Energy & Utilities
Grids, pipelines and water systems are now connected and remotely managed — and millions of meters, inverters and chargers sit at their edge. We test the systems utilities run and the equipment makers ship, with operational safety first.
Book a ConsultationThe energy transition moved the attack surface to the edge
Smart meters, rooftop solar inverters, batteries, heat pumps and EV chargers are connected devices, often controlled through their manufacturers’ clouds — and in aggregate they move real load on the grid. Behind them, control centres, substations and pumping stations are increasingly reached over IP, by vendors and remote operators.
The rules are specific and getting more so. NERC CIP keeps adding requirements for the bulk electric system, the EU’s network code on cybersecurity brings risk assessments and controls to electricity operators across borders, and NIS2 now names charge-point operators, aggregators and storage alongside traditional utilities.
Utility equipment stays in service for many years, so the cryptography in a device installed today has to outlast today’s public-key algorithms — and changing it later can mean a visit to every site. That decision belongs in procurement and design, not in a crisis.
Three services, tuned to the grid
Artificial Intelligence Security (AI-BOM)
AI in load forecasting, grid optimisation, outage response and customer service — and agents with a path to operator or customer actions. We test what the AI can change and who can steer it, not just what it says.
Learn more →Post-Quantum Cryptography Readiness (CBOM)
A cryptographic inventory across meter fleets, device identity and firmware signing, substation and control-centre protocols, and the VPNs and PKI that connect them. Re-keying a fleet is a field operation, so the roadmap is sequenced against your rollout and refresh plans.
Learn more →Product Penetration Testing
For operators: the IT/OT boundary, remote and vendor access, and control-centre and substation networks — passive by default, as described on our Industrial / OT page. For equipment makers: smart meters, inverters, batteries, EV chargers and grid devices, plus the apps and clouds that command them.
Learn more →Built for critical infrastructure, not adapted from IT
Rated at fleet scale
A flaw in a meter’s or inverter’s firmware, or in its vendor cloud, is a flaw across thousands of sites. We rate findings on aggregate impact — what an attacker could do with many devices at once — not just one unit on a bench.
The cloud control path
Many distributed devices are commanded through their manufacturer’s cloud. We test that path — accounts, APIs and firmware updates — because it is where one compromise reaches a whole fleet.
Passive on live networks
Operational networks are assessed passively by default, using the same safety-gated method as our Industrial / OT work. Active testing happens in a lab, on spares, or in an agreed outage window.
Evidence for your regulator
Scope, methods and results documented for the regime you report to — whether that is NERC CIP, the EU electricity network code, NIS, or your national regulator.
Where the rules stand, market by market
Energy and water carry some of the most specific cybersecurity rules of any sector — and the grid edge is catching up. Current as of October 2026.
| Market | Instrument | What it means for you |
|---|---|---|
| US — electricity | NERC CIP standards | Mandatory for the bulk electric system. CIP-003-9 added vendor remote-access controls for low-impact systems from 1 April 2026; FERC approved stronger low-impact requirements (CIP-003-11), virtualization standards and the extension of internal network security monitoring (CIP-015-2) in 2026, enforceable from 2028 and 2029. |
| US — pipelines | TSA security directives | Binding directives for designated pipeline operators, reissued in January and May 2026. A permanent rule proposed in November 2024 is not yet final. |
| US — water | No binding federal cybersecurity rule | Community water systems serving more than 3,300 people must complete risk and resilience assessments — covering electronic and automated systems — on a five-year cycle; the last tier was due 30 June 2026. |
| European Union | Network Code on Cybersecurity — Delegated Reg (EU) 2024/1366 | In force since 13 June 2024, with obligations phased in. Electricity-specific rules for cross-border flows: a Union-wide risk assessment first, then high- and critical-impact entities notified by 13 June 2028 at the latest, with entity and regional risk assessments and minimum and advanced controls to follow. |
| European Union | NIS2 — Directive (EU) 2022/2555 | Binding through national law, which member states had to apply from 18 October 2024. Electricity, district heating, oil, gas and hydrogen, drinking water and waste water are sectors of high criticality. The electricity subsector explicitly includes recharging-point operators and aggregation, demand-response and storage providers. |
| European Union | Critical Entities Resilience Directive — (EU) 2022/2557 | Member states had to identify their critical entities by 17 July 2026 and notify them within a month; physical and operational resilience duties, alongside NIS2, apply ten months after notification. |
| European Union | Cyber Resilience Act — Reg (EU) 2024/2847 | Applies to grid-edge products sold in the EU — chargers, inverters, home energy devices. Manufacturers’ reporting of actively exploited vulnerabilities and severe incidents since 11 September 2026; full application from 11 December 2027. Smart meter gateways are listed as critical products. |
| United Kingdom | NIS Regulations 2018 Smart Charge Points Regulations 2021 | Electricity, gas, oil and drinking water operators are under NIS, with Ofgem, jointly with DESNZ, assessing downstream gas and electricity operators in Great Britain against the NCSC Cyber Assessment Framework. Home and workplace EV charge points sold in Great Britain since 30 December 2022 must meet statutory security requirements. Smart meters are certified under the Smart Energy Code’s product assurance scheme. |
| United Kingdom (in progress) | Energy smart appliances and load control | Load-controller licensing is planned to open in March 2027 and become mandatory in March 2028, subject to Parliament approving the regulations. Draft rules for energy smart appliances were consulted on until February 2026, with only an interim government response so far. The Cyber Security and Resilience Bill, which would bring load controllers of 300 MW or more under NIS, is in the House of Lords and not yet law. |
| Germany | BSI TR-03109 | Smart meter gateways must be certified against the BSI’s protection profile and technical guideline, both revised in December 2024; the earlier gateway versions stay valid until 31 December 2027. Gateway administrators must adopt the revised administration part, published in late 2025, at their next certification from 1 January 2027. |
| Engineering standard | IEC 62351 | Security for power-system communications, including TLS profiles, role-based access control (new edition July 2026) and key management. Its key-management part says post-quantum cryptography will be considered later. |
| AI and post-quantum | EU AI Act Annex III CISA — Post-Quantum Considerations for OT | AI used as a safety component in the supply of water, gas, heating or electricity is high-risk from 2 December 2027. No energy-specific post-quantum guidance exists. CISA’s OT considerations (guidance, October 2024) are the closest reference, and US Executive Order 14412 (June 2026) directs sector agencies and CISA to help critical infrastructure operators plan their migration. The general timelines are on our PQC page. |
What you get
- Asset reconciliation — what passive discovery found against your inventory and drawings, including the devices nobody can explain
- Fleet-scale findings — rated on physical consequence, reachability and aggregate impact, each with a compensating control and a now / next outage / refresh roadmap
- Product security evidence — for equipment makers, test results and fixes your utility customers, certification schemes and market rules will ask about
- Cryptographic bill of materials — meter, device, protocol and PKI cryptography in CycloneDX format, with a post-quantum roadmap aligned to your rollout plans
- AI bill of materials — the models, data sources and tools behind your grid and customer AI, delivered as a CycloneDX ML-BOM
- Two briefings — one for engineering and operations, one for security and leadership
Find the path to the grid before someone else does.
An energy and utilities engagement starts with your assets, their consequences, and the regulator you answer to.
Get in Touch