Why distributed energy resources change the cyber risk picture

Distributed energy resources — rooftop solar, home and grid-scale batteries, electric vehicle charge points, heat pumps, microgrids and virtual power plants — are the engine room of the UK's low-carbon transition. But they also move the grid's edge from a few hundred large power stations to millions of small, networked devices. That is a cybersecurity shift, not just an engineering one. A compromised inverter or aggregator platform can disrupt voltage, hide malicious commands inside normal traffic, or turn a fleet of batteries into an unpredictable load. If customers and operators lose confidence in these technologies, climate innovation stalls. So securing DER networks is part of delivering net zero, not an afterthought.

Start with an honest asset and trust map

You cannot protect what you have not documented. Build a register that covers every device, platform and connection in your DER estate. Include make, model, firmware version, communications protocol, physical location, owner and criticality. Then mark your trust boundaries: where data moves from a home broadband router to an aggregator's cloud, from a substation gateway to a control room, or from a third-party maintenance laptop into a battery management system. Ask simple but uncomfortable questions. Who can send commands? Who can change setpoints? Which devices accept unauthenticated traffic? Which suppliers have remote access? A spreadsheet is fine. Perfection is not the goal; visibility is.

• Field devices: inverters, battery management systems, smart meters, charge points, sensors.
• Network equipment: routers, firewalls, cellular modems, radio mesh nodes.
• Control platforms: SCADA, distribution management systems, DERMS, virtual power plant software.
• People and process: installers, aggregators, maintenance contractors, call centre staff.

Secure communications from device to control room

Many DER protocols were designed for convenience, not security. Modbus, DNP3, IEC 61850, OCPP, OpenADR and MQTT are common, and some lack authentication or encryption by default. Where you can, wrap them in TLS, use mutual authentication with certificates, and avoid exposing devices directly to the internet. Prefer outbound-only connections from field devices to a cloud broker, so a compromised device cannot easily accept inbound commands. Segment networks: keep management traffic away from operational traffic, and separate guest Wi-Fi from charge point backhaul. For wireless links, use a private APN or dedicated spectrum with strong encryption. Rotate keys and certificates on a schedule. Obscurity is not a defence.

Layer defences at the edge, in the network and in the cloud

Assume that some devices will be compromised. Defence in depth means an attacker who defeats one control still faces others. At the edge, disable unused ports, change default credentials, enforce signed firmware, lock physical ports, and use a hardware root of trust where available. In the network, apply firewall rules, intrusion detection tuned to industrial protocols, and allowlists of known-good endpoints. In the cloud, use role-based access control, multi-factor authentication, API rate limiting and immutable audit logs. For aggregators, rate-limit commands and validate them against grid constraints. Keep a manual override for safety, and test it.

• Patch what you can; isolate what you cannot.
• Use separate credentials per device or site — never shared accounts.
• Log every command, configuration change and firmware update.

Monitor continuously and rehearse your response

Threats evolve, so point-in-time compliance is not enough. Continuous monitoring means collecting logs from inverters, gateways, firewalls and cloud APIs, then looking for unusual command frequency, failed logins, unexpected firmware changes, new outbound connections and data exfiltration. Set alerts that a human can act on, with clear escalation paths. In the UK, take account of NCSC guidance, the NIS Regulations if you are an operator of essential services, and your obligations as a distribution network operator or aggregator. Have an incident response plan that names who isolates a site, who contacts the network operator, who talks to customers, and how you restore service. Run tabletop exercises and test backups. A coordinated attack on many small devices can have a big effect, so speed matters.

Build security into procurement, people and culture

Cyber security is not a one-off project. Write requirements into contracts: no default passwords, a clear support lifetime, vulnerability disclosure, a patching cadence, and the right to audit. Ask vendors for evidence, not assurances. Train installers and field engineers to spot tampering, unusual cables or unexpected devices, and give them a simple way to report it. Create a culture where someone can say "this feels wrong" without blame. Share anonymised threat intelligence with peers through trusted forums, because attackers share too. As DER grows, so does the prize. Layered defences, secure communications and continuous monitoring are not extras; they are the foundation of a clean, resilient and trusted grid.