AI Agents for the Energy Sector

A grid modernization grant has a deadline attached, a compliance narrative required, and an underlying network that was built when Windows XP was current. That is the actual state of most utility SCADA environments: control systems bolted onto infrastructure from a different decade, with segmentation that was never designed against a modern threat model, sitting inside a physical supply chain sprawling across substations, meters, relays, and vendor firmware nobody on staff wrote. The grid modernization project meant to fix this has been stuck in planning for years, not because the engineering is hard, but because nobody wants to be the person who signs off on a network diagram for a system that trips a breaker if you get it wrong. A generalist AI tool asked to help with this will produce a generic segmentation whitepaper. It will not read your actual SCADA topology, will not flag the vendor with expired firmware attestation sitting three hops from the historian server, and will not produce anything you can hand to a grant auditor. That gap, between generic advice and an audit that actually reflects your network, is where Forge does its work.

Why ChatGPT and Cursor both stop short here

Ask ChatGPT or Claude.ai to help with SCADA network segmentation and you get a well-organized explanation of the Purdue model, a list of best practices for OT/IT boundaries, and a reminder that NERC CIP compliance matters. All of it is true. None of it is specific to the utility asking. A generalist chatbot has no way to read your firewall rule exports, no way to trace which historian server talks to which HMI across which VLAN, and no way to tell you that the RTU firmware on your western substations hasn't been patched since a vendor that no longer exists shipped it. It gives you a framework. What a grid modernization grant deadline requires is a finding: which segments fail, which vendor risk is unaddressed, and what the remediation sequence looks like before the money runs out.

Cursor and GitHub Copilot solve an entirely different problem and were never built for this one. They are excellent at autocompleting a Python script that parses a firewall config export. They have no concept of a control network's physical topology, no model of what a substation's air-gapped segment is supposed to look like versus what it actually looks like after fifteen years of ad hoc vendor remote-access exceptions, and no mechanism for producing the kind of structured audit a compliance office or a grant reviewer needs to see. Autocomplete tools operate at the file level. A SCADA segmentation audit operates at the network topology level, and it has to hold the full picture, every VLAN, every firewall rule, every vendor connection, in view at once to find where the boundary actually breaks.

The mismatch is structural, not a matter of the tool needing a better prompt. A chatbot answers the question you type. An infrastructure audit has to go looking for the questions you didn't know to ask, the vendor VPN tunnel someone set up in 2019 and forgot to document, the flat subnet spanning three substations that predates any segmentation policy at all. That requires an agent that reads the actual network state first and produces findings second, not one that pattern-matches a generic answer to a generic-sounding question.

Forge, and where Mesh and Chain fit

Forge is Tonone's infrastructure engineer, built for exactly the kind of network and cloud audit work a utility's grid modernization effort requires. Where a SCADA environment mixes OT and IT concerns, Forge treats the network layer as the thing to inventory and harden before anything else gets touched: VPCs, subnets, firewall rules, DNS, the physical and logical boundaries that either hold or don't. Two related Tonone agents sit alongside Forge on utility work. Mesh, the service mesh specialist, becomes relevant once segmentation is in place and the utility is modernizing how services within a segment authenticate to each other, mutual TLS between historian, HMI, and engineering workstation traffic instead of implicit subnet trust. Chain, the supply chain security specialist, handles the vendor risk problem directly: SBOM generation and dependency scanning across the RTU, PLC, and relay firmware that the utility didn't write and often can't fully audit on its own.

Tonone's Forge audits legacy SCADA network segmentation, mapping VLANs, firewall rules, and vendor remote-access paths before a utility proposes any modernization work.

Reconnaissance across the OT network first

The forge-recon skill is where a utility engagement starts. Rather than accepting a network diagram at face value, which is often years out of date, Forge reads whatever network state is available, firewall configuration exports, DNS zone files, VPN gateway configs, cloud infrastructure-as-code if the utility has moved any historian or SCADA-adjacent workloads to cloud, and builds an accurate picture of what actually exists versus what the last audit claimed exists. For a utility with substations that were connected piecemeal over a decade, this step alone routinely surfaces segments that nobody currently on staff knew were there, a flat /24 linking two substations because a contractor needed remote access in 2018 and the exception was never closed.

The segmentation audit itself

forge-audit is the skill that produces the finding a grant reviewer or compliance officer actually needs: a structured assessment of where network segmentation holds and where it doesn't, mapped against the Purdue model zones the utility is supposed to be maintaining. It flags flat subnets spanning control zones that should be isolated, firewall rules that are far broader than the documented policy claims, and remote-access paths that bypass the segmentation entirely, the vendor VPN tunnel that goes straight from a maintenance contractor's laptop to a relay's management interface with no jump host in between. The output is not a generic checklist. It is specific to the utility's actual network, with each finding tied to the rule, the subnet, or the config line that produces it, so remediation work can be scoped and sequenced against a real deadline instead of a hypothetical one.

