Toward Mission-Centric Cyber-Physical Defense: Coordinated, Explainable, and Human-in-the-Loop Strategies for Power CPS

1. Introduction

1.1. Background: Cyber-Physical Integration in Modern Power Systems

The rapid digitalization of modern power systems has led to the emergence of Power Cyber-Physical Systems (Power CPS), which tightly integrate physical electrical infrastructure with digital computing, communication, and control technologies [1,2,3]. This integration has transformed the way power systems are monitored, controlled, and optimized, enabling new capabilities such as real-time state estimation, distributed energy resource (DER) integration, wide-area monitoring, and autonomous control [4,5]. Advanced components such as Phasor Measurement Units (PMUs), Supervisory Control and Data Acquisition (SCADA) systems, smart meters, Internet of Things (IoT) devices, and Artificial Intelligence (AI)-driven analytics now play central roles in ensuring reliable and efficient grid operations [6,7,8,9].

However, this convergence of cyber and physical domains has also introduced new cyber vulnerabilities that traditional power system security practices were not designed to address [10]. Cyber attackers can exploit communication channels, software vulnerabilities, and human factors to compromise system integrity, confidentiality, and availability. Among the most well-documented and studied cyber threats in the Power CPS domain are False Data Injection Attacks (FDIAs), which target the state estimation process by stealthily manipulating measurement data while evading traditional bad data detection mechanisms [11,12,13].

While FDIAs have received significant attention in the literature over the past decade, real-world cyber-physical incidents such as the 2015 and 2016 Ukraine power grid attacks, the Stuxnet attack on industrial control systems, and the Colonial Pipeline ransomware incident have demonstrated that attackers increasingly employ coordinated, multi-stage strategies that go beyond simple data manipulation [14]. These attacks exploit cross-layer and cross-domain dependencies between cyber, physical, market, and human elements, often leveraging advanced persistent threats (APTs), supply chain compromises, and social engineering techniques to achieve their objectives [15].

1.2. Limitations of Detection-Only Paradigms and FDIA-Focused Reviews

Despite growing awareness of these evolving threat landscapes, much of the current research remains narrowly focused on detection-centric paradigms, particularly on FDIAs [16,17,18,19]. While detecting FDIAs is undoubtedly important, an overemphasis on detection alone presents several limitations:

• Narrow Threat Coverage: Detection methods often target specific attack models, such as linear FDIA formulations, without addressing broader multi-vector and coordinated threats that exploit multiple system layers.
• Post-Compromise Detection: Most detection mechanisms operate after the attacker has already penetrated the system, which limits their ability to prevent initial compromise or mitigate cascading effects in real time [20,21].
• Lack of Coordinated Response: Detection alone does not guarantee effective response or recovery. Without coordinated defense mechanisms that involve both automated systems and human operators, detected attacks may still cause significant operational disruptions [22].
• Neglect of Human Factors: Many detection algorithms assume fully automated operation and overlook the critical role of human operators in interpreting, validating, and responding to security alerts [23,24,25].
• Insufficient Integration with Operational Objectives: Detection methods rarely account for the broader mission objectives of power system operators, such as maintaining service reliability, economic efficiency, and regulatory compliance under attack conditions [26].

Existing review articles tend to reinforce these limitations by narrowly framing the cybersecurity challenge as a detection problem, often focusing on comparing machine learning (ML) algorithms or proposing incremental improvements to residual-based detection methods [27,28,29]. This perspective fails to address the need for mission-centric, coordinated, and human-in-the-loop defense strategies that can proactively safeguard power systems against a wide range of cyber-physical threats.

1.3. Why Mission-Centric, Coordinated, and Human-in-the-Loop Defense Matters

Power systems are mission-critical infrastructures, where the primary mission is to ensure the continuous, reliable, and secure delivery of electrical energy to consumers [1,30]. Cybersecurity measures must therefore be aligned with this mission, prioritizing operational continuity and resilience over purely technical metrics such as detection accuracy or computational efficiency [31,32].

A mission-centric defense perspective recognizes that:

• The ultimate goal of cyber defense is not merely to detect attacks but to maintain the safe and reliable operation of the power grid, even in the presence of ongoing cyber-physical disruptions [2].
• Defense strategies must be coordinated across cyber, physical, market, and human layers, leveraging distributed intelligence and multi-agent cooperation to detect, respond to, and recover from attacks in real time [33,34,35].
• Human operators play an indispensable role in interpreting complex situations, making informed decisions, and executing response actions that automated systems alone may not be capable of handling. Therefore, human-in-the-loop defense mechanisms that provide situational awareness, explainable AI support, and cognitive load management are essential for effective cyber-physical security [36].

By shifting from a narrow detection focus to a holistic defense paradigm that integrates coordinated automation with human judgment, power system operators can better prepare for, withstand, and recover from the increasingly sophisticated cyber-physical threats facing modern energy infrastructures.

