Cyber security and renewable energy: the big picture

< Blog

18 March 2025

The first in a series of articles from Capgemini and RenewableUK, pulling back the curtain to provide an introduction to the key concepts, notable headlines and hot topics around cyber security in the context of clean energy generation.

Setting the scene

Nostalgia is a powerful force and often a source of comfort – particularly if we think back to the days when going shopping didn’t involve equipping yourself with anti-virus and facial recognition software, and there was no danger of your Amazon parcels being mistakenly shipped to the wrong country. Or when listening to music involved playing a physical CD rather than haggling over whether to subscribe to Spotify or Apple Music.

Our intricate, modern and digitally enhanced world may not be perfect, but, by many measures, life today is better than we frequently think. The proportion of the world living in extreme poverty has significantly decreased, from 85% in 1800 to less than 9% in 2024, whilst global life expectancy has risen dramatically in the last two centuries. What’s more, global literacy rates have drastically improved, as has access to clean water, vaccination rates, and even the number of democracies around the world.

Electricity for all!

Most importantly for RenewableUK members, access to electricity has significantly increased in recent decades. As recently as 1998, only around 73% of the global population had access to electricity. By 2020, this number had risen to over 90%.

Increased access to electricity has had profoundly positive impacts on education and health, opening economic doors, especially in developing regions, as well as bringing people together by connecting us all through a 24/7 stream of news and media.

However, the advances in technology and innovation made possible by access to electricity are accompanied by a whole new set of challenges to address. In many cases, they have opened a pandora’s box, one that can impact the very progress humanity seeks. Ensuring we are conscious of and protected from these new threats is the role of cyber security.

The need for vigilance

Consider the security of your home or workplace - from the alarms, gates and locks on your doors to prevent intrusion, to the parental filters, screen time limits and passwords to block inappropriate content. We educate our children and colleagues (and even parents) regarding online risks, we discuss the latest scams with our friends and neighbours, we install antivirus software to protect our devices, and we password protect our Wi-Fi, which itself is likely to have an in-built firewall to block certain malicious websites.

In other words, we undertake a wide range of activities to ensure both physical and digital threats are reduced, many without really thinking. Within the cyber security world, these actions are known as ‘controls’, because they control a given ‘risk’, which in turn is defined as the combination of the impact of a threat with the likelihood it will occur. Having rules is one common example of a risk control, which will be expressed in a structured set of security policies, standards and processes. Some of these will be contained in the common ‘acceptable use’ policy signed by new employees, whilst there will be alternative policies for specific departments such as procurement and human resources.

With an increasing number of businesses now operating from the cloud and working remotely, new solutions are used to protect workers. Collectively these approaches and solutions are known as ‘zero trust’, and they exist to prevent unauthorised access to corporate resources by continuously verifying all access requests. Under zero trust, access is denied by default and only granted on very specific grounds for trusted individuals using trusted devices. This is what allows us to work safely and reliably from (almost) anywhere, by trusting nothing until we have validated who or what it is, and where it’s trying to go.

Are we overreacting?

If this all sounds a bit draconian, just consider a handful of recent headlines to see the worrying effects of cyber-attacks impacting our banking and financial services, water supplies, power grids, healthcare systems, public institutions, and even Governments. In October 2023, the British Library was attacked by the ransomware-as-a-service (RaaS) gang Rhysida, who demanded 20 bitcoin (around £596,000 at the time). When the library did not comply, the attackers released approximately 600GB of confidential data online. Similarly, the UK Ministry of Defence experienced a significant data breach in 2024, releasing the personal data of armed forces personnel, while the NHS suffered a ransomware attack which caused the suspension of blood testing in south east London for several weeks.

Looking overseas, we have seen a litany of cyber-attacks on US infrastructure and critical systems between November 2023 and April 2024, with Iran-affiliated and pro-Russian cyber actors gaining access to and manipulating critical industrial control systems in sectors like food and agriculture, healthcare, and wastewater. In short, cyber-attacks never stop and risk never sleeps.

How does this relate to renewables?

When considering the clean energy sector, the potential vulnerabilities quickly become apparent. From the components and technologies that power and monitor individual wind turbines and solar panels, to the grid network that converts and distributes electricity across the country, and even the interconnectors that allow the flow of electricity across continents. And that’s without mentioning the personal and financial data belonging to millions of billpayers!

The expansion of digital and smart technology into the operational technology (OT) systems which control our turbines, power grids, manufacturing plants, water supply and much more, brings with it a level of vulnerability. These technologies are complex and connected, so it only takes one badly written line of code or one weakness to be found for us to become exposed to attacks which have the potential to maim, kill and cause significant damage to the environment. For example, a form of malware known as Triton is specifically designed to sabotage and disable a power plant’s safety system, potentially causing explosions and major industrial accidents.

Extraordinary levels of vigilance are required to guard against such threats, and dealing with these challenges to safeguard progress and our quality of life is where cyber security comes in. Throughout this series, we will look at common forms of cyber-attacks, the vulnerabilities of widespread technologies in our sector, as well as measures to ensure best practice and protection. Our next article will examine Occam’s razor and the techniques that renewables can adopt from other forms of critical infrastructure, as well as how squirrels can inform our approach to dealing with new realities and risks to build operational resilience throughout our industry.

There is also still time to register for our Cyber Security Seminar next Tuesday 25 March, where a cast of expert speakers will explore emerging threats, regulatory requirements, and effective strategies to secure your digital infrastructure. Ranging from the current threats facing the renewables sector, to the future of secure renewable energy and the forthcoming Cyber Security and Resilience Bill, attendees will gain actionable insights into protecting their systems, fostering cyber resilience, and future-proofing their operations.