Over the past few years, utilities across the United States have faced a troubling trend: gunfire directed at electrical substations and other energy assets. Whether the intent is vandalism, sabotage, or reckless target practice, the results are the same. A single rifle round can destroy a million-dollar transformer that could take months to replace. This happens when the cooling fluid drains from the transformer. Once the fluid is lost, the unit quickly overheats and frequently ignites.

A recent DHS Homeland Threat Assessment concurs, stating, “We assess that domestic and foreign violent extremists will continue to call for physical attacks on critical infrastructure in furtherance of their ideological goals…”

One of the largest electric power and natural gas utilities in North America recognised this risk after a number of gunshot attacks on substations disrupted power to tens of thousands of customers. In one case, power was not restored for days, and a person dependent on life support equipment tragically lost their life.

Unique challenges

Before implementing a new solution, the utility needed to reassess how its security technologies worked together. Traditional security cameras were excellent for documenting clearly visible problems, but they could not reliably detect something as small as a bullet hole in a damaged transformer, leaving a critical awareness gap. The company’s challenge was not only detecting a gunshot but doing it fast enough to act before cascading failures occurred.

In many cases, gunfire at substations originates from hundreds of feet outside the fence line. The sound of the muzzle blast may never reach the site, leaving only the supersonic ballistic wave as evidence of incoming rounds. A system limited to triangulating muzzle blasts within a perimeter would miss these long-range threats entirely.

Integration with security cameras and VMS

Facing these unique requirements, the utility sought a technology that could provide instant notification with video and audio verification. This capability was essential to confirm whether an event was malicious or accidental. Integration with the utilities existing video management system (VMS) was a requirement, while direct control of a pan-tilt-zoom (PTZ) camera would allow operators to focus immediately on the source of the gunfire and determine if an actual threat existed.

According to Acoem, the utility needed immediate, accurate alerts to prevent catastrophic damage. Whether a threat is close-range or from a high-powered rifle fired from hundreds of feet away, they needed a modern, self-contained, highly accurate system to provide a full picture.

Cyber security was another defining requirement for this utility. The company prohibits internet connectivity within its operational network, a strict “air-gapped” policy that rules out any cloud-based system. For these secure environments, any new security technology must operate entirely on-premises, integrating directly with existing video and access control platforms.

Acoustic threat detection

To address the complex nature of the threats and meet these stringent demands, the utility required a specialised solution that avoided a full infrastructure overhaul. After extensive testing, the utility selected Acoem’s ATD (Acoustic Threat Detection) system. The company has now deployed numerous detection systems across multiple states and regions, with new installations continuing every week as part of an ongoing modernisation plan.

A principal reason behind choosing the Acoem ATD system was based on how the system works compared to legacy solutions. Instead of sending audio data from multiple sensors to a remote server, the Acoem sensor processes detection right on the device. When a gunshot occurs, it detects both the muzzle blast and the ballistic wave, confirming the event and calculating its location instantly.

Processing analytics on the edge is instant and gives operators the time they need to respond. That might mean rerouting power, isolating a substation, or taking a transformer offline before it fails. Having that situational awareness can make the difference between a quick repair and an extended regional outage.

Acoem developed an on-premises version of its Cadence software specifically to meet the utility’s cybersecurity requirements of restricted internet access. The platform displays live maps, sensor health, and provides audio verification clips that allow operators to hear what the sensor heard while viewing the shooter’s position overlaid on the map. Cadence integrates directly with the utility’s Avigilon video management system.

Digital and physical vigilance combined

Protecting critical infrastructure today means recognising that not every threat is digital. A single bullet can cause as much disruption as a cyber attack. The key is giving operators the real-time data they need to act quickly and decisively.

By combining edge-based AI, on-premises software, and open integration with existing security systems, Acoem’s ATD system has given the utility company the situational awareness it needed to protect its assets and its customers. The system keeps vital equipment online, strengthens compliance, and helps safeguard the communities that rely on uninterrupted service.