1.4. Contributions of This Review

This review offers a comprehensive and forward-looking synthesis of mission-centric, coordinated, and human-in-the-loop defense strategies for securing Power CPS. Building upon recent advances in cyber-physical resilience, explainable artificial intelligence (XAI), human-machine collaboration, and distributed defense architectures, the key contributions of this review are summarized as follows:

• Holistic Characterization of Evolving Cyber-Physical Threats:This review broadens the traditional FDIA-focused perspective by systematically analyzing multi-stage, AI-enhanced, and cross-layer coordinated attacks, including adversarial exploitation of human factors. It highlights the need to move beyond isolated detection toward integrated defense strategies that address threats across the cyber, physical, market, and human layers.
• Architectural and Mechanistic Foundations for Coordinated and Explainable Defense: The review proposes mission-centric architectural design principles, incorporating redundancy, diversity, modularity, and cross-layer trust mechanisms to enhance system resilience. It further synthesizes state-of-the-art multi-agent coordination, edge-cloud collaboration, and explainable AI techniques, providing actionable pathways for achieving distributed and operator-trustworthy defense mechanisms.
• Integration of Human-in-the-Loop and Post-Attack Recovery Strategies: Recognizing the critical role of human operators in complex grid operations, this review emphasizes situational awareness enhancement, cognitive engineering, and human-machine teaming. It also addresses post-attack recovery, including data reconstruction, operational reconfiguration, and the integration of resilience metrics to sustain mission assurance even under cyber-physical disruptions.
• Research Roadmap and Cross-Sector Collaboration Agenda:Finally, the review identifies key research gaps, standardization needs, and policy challenges, proposing a collaborative roadmap that unites academia, industry, and regulatory bodies to operationalize scalable, trustworthy, and human-aware cyber-physical defense for future energy systems.

1.5. Structure of This Review

The remainder of this review is structured as follows. Section 2 explores the evolution of cyber-physical threats, emphasizing their growing complexity and coordination. Section 3 introduces architectural foundations for mission-centric defense, while Section 4 presents real-time strategies enabled by explainable and distributed mechanisms. Section 5 turns to human-in-the-loop defense, underscoring the role of operators. Section 6 focuses on post-attack recovery and mission assurance. Section 7 outlines future research directions and collaboration needs, and Section 8 concludes with key insights and a call to action.

2. Evolution of Cyber-Physical Threats in Power CPS

The cybersecurity landscape for Power CPS has rapidly evolved over the past decade [37,38,39]. While early research largely centered on single-vector threats such as FDIAs, real-world incidents and emerging studies have revealed a far more complex, coordinated, and dynamic adversarial environment [40,41]. This section analyzes this evolving landscape across several dimensions: from isolated data manipulation to coordinated, multi-agent campaigns; from static threat models to AI-enhanced adversarial strategies; and from purely technical attacks to sophisticated exploitation of human and organizational vulnerabilities.

2.1. From Isolated FDIAs to Coordinated Multi-Stage, Multi-Agent Attacks

FDIAs demonstrated that attackers could inject mathematically crafted data into the state estimation process without triggering traditional bad data detection mechanisms [42,43]. These attacks leveraged the inherent linearity of state estimation algorithms to introduce undetectable biases, misleading system operators into making incorrect operational decisions. While this foundational work sparked significant research interest, it represented only the initial stage in the evolution of cyber-physical threats [44,45,46].

2.1.1. Limitations of Early FDIA Models

Early FDIA models typically made several idealized assumptions [47,48], such as:

• The attacker having full knowledge of the system’s topology and parameters.
• The attacker having unrestricted access to all measurement channels.
• The attack targeting a single objective, such as load redistribution or topology masking.

However, real-world attackers operate under constraints such as partial information, limited access, and noisy communication channels [49,50,51]. These limitations have driven adversaries to develop multi-stage attack strategies that combine reconnaissance, lateral movement, privilege escalation, and coordinated manipulation of cyber and physical assets.

2.1.2. Examples of Multi-Stage, Coordinated Attacks

Real-world incidents such as the 2015 Ukraine power grid attack exemplify this evolution. The attackers:

• Conducted long-term reconnaissance using phishing and malware (BlackEnergy).
• Compromised operator credentials to gain remote access to Supervisory Control and Data Acquisition (SCADA) systems [52].
• Simultaneously manipulated circuit breakers in multiple substations.
• Deployed disk-wiping malware (KillDisk) to hinder recovery efforts.

Similarly, the Stuxnet worm, though not targeting power systems directly, illustrated how malware could manipulate industrial control processes while masking its presence, operating as a multi-agent, multi-vector threat.

These examples underscore the shift from isolated technical exploits to coordinated campaigns involving multiple attack vectors, objectives, and system layers [53,54,55].

2.2. AI-Enhanced Adversarial Attacks and Model Poisoning Risks

As defenders increasingly adopt machine learning (ML) and artificial intelligence (AI) for anomaly detection, attackers have begun leveraging AI to design adaptive and evasive attack strategies [56,57,58,59,60].

Adversarial Machine Learning Threats

Adversarial ML allows attackers to:

• Craft adversarial examples that exploit blind spots in ML-based detection models.
• Train surrogate models to simulate the defender’s detection system.
• Optimize attack strategies using reinforcement learning or evolutionary algorithms to maximize stealth and impact [61].

For example, an attacker could simulate various FDIA patterns offline, selecting those that evade a target's detection model before launching them in a real system.

Federated Learning Poisoning

Federated Learning (FL) has been proposed to enable privacy-preserving, distributed anomaly detection across substations, microgrids, and DERs [62,63,64,65]. However, FL introduces new attack surfaces, such as:

• Model Poisoning: Malicious participants submit manipulated model updates to degrade detection performance [66,67].
• Backdoor Attacks: Attackers embed hidden triggers that activate malicious behavior under specific conditions [68].
• Sybil Attacks: A single attacker mimics multiple legitimate participants to overwhelm model aggregation [69].

