For years, utility leaders have treated cyber risk as a standing condition of the business. It sat on board agendas, in compliance binders, and in tabletop exercises. This week, it moved closer to the control room. On April 7, federal agencies warned that Iran-affiliated actors were actively exploiting internet-facing programmable logic controllers across U.S. critical infrastructure, including the energy sector. On April 8, NERC said it was actively monitoring the grid and had amplified the government advisory through the Electricity Information Sharing and Analysis Center. That matters because PLCs are not office software. They sit close to physical operations.