Substation Monitoring for the Discretionary 74,000

The 2022 Moore County, North Carolina incident — 45,000 customers offline for days — was on a distribution-tier substation, not a transmission-tier one. The 2025 NERC expansion of CIP-014 brings physical-security planning obligations down from transmission into the distribution-feeder layer for the first time. The compliance perimeter moved. The procurement perimeter hasn’t.

What’s left for a co-op general manager or a municipal utility ops director is a documented compliance obligation, a budget envelope that didn’t grow to match it, and a vendor field built for a different customer. Infrastructure for the unguarded isn’t metaphor. It is the operating condition of the U.S. distribution grid in 2026.

The 74,000 substations the incumbent stack wasn’t priced for.

The big names in substation monitoring built their product portfolios for investor-owned utilities. The per-substation pricing, the integration cycle, the SCADA-team assumption, the multi-year procurement timeline — all of it was sized to the Fortune-500-utility customer. Rural electric cooperatives, municipal utilities, independent power producers, community-solar and BESS operators, customer-owned industrial substations — none of those buyer profiles map cleanly onto an enterprise sales motion. The match is structural, not preferential.

So the 74,000 stay discretionary in practice. A NERC CIP-014 expansion moves the regulatory text; it doesn’t move the underlying procurement physics. Operations managers know the gap better than anyone — they’re the ones absorbing the copper-theft losses, the vandalism repair costs, the customer-outage hours, and the insurance-renewal questions on behalf of the customer base that funds the co-op.

What changes when monitoring is decentralized.

Edge Orbital is building substation monitoring that runs on three architectural premises the incumbent stack doesn’t share:

1 · Each site stands alone. The monitoring node runs full perception and pre-incident detection locally. No central-cloud dependency. No SCADA integration cost. No broadband-uplink requirement. A node continues to do its job during a regional internet outage, during a sustained attack on backhaul, during the contested conditions where substation monitoring matters most. Decentralized here is an architectural property, not a marketing word.

2 · Behavioral detection at the perimeter. The detection layer is built to recognize casing, scoping, dwelling, returning — the activity sequence that precedes a physical attack, a copper-theft event, or an equipment-tampering incident. Sensor fusion across visual, radio, and spatial-temporal modalities makes the discriminator robust under fog, low light, weather, and the back of the site that’s outside a camera’s pan range.

3 · Operator-budget pricing, ops-manager-routed alerts. The unit economics target the line item that closes inside a co-op operating budget. Alerts route to the ops manager and the line crew — text, dispatch, app — not to a 24/7 SOC contract. The decision to roll a truck stays with the people who know the site, the conditions, and the crew. Capability before claim: we are pre-pilot and explicit about it.

The convergent windows.

• CIP-014 distribution expansion (2025). Physical-security planning obligations now reach into the distribution-feeder layer. The documented program requirement applies to substations where no documented program previously existed.
• DOE GRIP §40101(c). $2.5B in grid resilience funding with explicit eligibility for rural electric cooperatives and small utilities. The funding flows through exactly the buyer tier the incumbent monitoring vendors don’t reach. Federal infrastructure policy chose the same customer Edge Orbital chose — reindustrialization at the pole.
• Threat volume. 5,800 substation physical-security incidents recorded by E-ISAC across 2022–2024. The defenders haven’t been given an affordable answer for the layer they’re now responsible for.
• Insurance pricing. Carriers are tracking physical-security postures and pricing accordingly. The CFO conversation is no longer hypothetical.

Dual-use, by design.

The same sensor-fusion and behavioral-detection stack that catches copper-theft recon catches the multi-night reconnaissance that precedes coordinated physical attacks on transformers, breakers, and capacitor banks. The pattern shape is the same; the response window is the same; the architectural answer is the same. Dual-use, by design means the underlying capability serves both civilian critical-infrastructure protection and adjacent threat-recognition without re-engineering. The buyer tier is the same. The architecture is the same. Supporting the national interest in this context means closing the loop between recon and incident across the layer of the grid that already knows it’s exposed.

Who this is for.

• Co-op general managers with a CIP-014 expansion obligation and an operating budget the incumbent monitoring vendors price past.
• Municipal utility ops directors with distribution-tier substations and rising physical-attack and copper-theft loss patterns.
• Customer-owned industrial substation operators — refineries, midstream terminals, agricultural processing, rural data-center sites — with operator-budget perimeter monitoring needs.
• Community-solar and BESS operators at the 10–50 MW scale with remote-site monitoring obligations that don’t justify an enterprise-grade monitoring contract.

The compliance perimeter moved. The procurement options haven’t.

Edge Orbital is building pre-incident detection for the 74,000 substations the incumbent stack wasn’t priced for — decentralized resilience for national interest infrastructure, dual-use by design.

Read the full critical-infrastructure thesis or talk to us about a pilot.