Mitigating these risks requires robust aggregation algorithms, participant authentication, and anomaly detection at the model update level.

2.3. Human Factor Exploitation and Social Engineering

While much of the literature focuses on technical exploits, human factors represent a significant and often overlooked vulnerability in Power CPS security [70,71,72].

Social Engineering and Phishing: Human operators, engineers, and administrators are frequent targets of social engineering attacks, including:

• Phishing Emails: Trick users into revealing credentials or downloading malware.
• Impersonation: Exploit trust relationships to gain unauthorized access.
• Physical Intrusion: Manipulate on-site personnel to bypass security controls.

The Ukraine 2015 attack, for instance, began with phishing emails that tricked operators into installing malware, demonstrating the critical role of human vulnerabilities in real-world cyber-physical attacks [73,74,75].

Cognitive Overload and Alert Fatigue: Even when detection systems function correctly, human operators may:

• Misinterpret or ignore alerts due to excessive false positives.
• Delay response due to uncertainty or lack of actionable insights.
• Overlook coordinated attacks that span cyber, physical, and market layers.

Thus, human-in-the-loop defense strategies must address situational awareness, cognitive load management, and operator training to ensure effective response [76,77,78].

2.4. Cross-Layer Propagation Across ICT, OT, and Market Operations

Power CPS do not operate in isolation. They depend on:

• Information and Communication Technology (ICT) networks, such as public and private telecommunication infrastructures [79].
• Operational Technology (OT) systems, including SCADA, Energy Management System (EMS), and DER management platforms [80,81,82].
• Energy markets, where economic signals influence operational decisions.

Cross-Layer Attack Scenarios: Adversaries increasingly exploit interdependencies between these layers [83,84,85]. For example:

• Telecom Outages: Disrupt operator situational awareness during grid emergencies.
• Market Manipulation: Inject false data to trigger price spikes or imbalance penalties [86].
• Supply Chain Attacks: Compromise third-party software or hardware to gain persistent access [87,88].

These cross-layer threats require integrated situational awareness that bridges cyber, physical, and market domains.

2.5. Summary of Emerging Threat Characteristics and Gaps

The emerging threat characteristics and gaps are summarized in Table 1.

In summary, the cyber threat landscape for Power CPS has evolved beyond isolated technical exploits, demanding coordinated, mission-aware, and human-centered defense strategies [89,90]. The next section will propose architectural foundations for building such defenses.

3. Design Foundations of Mission-Centric Cyber-Physical Defense

In light of the evolving threat landscape outlined in Section 2, defending Power CPS requires more than isolated detection algorithms or ad-hoc countermeasures. It calls for a systematic, architectural shift toward mission-centric defense, where cybersecurity is embedded into the design, operation, and governance of power systems [91,92,93]. This section presents the foundational design principles necessary to achieve such defense, emphasizing cross-layer architecture, redundancy and diversity, secure sensing and communication, and resilience-enabling modularity.

3.1. Defining Mission-Centric Resilience: Beyond Asset Protection

Traditional security strategies often focus on protecting specific system assets, such as SCADA servers, PMUs, or communication links [94,95,96]. While important, this asset-centric view falls short of addressing the mission assurance objective of Power CPS—ensuring safe, reliable, and continuous electricity delivery even under attack [97].

Mission-Centric Defense Principles

• Mission First: Prioritize maintaining core grid operations (e.g., frequency stability, voltage regulation, black start capabilities) over perfect asset security.
• Graceful Degradation: Design systems to continue operating in a degraded but safe state if parts of the system are compromised.
• Resilience over Robustness: Enable the system to adapt and recover from attacks, rather than merely resisting them through static barriers.

This mission-centric perspective requires rethinking system architecture to support cross-layer defense, where cyber, physical, market, and human elements collaboratively safeguard operational objectives [98,99,100].

3.2. Cross-Layer Defense Architecture: Cyber, Physical, Market, Human

A mission-centric defense architecture must span cyber, physical, market, and human layers to comprehensively address the multi-faceted attack surface of Power Cyber-Physical Systems [101,102]. These layers are interdependent, and effective defense requires coordinated mechanisms across all of them [103].

At the cyber layer, defense efforts focus on protecting the digital backbone of the grid. This includes securing communication protocols such as IEC 61850 and DNP3, which are widely used for substation automation and real-time grid control. It also involves hardening SCADA and EMS platforms that manage grid-wide operations [104,105,106]. Additionally, safeguarding data storage systems and computational resources, whether centralized in control centers or distributed at the grid edge, is critical to preventing data tampering, service disruption, and computational hijacking attacks [107,108,109,110]. The physical layer encompasses the tangible assets and sensing infrastructure that constitute the operational core of the power system. This includes generation units, transmission lines, and distribution networks, as well as DERs, microgrids, and energy storage systems that enable renewable integration and local flexibility [111,112,113]. Critical to physical layer security are the sensing and actuation devices, such as PMUs and Remote Terminal Units (RTUs), which provide real-time measurements and control signals essential for situational awareness and operational stability [114,115].

Moving to the market layer, cyber-physical defense must also account for economic and market-based mechanisms that influence system behavior. This includes securing energy pricing and bidding platforms, ensuring the integrity of ancillary service markets such as frequency regulation and voltage support, and safeguarding demand response programs that rely on prosumer participation [116,117,118]. Manipulation of market signals or exploitation of bidding mechanisms can have cascading impacts on grid reliability and economic fairness, making market-layer security a critical but often overlooked dimension of power system defense [119].

