Energy and Cybersecurity: AI and Connected Devices Widen the Gap

On 12 October 2026, the 9th Cybersecurity Forum took place in Brussels, jointly organized by E.DSO, EE-ISAC, ENCS and ENISA. The central message: regulation alone is not enough to close the gap between rapidly evolving threats and the energy sector's practical ability to respond.

The Context: ENISA Threat Landscape 2026

The forum came just weeks after the publication of the ENISA Threat Landscape 2026, which analyzed 8,257 incidents in 2025 involving EU Member States and organizations based in the Union. Two trends were highlighted: attackers are increasingly using artificial intelligence, and claims of OT-related intrusions, that is, intrusions into operational technology systems, have increased.

The Poland Case, December 2025

A concrete example dates from December 2025, when coordinated attacks hit numerous wind and photovoltaic farms and a combined heat and power plant supplying heat to nearly half a million customers. According to reports, the effects were:

• electricity production was not interrupted;
• communications between the affected plants and the distribution system operators were lost;
• the attackers gained access that could have allowed them to cause outages.

AI: A Tool for Both Attack and Defense

Ukrenergo, Ukraine's transmission system operator, uses AI to help security teams react faster, identify gaps, support staff and assist with report drafting. Critical decisions, however, remain with humans. Ukrenergo also points to a difficulty: rebuilding qualified security teams through hiring is hard.

From Home to Grid: The ENCS Demonstration

ENCS showed how an attacker who has already compromised a household device, such as a router or a camera, could use it to reach a residential photovoltaic inverter or a home battery on the same network. Some of these devices use control protocols that do not authenticate whoever sends a command.

Compromising a single home would hardly affect the grid. Manipulating thousands of devices at once, however, could cause sudden swings in generation or demand and contribute to wider disturbances. It should be noted that the source gives no figures on how many devices would be needed, and that the scenario is presented as a potential path emerging from a demonstration, not as an attack that has occurred.

Recommendations

Harm van den Brink of ENCS called for independent security testing, prioritized by the power potentially involved, together with vulnerability management by manufacturers. Dimitra Liveri of ENISA argued that the sector must move from protecting individual systems to optimizing the whole ecosystem for resilience. NIS2 and the Network Code on Cybersecurity remain important references.

What This Means for Industrial Software Developers

Practical guidance for those who design or integrate automation systems:

• Command authentication: a control protocol without authentication is a real design risk; compensate with segmentation, access control and gateways that verify the origin of commands.
• Consumer devices on the same network: routers and cameras can become an entry point to power assets; network isolation should be a requirement, not an option.
• AI with human oversight: use it to speed up analysis and reporting, leaving critical decisions to people, as in the model described by Ukrenergo.
• Security testing: for high-power connected devices it is likely to become a priority, so it pays to prepare with inventories, vulnerability analysis and close relationships with suppliers.

Regulation alone does not close the gap between fast-moving threats and practical response capability.

The picture that emerged in Brussels on 12 October 2026 points in a clear direction: resilience depends as much on the secure design of individual components as on regulatory compliance.