Europe energy groups warn cyber rules lag behind risk

European energy and cybersecurity groups warned that the region's power sector must close the gap between cyber regulation and operational readiness at the 9th Cybersecurity Forum in Brussels.

Speakers pointed to attacks on Poland's energy sector, Ukraine's experience defending its grid under sustained pressure, and weaknesses in connected household energy devices as examples of risks that rules alone cannot address.

The forum was organised by European distribution system operators, energy information-sharing body EE-ISAC, cybersecurity group ENCS and the EU's cybersecurity agency ENISA. The central message was that utilities, manufacturers and public authorities must focus more on practical resilience measures such as testing, vulnerability management and information sharing.

ENISA's Threat Landscape 2026 reviewed 8,257 cyber incidents affecting EU member states and EU-based organisations in 2025. It found that geopolitical developments continued to shape malicious cyber activity, attackers were increasingly using artificial intelligence, and claims of intrusions into operational technology were rising.

Operational technology refers to the systems used to monitor and control physical equipment and industrial processes. In the energy sector, that includes infrastructure linked to generation assets, substations and other parts of the electricity system.

Poland lessons

One case study discussed at the forum was the coordinated cyberattack on Poland's energy sector in December 2025. The attacks targeted multiple wind and solar farms, as well as a combined heat and power plant supplying heat to nearly half a million customers.

Electricity generation was not interrupted, but communications between the affected sites and distribution system operators were cut. Forum material said the attackers gained a level of access that could have been used to cause disruption.

The Polish case has drawn attention because it showed that attackers may not need to shut down generation outright to create operational risks. Loss of visibility and communications between renewable sites and grid operators can weaken system control and complicate incident response.

Ukraine response

Ukraine's transmission system operator NPC Ukrenergo also shared its experience of running a grid under sustained cyber pressure. Its approach includes using artificial intelligence tools to help cyber teams respond faster, identify gaps, support staff and assist with reporting, while leaving critical decisions to people.

The Ukrainian example also highlights a workforce problem across the wider sector. Specialist cybersecurity expertise is hard to replace once experienced teams are depleted, adding pressure to operators already dealing with persistent threats.

Household risk

Another issue raised at the forum was the spread of connected energy devices in homes. ENCS researchers outlined how a compromised smart-home device such as a router or camera could potentially be used to communicate with a residential solar inverter or home battery on the same network.

Some of these devices use control protocols that do not authenticate the source of a command. This means an attacker might not need to breach the inverter or battery directly to influence whether it generates, consumes or stores electricity.

On its own, a single household device is unlikely to affect the wider system. But experts said simultaneous manipulation of thousands of such devices could create abrupt shifts in electricity generation or demand and contribute to broader grid disturbances.

"More high-power IoT devices are being deployed every day, and vulnerabilities in some of these devices have already been exploited and could be exploited again to disrupt the electricity grid. In the short term, we need independent security testing, prioritised according to the amount of power potentially affected, combined with vulnerability management by manufacturers," said Harm van den Brink, security researcher, ENCS.

The concern reflects a broader shift in the electricity system as distributed generation, batteries and smart devices become more common. While these technologies can improve flexibility, they also widen the range of entry points for attackers.

Forum participants said regulation remains necessary, including measures such as NIS2 and the Network Code on Cybersecurity, but argued that prescriptive rules cannot keep pace with every technical change or threat path. That leaves operators and suppliers needing to identify emerging weaknesses through testing and cooperation rather than relying solely on compliance exercises.

For utilities, that means paying closer attention to third-party devices, software supply chains and communications links with distributed assets. For manufacturers, it increases pressure to fix vulnerabilities and support patching and disclosure processes.

"We must move from protecting individual systems to optimising the whole ecosystem for cybersecurity resilience," said Dimitra Liveri, head of the Resilience of Critical Sectors Unit, ENISA.