-to-haves, but strategic imperatives for maintaining competitiveness in both the AI race and the broader contest for technological leadership.

RECOMMENDATION

The US government should adopt a whole-of-nation strategy to guarantee the security, availability, and vendor trustworthiness of the modern energy technologies that will be key to powering the AI race and subsequent engines of innovation.

• This strategy should focus in the near term on the cybersecurity of key modern energy technologies (especially those with high dependence on PRC supply chains) and scalable solutions to promote the faster deployment of secure and resilient electricity.
• For the medium term, it should adapt lessons learned from US and allied semiconductor supply chain diversification efforts, including maintaining both leading-edge innovative engines to maintain advantage as well as trailing-edge production capacities to hedge against supply disruption.
• This strategy should prioritize maintaining US and allied leadership in international energy technology financing. This should ensure that cyber-secure and trusted technology is accessible to emerging markets, that those markets’ demand can contribute to scaling US and allied manufacturing capacity, and in so doing, balance PRC influence over the future of those markets’ energy security so we avoid another Huawei-and-5G-style setback.^vii

The development, security, and deployment of modern energy technologies is increasingly intertwined with US-China competition, but the communities driving each remain dangerously siloed. Traditional energy and security stakeholders possess decades of experience mitigating national security threats, but are poorly integrated with the entrepreneurs and innovators deploying digitally-native technologies that now comprise the large majority of new electricity generation. Meanwhile, modern energy developers—often smaller, more numerous, and less security-sophisticated than their traditional counterparts—are racing to deploy sophisticated software-defined systems without adequate access to threat intelligence or security frameworks. This disconnect extends throughout our governance structures: public-private critical infrastructure protection bodies have not updated their frameworks to address the fundamentally distinct way modern energy technologies interact with digital connectivity, while energy policy processes deploy grid-transforming technologies with minimal integration of national security expertise.

The convergence of AI compute and rapidly-digitizing energy infrastructure demands a more integrated "China risk/energy risk" community of practice that can transform sources of potential technical vulnerability instead into strategic advantage, but will require leadership from the White House and industry executives to succeed.

RECOMMENDATION

The US government should intentionally integrate relevant national security and modern energy policymaking processes and frameworks.

• Given the rapidly growing importance of modern, digitally-native technologies to our grid, the National Energy Council—and other relevant energy-focused policymaking bodies and processes—should include CISA and the National Security Agency in its membership.
• The next National Infrastructure Risk Management Plan, a White House-directed policy update coordinated by CISA and due later in 2025, should explicitly incorporate the novel considerations introduced by modern energy technologies.

RECOMMENDATION

Industry coordination and intelligence distribution bodies, like Information Sharing and Analysis Organizations and Centers (ISAOs/ISACs), should ensure their membership and processes are designed to incorporate and engage with the modern energy ecosystem and its structural novelties.

• ISAOs/ISACs should review a) their membership to ensure they reflect the modern, digitally-native energy influence in their marketplaces, and b) restructure their coordination mechanisms to better integrate with smaller, more numerous, and less risk-sophisticated modern energy stakeholders.
• ISAOs/ISACs and sector-specific coordinating councils should adapt security and resilience resources for modern energy stakeholders’ unique considerations, including those on secure-by-design principles, technical standards implementation, and open-source software security.

RECOMMENDATION

Electricity sector stakeholders, from utilities to the tech industry, should drive coordinated cybersecurity practices that are tailored to and scalable among the broader modern energy marketplace.

• The country’s energy utilities should coordinate on shared guidance for “what right looks like” for the unique cybersecurity considerations of integrating digitally-native energy technologies into their grids. This will make it easier for more modern energy vendors to scale their contributions to security and resilience across different regional regulatory jurisdictions and integrate into different regional grids more quickly, all while helping mitigate broad regulatory gaps in electricity infrastructure cybersecurity.
• Cloud computing hyperscalers, whose next-generation AI training and inference data centers are helping to propel historic increases in electricity demand, should use their purchasing power to inform and drive new modern energy cybersecurity practices. As some of the few actors in the US economy possessing deep expertise in both energy economics and PRC exploitation of flawed software, today’s AI-driven hyperscalers should use their influence over the next generation of energy deployment to inform and drive the development of modern energy-specific security practices.

