Cybersecurity for energy
Substations, wind and solar parks, batteries, inverters, smart meters and the vendor clouds that manage them.
A decentralised grid means thousands of connected entry points.
Substations, wind and solar parks, batteries, inverters and smart meters are monitored and controlled remotely, often through vendor clouds. The energy transition multiplies the connected devices that keep the grid stable.
Operators face NIS2 and the KRITIS rules. Manufacturers of inverters, controllers and charging equipment face the CRA and the Radio Equipment Directive. Both have to show that remote control cannot be abused.
Who it is for
- Transmission and distribution system operators
- Operators of wind, solar and storage assets
- Manufacturers of inverters, controllers and energy management systems
- Service providers with remote access to energy assets
Where energy systems are exposed today
The attack paths we see most often in generation, grids and the devices connected to them.
Remote control
Vendor clouds
Many inverters and turbines are controlled through the manufacturer's cloud. One compromised platform reaches thousands of assets at once.
Communications
Satellite and mobile links
Remote sites depend on third-party networks. When these fail, monitoring and control are lost.
Substations
Substation automation
IEC 61850 and telecontrol protocols were designed for closed networks and need protection once they are connected.
Remote access
Service access
Service teams and contractors access parks and stations remotely, often with shared accounts.
Devices
Inverters and controllers
Firmware vulnerabilities in inverters and battery controllers can affect grid stability when exploited at scale.
Metering
Smart meters and gateways
Meter gateways connect homes and businesses to the grid. In Germany their security is regulated by the BSI.
Corporate IT
Office networks
Ransomware in the office forces precautionary shutdowns of systems that support operations.
Supply chain
Components from many vendors
Components and software from many vendors meet in one plant. A vulnerability in one product affects many sites.
When it went wrong
Three documented cases from the energy sector. They show what happens when remote control is lost or abused.
December 2015, grid attack
Ukraine: the first blackout caused by a cyberattack
On 23 December 2015, attackers took remote control of the SCADA systems of three Ukrainian distribution companies and opened breakers at substations. They had prepared for months, starting with phishing emails.
Impact
About 225,000 customers lost power for several hours. The attackers also overwrote device firmware and wiped systems to delay recovery, so operators had to run substations manually.
Sources: E-ISAC and SANS ICS analysis, March 2016; ICS-CERT
February 2022, satellite network attack
Enercon: 5,800 wind turbines lose remote control
An attack on the KA-SAT satellite network, on the day Russia invaded Ukraine, disabled tens of thousands of modems across Europe. Enercon used this network to monitor and control wind turbines.
Impact
About 5,800 turbines with 11 GW of capacity could no longer be monitored or reset remotely. They kept producing power, but restoring the connections took weeks.
Sources: Enercon; Viasat; Reuters; AFP
March 2022, ransomware
Nordex: a turbine maker shuts down its IT
The wind turbine manufacturer detected an intrusion on 31 March 2022 and shut down IT systems across multiple locations and business units as a precaution. The Conti ransomware group later claimed the attack.
Impact
The turbines kept running, but Nordex had to switch most of its fleet to alternative remote control services while its systems were restored.
Sources: Nordex press releases, April 2022; Infosecurity Magazine; ISMG
What a working energy security approach looks like
Six building blocks that keep generation and grids controllable, for operators and manufacturers.
1
Asset and connection inventory
Every site, device and remote connection is known, including vendor clouds.
2
Secure remote control
Strong authentication, encryption and approval for every path that can send commands.
3
Redundant communications
Fallback paths, so monitoring and control survive the loss of one network.
4
Segmented substations and parks
Zones and conduits according to IEC 62443 and protected control protocols according to IEC 62351.
5
Secure products
Inverters, controllers and gateways developed to the CRA, the Radio Equipment Directive and IEC 62443-4-2.
6
Incident response for operations
Playbooks for manual operation, reporting and recovery after an attack.
How we help
For operators and manufacturers, from the first applicability check to tested control paths.
OT and plant security
Parks and substations that stay controllable under attack.
What we do
- Assessment against IEC 62443 and IEC 62351
- Remote access and communication concept
- Recovery and manual operation planning
You receive
Zone model, measure plan, recovery plan
Regulatory readiness
Clarity on NIS2, KRITIS, the CRA and the Radio Equipment Directive.
What we do
- Applicability check for operators and manufacturers
- Gap analysis against the relevant requirements
- Roadmap with priorities
You receive
Applicability report, gap list, roadmap
Product security engineering
Secure inverters, controllers and energy management systems.
What we do
- Threat analysis per product
- Requirements based on IEC 62443-4-2 and EN 18031
- Review of update and cloud architecture
You receive
Threat analysis, requirement set, architecture review
Testing and vulnerability handling
Evidence that devices and control paths withstand attacks.
What we do
- Penetration tests of devices, clouds and remote access
- Vulnerability monitoring and response process
- Preparation for CRA and NIS2 reporting
You receive
Test report, response process, reporting playbook
How we work
Step 1
Scope
We agree on the sites, products and rules in scope.
Step 2
Assess
Site visits, workshops and a document review show where you stand.
Step 3
Build
We create the work products with your engineers, or generate them with AITIGRITY.
Step 4
Prove
Tests, exercises and audit preparation close the gaps that matter.
Standards and regulations
NIS2 and the BSI Act
Grid and generation operators are essential or important entities with duties for risk management and reporting. Operators of critical facilities also provide evidence to the BSI.
IT security catalogues of the Federal Network Agency
German grid and energy facility operators must meet the BNetzA IT security catalogues under the Energy Industry Act, including ISO 27001 certification.
Network Code on Cybersecurity (EU) 2024/1366
Specific rules for cross-border electricity flows, with risk assessments for entities that are critical for the grid.
IEC 62351, IEC 61850 and IEC 62443
Security for power system communication, substation automation and the control systems and components in plants.
Cyber Resilience Act and Radio Equipment Directive
Inverters, controllers, wallboxes and gateways with digital elements fall under the CRA. Wireless devices have had to meet the RED cybersecurity requirements since August 2025.
Related services and modules
The consulting services and AITIGRITY modules used most often in the energy sector.
Not sure where to start?
A short scoping call shows which rules apply to your sites or products and what comes first.
Talk to an expertFrequently asked questions
Does the CRA apply to our inverters and controllers?
In most cases yes, if they contain software or connect to networks. Wireless products must also meet the Radio Equipment Directive requirements. We check this per product family.
What do the BNetzA IT security catalogues require?
An information security management system with ISO 27001 certification for the scope defined in the catalogue, plus specific measures for the systems that control the grid or the plant.
How do we keep control of remote sites during an attack?
With redundant communication paths, procedures for local and manual operation, and exercises that test them. We help you plan and practise this.
Can you assess our vendor's cloud platform?
Yes. We review the security of remote control platforms and define the requirements your contracts should include.
Where does your product stand?
Tell us about your product and the rule you are facing. You talk to an engineer from the first call.
Cybersecurity consulting and the AITIGRITY platform for connected products and industrial systems.