Finally, the human layer addresses the role of system operators, field technicians, market participants, policy makers, and cybersecurity analysts in maintaining grid resilience [120,121]. These human actors are responsible for interpreting data, making real-time decisions, and implementing defense strategies. However, they are also potential targets for social engineering, cognitive overload, and insider threats. Empowering human operators with situational awareness tools, cognitive support systems, and decision-making frameworks is essential to ensuring that technological defenses are effectively managed and adapted in practice [122,123,124].

In summary, defending Power CPS requires cross-layer coordination mechanisms that promote information sharing, trust management, and joint decision-making across these cyber, physical, market, and human layers, moving beyond isolated or siloed defense strategies toward a holistic and mission-centric security architecture [125].

3.3. Redundancy, Diversity, and Modularity for Systemic Resilience

Redundancy: Eliminating Single Points of Failure

• Sensing Redundancy: Deploy multiple, independent measurement sources (e.g., PMUs, smart meters) to cross-validate data.
• Communication Redundancy: Utilize diverse communication channels (e.g., fiber, LTE/5G, satellite) to maintain data flow during disruptions.
• Control Logic Redundancy: Implement fallback control strategies on edge devices to maintain safe operation if centralized control is compromised [126].

Diversity: Breaking Homogeneity to Increase Attack Complexity

• Vendor Diversity: Avoid reliance on single suppliers for critical hardware or software.
• Software and Firmware Diversity: Deploy varying versions or configurations to prevent system-wide exploitation of a single vulnerability.
• Protocol Diversity: Support multiple communication standards with isolation mechanisms to contain protocol-specific attacks [127,128].

Modularity: Isolating Risks through Segmentation

• Microgrids and Virtual Power Plants (VPPs): Enable localized operation independent of central control [129,130].
• Regional Control Zones: Partition the grid into semi-autonomous areas with localized situational awareness and response capabilities.
• Network Segmentation: Enforce strict separation between critical operational networks and corporate IT environments [131].

These architectural elements collectively support systemic resilience, allowing the grid to contain, absorb, and recover from cyber-physical attacks without catastrophic performance loss.

3.4. Secure Sensing and Communication: From Cryptography to Trustworthy Learning

Secure-by-Protocol Approaches

• Cryptographic Techniques: Use Message Authentication Codes (MACs), digital signatures, and end-to-end encryption to protect data integrity and confidentiality.
• Standards Compliance: Implement protocols such as IEC 62351 to secure power system communications [132].

However, protocol-level security alone is insufficient, especially when attackers exploit insider threats or compromised trusted nodes [133,134,135].

Secure-by-Learning Approaches

• Physics-Informed Learning: Validate data consistency with physical laws (e.g., Kirchhoff’s laws) to detect manipulation [136].
• Behavioral Baselines: Use machine learning to establish normal operational profiles and flag deviations.
• Cross-Domain Anomaly Detection: Correlate cyber, physical, and market data streams to detect coordinated attacks [137].

Challenges and Research Gaps

• Model Explainability: Ensuring that AI-driven detection models provide interpretable results for operator validation.
• Adversarial Robustness: Hardening learning-based models against adversarial manipulation and model poisoning.
• Computational Feasibility: Deploying real-time learning and detection capabilities on edge devices with limited resources.

By combining cryptographic assurance with data-driven trust validation, Power CPS can achieve layered security that adapts to evolving threat landscapes [138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170].

In summary, mission-centric cyber-physical defense requires a coordinated architectural foundation that integrates cross-layer awareness, systemic resilience through redundancy and diversity, and trustworthy sensing and communication mechanisms. The next section will build on this foundation by presenting coordinated, explainable, and human-in-the-loop defense mechanisms designed for real-time cyber [171,172,173].

4. Coordinated and Explainable Defense Mechanisms

While architectural design sets the foundation for mission-centric cyber-physical defense, effective protection requires dynamic, real-time defense mechanisms capable of detecting, interpreting, and mitigating threats as they unfold [174]. These mechanisms must operate coherently across distributed assets, provide explainable insights to human operators, and support coordinated response actions that minimize operational impact [175]. This section presents the emerging defense paradigms of multi-agent coordination, edge-cloud collaboration, and XAI, alongside the critical role of attack attribution and accountability in response management.

4.1. Multi-Agent and Distributed Defense Architectures

4.1.1. Limitations of Centralized Defense

Traditional centralized Security Operations Centers (SOCs), while widely deployed in critical infrastructure sectors, face notable limitations when applied to large-scale and distributed Power CPS environments [176]. High latency often arises when attempting to detect and respond to geographically dispersed threats, reducing the ability to react in real time. Moreover, centralized architectures inherently create single points of failure—attractive targets for adversaries seeking to paralyze grid-wide defense capabilities. As power systems scale in size and complexity, centralized solutions also suffer from limited scalability, making it increasingly difficult to maintain visibility and control across heterogeneous assets such as substations, microgrids, and DERs [177].

4.1.2. Advantages of Multi-Agent Defense Systems

To overcome these limitations, multi-agent defense architectures distribute cybersecurity functions across the hierarchical layers of Power CPS [178]. Local agents deployed in substations and microgrids are empowered to perform real-time anomaly detection and execute autonomous control adjustments. At a higher level, DER aggregators and VPPs can monitor distributed prosumer activities and detect irregularities in market interactions. Transmission control centers serve as coordinating hubs, maintaining wide-area situational awareness and facilitating inter-agent communication [179,180]. These agents operate collaboratively, sharing threat intelligence in near real-time, cross-validating anomaly detections, and coordinating localized response actions. Such distributed architectures not only enhance detection coverage but also relieve central operators from information overload, enabling more agile and resilient defense operations [181].

