Electric utilities, water authorities, and energy providers operate some of the most critical infrastructure in the country. Substations, pumping stations, and transmission facilities are designed for reliability and efficiency, not for absorbing hostile fire. Yet over the past several years, gunshot attacks against these sites have increased, exposing a security gap that many facilities teams are only now confronting.
Unlike cyber incidents, these attacks are often simple, fast, and devastating. A single rifle round can puncture a transformer, drain cooling fluid, and trigger a cascade of failures that leads to prolonged outages. Replacement equipment may take months to procure. In the meantime, communities lose power, essential services are disrupted, and the consequences can quickly escalate from operational inconvenience to public safety risk.
For facilities managers responsible for critical infrastructure, the challenge is not just preventing attacks but detecting them early enough to act before damage spreads.
Why Traditional Security Measures Fall Short
Most utility facilities already deploy perimeter fencing, access control, and video surveillance. These measures are necessary, but they are not sufficient for addressing gunfire threats.
Conventional cameras are designed to observe visible activity. They are effective for documenting intrusion or vandalism, but they cannot reliably detect a bullet strike on a transformer or identify the origin of a shot fired from hundreds of feet away. In many gunfire incidents, the shooter never crosses the fence line. The first indication of a problem may be a failing transformer, not the shot that caused it.
Facilities teams are then forced into a reactive posture, dispatching crews after damage has already occurred, often without understanding whether the event was accidental, malicious, or ongoing.
Understanding the Nature of the Threat
One of the most overlooked aspects of substation attacks is distance. Gunfire frequently originates well outside the facility perimeter, sometimes from tree lines, roadways, or adjacent properties. In these scenarios, the audible muzzle blast may never reach the site itself. Only the supersonic ballistic wave created by the projectile passes through the facility.
Security approaches that rely solely on perimeter-based detection or human reporting struggle in these conditions. By the time an issue is discovered, valuable minutes or hours may have been lost.
Facilities leaders need detection strategies that acknowledge this reality: Threats do not respect fence lines.
The Importance of Speed and Context
When gunfire occurs near critical infrastructure, time matters. Early awareness can allow operators to reroute power, isolate equipment, or safely shut down affected assets before catastrophic failure occurs. Delayed awareness often means damage has already compounded.
Equally important is context. An alert without visual verification forces facilities teams to choose between overreacting and underreacting. Visual and situational confirmation allows teams to quickly distinguish between malicious attacks, accidental discharges, or unrelated activity such as hunting near rural facilities.
The goal is not automation for its own sake, but actionable intelligence that supports confident decision-making.
Hunters or Vandals?
In one recent example, a gunshot detection system reported gunfire at a remote substation. Through the linked PTZ (pan-tilt-zoom) camera, operators quickly confirmed that the shots came from hunters outside the perimeter and that there was no threat to equipment or personnel. The team was able to assess the situation instantly without dispatching crews or contacting law enforcement.
Integrating Detection with Existing Systems
Modern facilities management increasingly depends on integrated systems rather than standalone tools. Gunshot detection should not exist in isolation. It should work in concert with existing video management platforms, mapping systems, and operational workflows.
When detection data can automatically slew PTZ cameras, update facility maps, and alert operators in real time, security teams gain immediate situational awareness. Instead of searching through multiple screens or dispatching personnel blindly, they can see what happened, where it happened, and whether the threat is credible.
This integration reduces response friction and shortens the gap between detection and action.
Cybersecurity and Closed Networks Matter
Many utility operators maintain strict cybersecurity policies that prohibit external internet connectivity within operational environments. Any security technology deployed in these facilities must function within closed, on-premises networks and align with existing cyber governance frameworks.
From a facilities management perspective, this requirement is non-negotiable. Physical security enhancements should never introduce new digital risk. Systems that rely on external processing or cloud connectivity may be unsuitable for sensitive infrastructure environments, regardless of their capabilities.
Minimum Compliance Does Not Equal Adequate Protection
Regulatory standards such as NERC CIP-014 require utilities to identify and protect critical transmission assets from physical threats. Compliance is essential, but it should be viewed as a baseline, not the end goal.
Facilities leaders who focus solely on meeting minimum requirements risk designing security programs that document incidents after the fact rather than preventing outages in real time. Effective protection strategies prioritize resilience, uptime, and the ability to act decisively under pressure.
A Facilities-Led Path Forward
Protecting utility facilities from gunfire requires a shift in mindset. It is not solely a security issue or a compliance exercise. It is an operational continuity challenge that sits squarely within the facilities domain.
Facilities managers are uniquely positioned to advocate for solutions that prioritize early detection, system integration, and operational practicality. By combining edge-based AI, on-premises software, and open integration with existing security systems, a modern gunshot detection system can provide facilities the situational awareness needed to protect its assets and its customers. Critical infrastructure will always be a potential target. The question is whether facilities teams have the visibility and response capability to protect it before a single shot becomes a prolonged outage.
Timothy English is currently the managing director of security solutions at Acoem. English has 14 years’ experience in commercial leadership of sensor-based technology companies, including SKF, Pruftechnik (Fluke), and RDI Technologies. Before his industry career, he spent nine years on active duty in the U.S. Navy, primarily as an officer in the E-2C Hawkeye platform, and is a recipient of the Bronze Star Medal. He holds a BA from Penn State University and an MBA from Miami University.