The convergence of AI and modern energy infrastructure is evolving at unprecedented speed, demanding frameworks that can adapt as quickly as the technologies they govern. Just years ago, batteries were peripheral to grid planning—today they keep entire states’ grids operational during peak demand.^viii The shift from training-intensive to inference-intensive AI is similarly upending assumptions about data center geography, latency requirements, and co-located generation needs. Our prioritization frameworks must be equally dynamic, capable of rapidly reassessing which technologies pose the greatest systemic influence—and bring the most digital risk—as the landscape shifts. Virtual power plants, for example, are entirely software-defined with massive systemic impact, yet their digital nature may make them easier to secure through established software validation practices—if we act quickly. Batteries present a more complex challenge: digitally sophisticated enough to pose risk, systemically critical to grid stability, yet often dependent on Chinese supply chains that challenge traditional security controls. Meanwhile, breakthroughs in solid-state batteries, enhanced geothermal, or fusion reactors could suddenly offer leap-ahead opportunities to break supply chain dependencies—but only if policymakers are watching for them.

As specific technologies and threats evolve, certain principles must endure: prioritizing the security of our most systemically critical infrastructure, maintaining vendor trust and supply chain awareness, and ensuring that every new deployment enhances rather than undermines our grid's defensibility against adversary attack. But in this current environment, our greatest risk may be fighting yesterday's war with outdated assumptions about where threats and opportunities lie. To operationalize this balance between enduring priorities and adaptive flexibility, we need assessment frameworks that are rigorous enough to guide billion-dollar infrastructure investments yet nimble enough to evolve with the rapidly shifting AI-energy landscape. These frameworks must evaluate both relative risk—assessing digital exposure and systemic influence across technologies—and difficulty of remediation—identifying which vulnerabilities can be addressed through scalable interventions, versus those requiring bespoke solutions.

The convergence of AI and modern energy infrastructure is evolving at unprecedented speed, demanding frameworks that can adapt as quickly as the technologies they govern. Batteries evolved from grid afterthoughts to essential stability anchors in just a few years; the shift from training-intensive to inference-intensive AI is similarly rewriting assumptions about where compute must be located and how it must be powered. This velocity of change creates a dangerous gap: Our security structures and supply chain strategies are calibrated to a landscape that no longer exists. Technology policymakers until recently barely tracked—like virtual power plants, demand response, energy storage, and distributed microgrids—now hold systemic influence over our grid's resilience, yet many remain deeply dependent on PRC-controlled supply chains or operate outside traditional security oversight.

This dynamism demands a more nimble approach to risk assessment and technology development—one that can identify which emerging technologies pose the greatest security exposure while simultaneously spotting opportunities to break free from geopolitically risky dependencies. We need frameworks agile enough to continuously reassess the threat landscape as new technologies achieve critical mass, yet rigorous enough to guide major infrastructure investments. Equally important, we must actively cultivate breakthrough alternatives—like in solid-state batteries, enhanced geothermal, or advanced nuclear and fusion—that could provide leap-ahead substitutes for the PRC-dominated components that define our energy supply chains. The US government should work with industry to establish assessment mechanisms to track this evolving landscape, and R&D priorities to shape it in America's favor.

RECOMMENDATION

The Office of the National Cyber Director, Department of Energy, CISA, and the National Security Agency should develop a joint risk and remediation framework for modern energy technologies.

• The assessment should recognize “linchpin technologies” key to our AI-driven grid buildout according to digital exposure, systemic impact, and relevant threat intelligence. It should identify areas of scalable interventions for swifter and more secure deployment—such as with broader adoption of certain secure software development practices—and areas where bespoke interventions may be required.
• The assessment should consider near-term cybersecurity considerations as well as longer-term supply chain dependencies that may impede greater certainty in relevant technologies’ security and resilience.

RECOMMENDATION

The Office of Science & Technology Policy, the Department of Energy, and the Department of Commerce should establish an R&D strategy for modern energy technologies that not only are game-changing generation and storage tools, but also provide “leap-ahead” substitution opportunities for US and allied manufacturers currently dependent on PRC supply chains and electrotech advantages.

• This R&D strategy should identify and accelerate emerging technologies that could help break U.S. and allied dependence on vulnerable or insecure supply chains.
• This strategy should adjudicate for which technologies the United States is willing to tolerate relative PRC dominance—perhaps including, for example, relatively “dumb” and commodity energy components—and those that are more systemically impactful and over which the United States should seek to retain influence, such as in battery storage or other more digitally-native platforms.