4.1.3. Key Design Considerations

Designing effective multi-agent defense systems requires careful consideration of autonomy versus coordination. While local agents must make timely, context-aware decisions, they must also contribute to global situational awareness to prevent fragmented or conflicting actions [182]. Communication overhead presents another challenge; efficient protocols must be designed to ensure that bandwidth usage is minimized without compromising information freshness and completeness. Finally, securing inter-agent communication is paramount. Defense frameworks must protect against spoofing, message tampering, and agent compromise, ensuring that the distributed defense network itself does not become a new attack vector [183].

4.2. Edge and Cloud-Based Real-Time Defense Coordination

4.2.1. Role of Edge Computing

Edge computing plays a critical role in enabling real-time cyber-physical defense by moving data processing and security analytics closer to the operational assets of the power system [184]. By deploying Intelligent Electronic Devices (IEDs), local controllers, and other edge computing nodes directly within substations, microgrids, and DER sites, organizations can significantly reduce communication latency, bandwidth consumption, and dependency on centralized infrastructure [185]. These edge nodes are capable of executing lightweight anomaly detection algorithms, applying immediate fallback control actions to contain threats locally, and maintaining secure local logs for post-incident forensic analysis. Such capabilities ensure that even in the face of network congestion or partial isolation, critical defense functions remain active at the grid edge [186].

4.2.2. Role of Cloud Computing

While edge computing offers speed and locality, cloud-based platforms provide the scalability and computational power necessary for large-scale data aggregation, long-term analytics, and global situational awareness [187]. The cloud enables cross-agent coordination by synthesizing insights from distributed edge nodes and facilitating global model updates that improve system-wide defense performance over time. Moreover, the cloud serves as the ideal environment for training advanced AI models using historical and large-scale datasets, enabling the continuous improvement of detection algorithms that can later be deployed to the edge for real-time execution [188].

4.2.3. Hybrid Edge-Cloud Defense Framework

Recognizing the complementary strengths of edge and cloud computing, a hybrid edge-cloud defense architecture integrates both layers to achieve distributed yet coordinated cybersecurity operations. In this framework, edge nodes handle low-latency detection and localized response, ensuring immediate containment of threats, while cloud platforms maintain broader situational awareness, perform model refinement, and provide strategic decision support to human operators and automated agents. This architecture enhances the resilience of the defense system by ensuring that even if cloud connectivity is temporarily degraded or lost, critical edge-based defense mechanisms continue to operate autonomously, maintaining grid security without interruption [189,190].

4.3. Explainable AI for Operator-Trustworthy Defense Decision Support

4.3.1. Challenges of Black-Box AI Models

While AI and machine learning have shown great promise in automating threat detection and response, black-box models—such as deep neural networks—pose significant challenges for deployment in critical infrastructure like Power CPS. These models often lack interpretability, making it difficult for human operators to trust or understand the rationale behind AI-driven alerts or recommendations. In high-stakes operational environments, such lack of transparency can lead to operator hesitation, over-reliance on automation, or even the rejection of valid defense actions, ultimately undermining the effectiveness of AI-assisted cyber-physical defense systems [191].

4.3.2. Role of Explainable AI in Enhancing Operator Trust

XAI addresses this challenge by providing transparent, human-understandable explanations for AI-generated outputs. By offering insights into which features influenced a detection result, how anomalies are characterized, or why certain mitigation actions are recommended, XAI empowers operators to validate AI decisions and maintain human oversight. This transparency not only increases operator trust in automated systems but also supports collaborative human-machine decision-making, ensuring that AI augments rather than replaces expert judgment [192].

4.3.3. Human-AI Interaction in Defense Operations

Effective integration of XAI into cyber-physical defense workflows requires aligning explanation granularity with operator cognitive load and situational urgency. Visual analytics dashboards, ranked feature importance lists, and counterfactual reasoning tools are among the techniques that can be used to present explanations in actionable formats. Furthermore, XAI should be tightly coupled with real-time situational awareness systems, allowing operators to interactively explore AI recommendations and make informed, context-aware decisions. By bridging the gap between AI autonomy and human accountability, XAI plays a critical role in achieving operator-trustworthy and mission-centric cyber-physical defense [193].

4.4. Attack Attribution and Accountability in Distributed Defense

4.4.1. Importance of Attack Attribution for Coordinated Response

In distributed Power CPS environments, accurate and timely attack attribution is essential for coordinating defense actions across organizational and jurisdictional boundaries. Without reliable attribution, defense teams risk responding to false positives, misidentifying the source of an attack, or failing to coordinate properly across affected entities. Effective attribution not only improves the precision of mitigation actions but also supports post-incident forensics, legal accountability, and cross-sector information sharing. In multi-stakeholder environments involving utilities, market operators, and DER aggregators, establishing a shared understanding of the threat landscape through trusted attribution mechanisms is a cornerstone of mission-centric defense [194].

