From Predictive to Prescriptive Security: How Large Language Modelss Transform Smart Grid Cyber Defense

Smart grids are evolving into highly distributed, data-rich cyber-physical systems where conventional cybersecurity approaches are increasingly insufficient. Most machine-learning??"based defenses remain fundamentally predictive: they detect anomalies, estimate risks, and issue alerts. While valuable, these systems stop short of supporting the rapid, context-aware decisions required during active cyber-physical events.

Large Language Models (LLMs) enable a transition toward prescriptive security, security that not only detects threats, but also reasons over system context, evaluates response options, and generates actionable guidance. By synthesizing heterogeneous inputs, including grid telemetry, system logs, operator annotations, threat intelligence, and distributed energy resource (DER) behavior, LLMs can produce structured threat explanations, prioritize mitigation strategies, and assist in coordinated response planning. This elevates cybersecurity from reactive pattern recognition to continuous, decision-centric defense.

This talk presents an LLM-enabled prescriptive security architecture that integrates reasoning engines, agentic coordination frameworks, and safety-constrained action layers to ensure operational integrity. We illustrate how such systems enhance situational awareness, support real-time mitigation planning, and enable adaptive cyber-physical defense across DER-rich environments. The result is a pathway toward more autonomous, resilient, and operationally aligned smart grid security.

Speaker: Mostafa Mohammadpourfard, Texas Tech University