Electric utilities face a compounding threat: the same digital transformation that unlocks grid intelligence — SCADA systems, synchrophasor networks, DER integrations, substation automation — expands the attack surface exponentially. Traditional security models rely on credential databases and perimeter firewalls that attackers have learned to circumvent.

Meanwhile, cross-utility data sharing is effectively paralyzed. Utilities hold data that, in aggregate, would dramatically improve reliability and threat detection — but privacy regulations, competitive concerns, and lack of secure infrastructure prevent collaboration. The result: every utility defends alone, and threat actors exploit the seams.

Legacy zero-trust architectures (Tailscale, Okta, VPN overlays) reduce but do not eliminate the attack surface. A compromised credential still means a compromised network. Grid communications during extreme events — precisely when security matters most — depend on infrastructure that was never designed to survive compound disruptions.

• Credential elimination Passwords and tokens are never transmitted or stored on any network-accessible system. Authentication is cryptographic proof-of-key, not secret exchange — so there is nothing on the wire to intercept and nothing in a database to breach.
• Beyond end-to-end encryption Encryption is not just in transit. The full life cycles of connections, sessions, relationships, identities, devices, data stores, applications, and systems are enclosed in layered cryptography from user to user and woven together across time into a fully continuous mesh. No cleartext exists between any two points where data is at use, including on the infrastructure nodes themselves.
• Legacy access via ZTNA mesh overlays Existing SCADA systems, historians, and OT infrastructure are accessed through mesh overlay adapters using Zero Trust Network Access principles. Legacy systems gain modern security posture without modification or rip-and-replace.
• Phishing and social engineering resistance Because credentials are never exchanged between parties, there is nothing for an operator to be tricked into revealing. Phishing, credential stuffing, and SIM-swap attacks against grid personnel become structurally inert. Not to mention cryptographic assurance of who you are talking to in the first place.
• Encryption to offline destination keys Sensitive data — sensor readings, operational logs, configuration — can be encrypted at the point of collection to offline destination keys held in cold storage or hardware security modules. Even full network penetration cannot expose data that was never decryptable on the network.
• High-security operations: airgap and hardware key support Full support for YubiKey and equivalent hardware security devices. Airgapped operational modes are first-class — the protocol is designed from the ground up for environments where physical security boundaries are as important as network security.

NAT-penetrating P2P connectivity means these guarantees hold across degraded backhaul, congested 5G links, and loss-of-connectivity scenarios during extreme weather events. OAuth2 local adapter bridges the mesh to existing utility IT stacks. Apache 2 licensed under a 501(c)(3) — open forever.