Protecting the Energy That Powers America

The Challenge

Protecting the Grid That Powers Eight States

Xcel Energy provides electricity and natural gas to millions of residential and business customers from Minnesota to Texas. With around 28,000 employees, it’s one of the country’s larger multi-state energy operations and a daily lifeline for communities across America. Energy is critical infrastructure, alongside financial services and telecommunications, because without it, nothing runs. That makes Xcel Energy a clear target for nation-state actors. 

Shaun Marion, Xcel Energy’s Chief Security Officer, says attacks have escalated sharply over the past 18 months. Between February 2025 and April 2026, the company faced a 328% increase in business email compromise attacks (BECs), a 501% increase in phishing, and a 902% increase in Telephone-Oriented Attack Delivery (TOAD) threats. The human cost of an attack on the grid is direct and impactful. "A hospital can operate about three days without electricity," Marion warns. "At three days you start having some serious problems." 

Regardless of who the attacker is or which vector they choose, the easiest way in is still via email, and Xcel Energy’s existing defense didn’t have the capabilities to keep 28,000 inboxes secure. Marion went back to the basics and looked at how the company was filtering emails, training employees, and protecting data. “We put a lot of work into making sure that we can not only secure the grid but secure our operations so we can continue to provide those services to our customers,” he says. 

For Marion, the path forward was to “amp up” Proofpoint’s capabilities to make sure the company was getting the most out of the platform.  

The Solution

Tapping Into the Full Power of Proofpoint  

When Marion joined Xcel Energy, Proofpoint was already a partner, but was only partially deployed alongside Microsoft’s email security capabilities. "Microsoft does a lot of really good things, but security is not their bread and butter," he states. Marion decided to introduce the team to the full power of Proofpoint. 

The company’s Proofpoint stack consists of Core Email Protection: Enterprise Email Protection, Targeted Attack Protection (TAP), and Threat Response Auto-Pull, which all work together to filter, detect, and remediate threats at the gateway. Marion points to data suggesting that 93% of breaches start with phishing, making the fix critical. “I’ll deploy Proofpoint to solve that problem,” he says. “That’s why I say Proofpoint is foundational to my strategy.”  

If an attacker manages to get in, Internal Mail Defense catches lateral threats that can move inside the network.  Marion says Proofpoint makes it easy: "I get a monthly report and I know that we are filtering out a ton of email, spam, and phish. I don't really go dig, because I trust the platform." Now Marion can focus his attention on the threats that need human judgment. 

Layered over the email defense is Proofpoint’s ZenGuide. Where many security tools try to operate invisibly, ZenGuide deliberately engages Xcel Energy’s workforce with phishing simulations modeled on real-world patterns. Marion recalls one email that teased a change in remote work policy: “My click rates flew through the roof.” 

Employees quickly become skilled at flagging risky emails the moment they encounter them. Marion says engagement is one of the most distinctive things about the platform. "The better I use Proofpoint’s capabilities, the better my employees become at protecting the company.”  

The Results

Powerful Results in a Short Period of Time  

Over a three-month period, Proofpoint detected more than 430,000 phishing, malware, BEC, and TOAD threats for Xcel Energy at a 99.99% effective detection rate. Across a six-month window, the platform analyzed more than 120 million inbound emails and blocked 77% of them at the gateway, with close to one million of those classified as advanced threats.  

Behind the headline numbers lies an operational overhaul. Proofpoint has taken Xcel Energy’s abuse inbox—where employees report suspected phishing—from thousands of manual reviews a month to about 6. That reduction has freed the team to focus on the threats that need a human in the loop. 

The most dramatic results were leadership driven. When Marion brought a report to an executive briefing that showed click rates and phishing-report rates broken down by business unit, the comparison turned into a competition. "One of the best things I ever did," Marion says. Leaders started forwarding the reports to their direct reports, causing a rapid uptick of abuse reporting across the company.  

"We could see a clear correlation between sharing the data with the right people, that data getting disseminated, and action happening," Marion says. Insight became leverage, leverage became culture, and Xcel Energy’s executive leadership became more engaged as a result. 

What started as a partial deployment is now a pillar of Xcel Energy's security strategy. Proofpoint’s Core Email Protection, Internal Mail Defense, and ZenGuide security awareness training transformed how email threats affect the company. Now the team can focus on what comes next as AI energizes both attackers and security teams.  

"AI is a game changer," Marion explains. “When I think of agentic, we're at the point now where we can get ahead of this, because if we're going to let these agents act as humans, we have to give them identities like humans.”  

For a company that powers millions of homes, hospitals, and businesses across America, having Proofpoint along for the next chapter is a significant win. With secure, reliable energy in the background, individuals and communities can thrive. Marion agrees: “Proofpoint is foundational to my security strategy.”