4.4.2. Methods for Attribution in Power CPS Environments

Attribution in Power CPS can leverage a combination of technical, behavioral, and contextual analysis. Technical methods include network forensics, log correlation, and traffic fingerprinting to trace attack vectors and identify responsible entities. Behavioral analysis leverages machine learning models to recognize attacker tactics, techniques, and procedures (TTPs) based on historical patterns [195]. Contextual analysis incorporates environmental factors, such as known vulnerabilities or recent threat intelligence reports, to strengthen attribution confidence. Together, these methods enable multi-source, evidence-based attribution that supports both real-time response and strategic post-event analysis.

4.4.3. Accountability and Legal Considerations in Multi-Stakeholder Defense

Attribution is only effective if it leads to accountable actions. In distributed power systems, legal and regulatory frameworks must define responsibilities, liabilities, and escalation procedures for responding to cyber-physical incidents. This includes establishing evidence standards for cross-organizational attribution, data sharing agreements, and collaborative incident response protocols. Transparent accountability mechanisms ensure that all stakeholders—whether utilities, third-party service providers, or regulatory authorities—are held responsible for their security roles while empowering coordinated and legally compliant defense actions. Building this accountability framework is critical for sustaining trust and collaboration in large-scale, distributed defense ecosystems.

5. Human-in-the-Loop and Operator-Centered Defense Strategies

While automation and AI are essential for improving cyber-physical defense scalability and speed, human operators remain irreplaceable in mission-critical decisions. Human judgment provides the contextual reasoning, operational experience, and adaptive flexibility that fully automated systems often lack. However, humans are also prone to cognitive overload, alert fatigue, and misinterpretation when overwhelmed by poor system design or excessive information. This section presents how Human-in-the-Loop (HITL) strategies bridge these gaps by integrating human expertise with machine intelligence to achieve coordinated, explainable, and trustworthy cyber-physical defense [196].

5.1. Human-Machine Teaming in Cyber-Physical Defense Operations

While fully automated defense systems excel at rapid data processing and rule-based threat detection, they frequently struggle with ambiguity, unforeseen scenarios, and contextual understanding. Such systems may incorrectly classify benign behaviors as attacks, for example, flagging a False Data Injection Attack (FDIA) where none exists. This could trigger unnecessary actions such as grid reconfiguration, inadvertently reducing system stability if human validation is bypassed [197].

To address these limitations, effective human-machine teaming must be designed around four core principles. Complementarity ensures that machines handle large-scale data analytics while humans provide contextual interpretation. Transparency allows AI systems to explain their reasoning to build operator trust. Controllability ensures that human operators retain override authority, preventing over-reliance on automation. Finally, collaboration fosters joint human-machine decision-making, moving beyond passive alerting toward active engagement. These principles enable synergistic defense operations, maximizing the strengths of both human and machine actors.

5.2. Situational Awareness and Cognitive Load Management

Situational awareness is the operator’s ability to perceive, comprehend, and anticipate the system’s state under both normal and attack conditions. It is frequently compromised by information overload, alert fatigue, and fragmented system views. Unfiltered data streams and repetitive false alarms can desensitize operators, reducing their ability to detect genuine threats. Similarly, fragmented dashboards that fail to integrate cyber, physical, and market data can obscure the full operational context [198].

To mitigate these challenges, systems must incorporate cognitive load management techniques. This includes providing prioritized alerts ranked by mission impact, contextual dashboards that unify multi-domain data, and progressive disclosure that allows operators to drill down into details only when necessary. Adaptive interfaces can further optimize information presentation based on operator workload and task criticality. Together, these features help maintain clear situational understanding without overwhelming the operator, ensuring effective real-time decision-making.

5.3. Operator Training, Decision Support Tools, and Incident Response Readiness

Operator competence is built through continuous training and the availability of decision support tools. Cyber-physical training simulators and tabletop exercises provide realistic environments for operators to practice responding to complex, coordinated attacks. Adversarial thinking workshops help operators develop an attacker’s mindset, improving their ability to recognize sophisticated threat patterns.

Advanced decision support tools such as what-if analysis engines, playbook recommendation systems, and collaborative platforms enable teams to evaluate and coordinate response strategies across geographic and organizational boundaries. Establishing incident response readiness requires clearly defined roles and responsibilities, pre-approved mitigation playbooks to accelerate action, and post-incident learning loops to capture lessons and continuously improve defense capabilities [199].

5.4. Integrating Human Factors into Security Engineering and Policy

Finally, embedding human factors engineering into defense tool design and organizational policy is essential. Explainable interfaces should present AI outputs in clear, operator-friendly formats, while feedback channels allow operators to report misleading system behavior, informing future model refinements. User-centered design methodologies involving operator input throughout the development lifecycle ensure that tools are not only functional but also usable and trusted in high-pressure environments.

From a policy perspective, fostering a cybersecurity-aware organizational culture, investing in workforce development that integrates cybersecurity and power engineering, and ensuring regulatory alignment with standards like NERC CIP and NIS2 are critical. These measures ensure that human factors are not treated as afterthoughts but as core components of cyber-physical security strategy.

In summary, Human-in-the-Loop defense strategies are not optional add-ons but foundational pillars of resilient and mission-centric Power CPS security. By empowering operators with situational awareness, explainable AI, decision support tools, and comprehensive training, power system organizations can fully leverage human expertise to confront and adapt to evolving cyber-physical threats.