Tonone's forge-audit skill maps segmentation failures to the specific firewall rule or subnet that produces them, turning a compliance narrative into a remediation punch list.

Diagnosing network problems, not just cataloguing them

Legacy SCADA networks fail in ways that are hard to reproduce and harder to explain to a grant committee: intermittent HMI disconnects, a historian that drops writes during peak load, latency spikes on a relay's polling interval that only show up under specific network conditions. forge-diagnose is built to trace these failures back to root cause, whether that is a misconfigured QoS policy competing with a new segmentation rule, a DNS resolution path crossing a boundary it shouldn't, or a firewall rule introduced during a prior audit that quietly broke a legitimate polling path. For a utility mid-modernization, this matters because segmentation changes themselves can introduce the exact class of intermittent failure that erodes confidence in the whole project. Diagnosing it fast, and tying it to a specific config change, keeps the modernization timeline intact.

Vendor risk across the physical supply chain

A utility's attack surface is not just its own network, it is every vendor's firmware running on every relay, meter, and RTU in the field. Chain's chain-sbom and chain-scan skills generate a software bill of materials for the firmware images a utility can extract or obtain from vendors, and scan the dependency chain for known vulnerabilities, unmaintained libraries, and license issues that create both security and compliance exposure. This is the piece a SCADA segmentation audit alone cannot cover: segmentation limits blast radius if a device is compromised, but it does not tell you which of your three hundred field devices is running firmware with a known CVE that the vendor stopped patching two product generations ago. Chain and Forge working together give a utility both halves of the picture, the network boundary and the vendor risk sitting inside it.

A worked example: the grant deadline audit

Say a mid-size utility has a federal grid modernization grant with a compliance review in ten weeks. The grant requires a documented segmentation posture and a remediation plan for any gaps found, submitted before disbursement. The utility's last formal network audit was four years old and covers a network that has since absorbed two substation acquisitions, neither of which was fully integrated into the segmentation policy. Nobody currently on the infrastructure team was there when the original Purdue-model zoning was designed.

Forge starts with forge-recon across the available firewall exports, VPN configs, and the two acquired substations' network documentation, most of it incomplete. The recon pass surfaces 14 VLANs where the original design called for 9, three vendor remote-access tunnels with no corresponding firewall rule restricting them to specific hosts, and one acquired substation still running on a flat /16 with no internal segmentation at all. forge-audit then maps each finding against the Purdue zone it should belong to and produces a severity-ranked list:

Forge, SCADA Segmentation Audit, [Utility] Grid Modernization Grant
Scope: 3 substations (2 acquired, 1 legacy), historian + HMI network, vendor remote access

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CRITICAL, Acquired Substation B
  Flat /16, no internal VLAN segmentation. HMI, relay management,
  and corporate guest Wi-Fi share one broadcast domain.
  Remediation: VLAN split into 4 zones matching Purdue levels 0-3.
  Est. effort: ~3 weeks, requires on-site network hardware changes.

HIGH, Vendor remote access (3 tunnels)
  No host-level restriction. Contractor VPN reaches relay
  management interfaces directly, no jump host.
  Remediation: Route through bastion, restrict to named host list,
  add session logging. Est. effort: ~1 week, config only.

MEDIUM, Historian-to-corporate DNS path
  Historian resolves against corporate DNS across zone boundary,
  should resolve locally within OT zone.
  Remediation: Internal DNS zone for OT segment.
  Est. effort: ~3 days.

LOW, Firmware attestation gap (Chain cross-reference)
  41 of 190 field devices have no current firmware attestation
  on file. Chain scan flags 6 with known CVEs, unpatched.
  Remediation: Vendor attestation request + prioritized patch
  cycle for the 6 flagged devices.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Recommendation: Sequence CRITICAL and HIGH before the compliance
review date. MEDIUM and LOW can follow in the next maintenance window.
Next: Forge hands remediation spec to network team, Chain tracks
firmware patch cycle for flagged devices.

Ten weeks is enough time to close the critical and high findings, which is what the grant review actually checks for. Without this audit, the utility's compliance narrative would have been a description of the original four-year-old design, not the network that exists today, the exact gap that fails a grant review when a reviewer asks for current-state evidence rather than a policy document.

Tonone's Chain agent generates SBOMs and scans dependency chains for the field device firmware a utility didn't write, closing the vendor-risk half of a grid modernization audit.

Install and try

Tonone is free and MIT-licensed. Install it once and Forge, Mesh, Chain, and the rest of Tonone's agents are available inside your Claude Code session. You pay only for the Claude Code token usage during the audit itself.