6. Post-Attack Recovery and Mission Assurance

No defense mechanism can guarantee absolute protection against sophisticated cyber-physical attacks. Therefore, post-attack recovery and mission assurance have emerged as essential pillars of resilience-oriented security strategies for Power CPS. These capabilities enable grid operators to restore compromised functions, maintain critical services, and learn from incidents to strengthen future defense. This section explores methods for data reconstruction, adaptive control reconfiguration, integration of resilience metrics, and lessons learned from both real-world and simulated incidents.

6.1. Data Reconstruction, System Restoration, and Operational Continuity

A major challenge following a cyber-physical attack is the loss or corruption of critical system data. While intrusion detection systems may successfully flag compromised data, they rarely offer clear methods to restore trustworthy system states. Simply discarding all suspicious data risks blinding operators, compromising situational awareness and potentially leading to unsafe control actions.

To address this, several data reconstruction strategies are emerging. Model-based reconstruction leverages physical system models, such as power flow equations and robust optimization techniques, to estimate missing or corrupted values. Data-driven methods use historical and real-time data to train AI models capable of imputing missing measurements or correcting anomalies, including the use of physics-informed neural networks (PINNs) that combine data learning with physical constraints. Additionally, multi-source data fusion techniques cross-validate information from diverse sensors like PMUs, RTUs, and smart meters, improving data reliability. Finally, operator-guided validation ensures that reconstructed states are reviewed by human experts, especially in high-risk or ambiguous scenarios. These methods collectively support continuity of grid observability, enabling informed decision-making even when data integrity is partially compromised [200].

6.2. Adaptive Reconfiguration and Mission-Aware Control Strategies

Once a reliable system state is reconstructed, the next step is reconfiguring control strategies to contain the impact of the attack and maintain critical services. Adaptive reconfiguration involves isolating compromised components, redirecting power flows, and activating local control modes in microgrids or VPPs. Specific examples include enabling islanded microgrid operation to protect local loads by disconnecting affected regions from the bulk grid, prioritizing load shedding based on service criticality (e.g., keeping hospitals and data centers online), and re-optimizing market dispatch to account for degraded system visibility or compromised assets.

While automation can perform these reconfigurations rapidly, human oversight remains essential. Operators can use what-if simulators to preview potential outcomes, assess confidence scores to gauge reliability, and rely on explainable AI recommendations to support their decisions. This combination of automated execution and human validation ensures the system can deliver acceptable levels of service under degraded conditions while avoiding unintended consequences [201].

6.3. Integration of Resilience Metrics in Grid Operations and Market Mechanisms

Traditional cybersecurity metrics—such as the number of blocked attacks or alerts generated—provide little insight into the actual resilience of power systems. To close this gap, operators are increasingly adopting mission-oriented resilience metrics. These include service continuity (percentage of load served during and after an attack), time to recovery (duration required to restore functionality), quality of service (voltage and frequency stability), and economic impact (costs of service disruption and corrective actions).

Embedding these metrics into market operations can further align economic incentives with resilience objectives. For example, flexible resources such as DERs, energy storage, and demand response can be rewarded for providing services that enhance grid resilience during emergencies. Additionally, new resilience-based market products can be introduced, valuing capabilities like black start services, grid-forming inverters, and operational flexibility. This integration ensures that both technical and economic layers of the power system contribute to overall mission assurance [202].

6.4. Lessons from Real-World Incidents and Simulated Benchmarks

Real-world cyber-physical incidents provide valuable lessons that go beyond technical vulnerabilities. The 2015 Ukraine blackout highlighted the importance of operator training and multi-layered defense coordination. Stuxnet demonstrated the need for supply chain security and stealthy threat detection, while the Colonial Pipeline ransomware incident emphasized the risks of cross-sector interdependencies and the importance of coordinated response planning. These events underline that technical solutions alone are insufficient without organizational readiness and cross-sector collaboration.

Complementing these real-world insights, simulated testbeds and red team/blue team exercises provide controlled environments to evaluate detection, response, and recovery strategies. These activities stress-test defense mechanisms, identify operational gaps, and benchmark resilience metrics against standardized scenarios. By continuously engaging in empirical testing and validation, organizations can operationalize resilience and build adaptive defense postures based on real-world and simulated evidence [203].

In summary, post-attack recovery and mission assurance require a holistic approach that integrates data reconstruction, adaptive control, resilience metrics, and organizational learning. These capabilities ensure that Power CPS can sustain essential services, recover effectively, and continuously improve defense strategies in response to evolving threats.

7. Future Research and Cross-Sector Collaboration Directions

While this review has outlined a comprehensive vision for defending Power CPS, turning that vision into operational reality demands sustained research, standardization, and multi-stakeholder collaboration. This section highlights key open research questions, technology gaps, and collaborative pathways necessary to transition from conceptual frameworks to validated, deployable defense solutions.

7.1. Toward Cyber-Physical-Human Co-Resilience Modeling and Validation

Current research in Power CPS security remains fragmented, often addressing cyber and physical layers in isolation. Even when these layers are modeled together, they tend to overlook human behavior, organizational response dynamics, and interdependencies with other critical infrastructures like telecommunications and energy markets.

Future research must advance multi-layered resilience modeling frameworks that explicitly capture interactions across cyber, physical, market, and human layers. This includes integrating behavioral and cognitive models that represent operator decision-making processes, cognitive limitations, and team dynamics during attacks. Additionally, cross-infrastructure modeling should account for cascading failures spanning energy, communications, and market systems under coordinated cyber-physical assaults. Finally, the development and validation of mission-centric resilience metrics—such as service continuity, time to recovery, and economic impact—are essential to quantify a system’s ability to sustain critical operations under adverse conditions [204].

7.2. Bridging Policy, Regulation, and Operational Practices

Despite technological advancements, a persistent gap exists between research outputs and policy adoption. Regulatory frameworks often lag behind emerging technologies, leading to misalignment between compliance requirements and operational best practices. Additionally, operational procedures may fail to incorporate AI-driven or distributed defense mechanisms due to the lack of certification, regulatory recognition, or industry standards.

Bridging this gap requires regulatory co-design, involving researchers, operators, and regulators in the joint development of cybersecurity guidelines that balance technological feasibility with enforceable policies. Contributions to standards development bodies such as IEEE, IEC, and NERC CIP are also crucial to operationalize mission-centric defense principles. To translate policies into practice, organizations need toolkits and training programs that align regulatory requirements with operational workflows. Strengthening cross-sector information sharing mechanisms further ensures that cyber threat intelligence and lessons learned are shared across the energy sector and other critical infrastructures, enhancing collective resilience.

7.3. Building Open Testbeds and Benchmarks for Realistic Evaluation

Many defense solutions are evaluated in overly simplified environments, limiting their relevance to real-world Power CPS operations. The absence of benchmark datasets—due to security restrictions, proprietary limitations, or lack of standardization—further impedes objective comparison of defense mechanisms.

Addressing these limitations calls for the development of open cyber-physical testbeds that replicate realistic operational conditions, including human-in-the-loop simulations. Establishing standardized evaluation scenarios and benchmarks enables consistent comparison across different defense strategies. Additionally, privacy-preserving data sharing techniques, such as federated learning and synthetic data generation, are needed to securely share operational data without exposing sensitive information. Community-driven activities like capture-the-flag (CTF) competitions and red team/blue team exercises can further crowdsource innovative defense solutions, stress-test them under realistic threats, and drive continuous improvement through empirical validation [205].

7.4. Roadmap for Cross-Sector and International Collaboration

Power CPS are interdependent with sectors such as telecommunications, transportation, water systems, and financial markets. Effective defense requires cross-sector collaboration to address shared vulnerabilities and respond to coordinated multi-domain threats.

On an international scale, building global threat intelligence networks is critical to facilitate the sharing of attack signatures, tactics, techniques, and threat actor profiles. Launching multi-country research consortia can accelerate the development of cross-infrastructure resilience models and AI-based defense solutions. Harmonizing cybersecurity standards across regulatory jurisdictions will further ensure consistent protection levels globally. Finally, capacity building efforts—including training programs, technical exchanges, and policy dialogues—will help disseminate best practices and strengthen cyber defense capabilities worldwide.By building a globally coordinated ecosystem of researchers, operators, regulators, and policy makers, the energy sector can better address the complex, multi-domain challenges of securing Power CPS against evolving cyber-physical threats.

In summary, advancing the security and resilience of Power CPS requires cross-disciplinary research, regulatory alignment, realistic evaluation platforms, and international collaboration. By building a globally coordinated ecosystem of researchers, operators, regulators, and policymakers, the energy sector can transform mission-centric defense from a conceptual aspiration into an operational reality, safeguarding critical infrastructures against future cyber-physical threats.

8. Conclusions

The digitalization of power systems via Power CPS has enhanced grid operations but also exposed new vulnerabilities to sophisticated, multi-stage cyber-physical attacks, rendering traditional, isolated defense strategies inadequate for ensuring reliable and secure power delivery. This review advocates for a paradigm shift toward mission-centric, coordinated, and human-in-the-loop cyber-physical defense, covering the full security lifecycle from threat anticipation and detection to response, recovery, and mission assurance. The key insights and contributions are summarized as follows:

1) This review expands the understanding of power system security by moving beyond isolated False Data Injection Attacks (FDIAs) to address AI-enhanced, multi-agent, and cross-layer attack campaigns. These evolving threats exploit not only cyber and physical infrastructures, but also market dynamics and human factors, requiring holistic and multi-domain defense strategies.

2) It proposes cross-layer architectural principles that integrate redundancy, diversity, modularity, and trustworthy sensing and communication to enhance system resilience. Building on this foundation, the review synthesizes multi-agent coordination frameworks, edge-cloud collaborative defense models, and explainable AI techniques to enable real-time, distributed defense operations that balance automated intelligence with operator trust and oversight.

3) Recognizing the indispensable role of human operators, this review highlights the importance of situational awareness tools, cognitive load management, and interactive decision support systems. It further emphasizes post-attack recovery strategies, including data reconstruction, adaptive control reconfiguration, and the integration of resilience metrics into grid and market operations to ensure service continuity under degraded conditions.

4) Finally, the review identifies the need for cross-disciplinary research, regulatory and policy co-design, open testbeds, and international collaboration to bridge the gap between conceptual frameworks and operational deployment, paving the way for a scalable, trustworthy, and mission-aware cyber-physical defense ecosystem.

As cyber-physical threats escalate in scale and complexity, advancing power system security demands cross-sector collaboration among industry, academia, and government. This requires breaking down disciplinary silos, embedding resilience as a core design principle, strengthening workforce capabilities, and fostering national and international partnerships for knowledge and threat intelligence sharing. By embracing a mission-centric, coordinated, and human-aware defense paradigm, the energy sector can move beyond detection-centric limitations and secure the resilient, reliable, and digitalized energy systems of the future.