Centrii has published ‘GRIDLOCK’, a risk assessment analysis of cyber-physical exposure in UK battery energy storage systems (BESS). These use batteries to store wind or solar generated electricity at times when supply is higher than demand. They can then later release it into power grids when it is needed.
Using a Monte Carlo risk analysis methodology of 10,000 simulations across three industry security postures – baseline, moderate, and aggressive – the ‘GRIDLOCK: What a Coordinated Battery Attack Would Cost the Grid’ report quantifies the probability and financial cost of a coordinated attack on BESS between now and 2031.
According to the findings, under industry-average security practices, there is a 92% probability of a major attack on battery storage infrastructure within the next five years. This falls as security investment and enhancements increase. Under voluntary improvement adopted gradually and unevenly across the sector, it falls to 78%, while adopting mandatory IEC 62443 certification and regular attack-readiness drills sees the probability fall to 61%.
The earliest likely attack window also changes as a result, from 2027-28 under the baseline posture to 2029-31 under the most rigorous one. Based on these figures, security investment not only reduces risk, but it also buys time.
In the UK, the effects of an attack are more concentrated than in the US. The modelling finds that compromising 29% of national BESS capacity (around 400 units) could be sufficient to trigger a nationwide outage affecting 67 million people, effectively the entire population. A single major attack is estimated to cost between £2bn and £10bn in financial damage.
Bringing UK battery storage infrastructure up to IEC 62443 Security Level 2 – the standard the modelling shows meaningfully reduces attack probability – is estimated to cost between £400m and £1bn across the national fleet. That is a return on proactive security investment of roughly 5x to 25x.
Rafael Narezzi, Co-Founder and CEO of Centrii, explains the importance: “A coordinated attack does not need to stop generation to cause a blackout. It only needs to desynchronise the balancing layer, forcing batteries to charge or discharge together, or delaying how they respond to grid signals. Neither action damages a battery. The effect is closer to a distributed denial-of-service attack than a conventional outage – instead of overwhelming a website with traffic, it overwhelms the grid’s ability to stay in balance, using energy itself as the disruptive force. The modelled result is a cascading blackout that unfolds in under two minutes.”
Risks to grid-balancing infrastructure
According to RenewableUK, the UK government has estimated that between 23GW and 27GW of battery storage will be required by 2030, a significant increase from approximately 4.5GW in 2024.
While the balancing function in modern battery fleets, often managed remotely through cloud-based platforms, makes them efficient to run at scale, it also exposes them to attacks, according to the Centrii report.
Recent high-profile events in Europe demonstrate how disruptions to grid-balancing infrastructure can escalate quickly. Both illustrate the underlying risks examined by ‘GRIDLOCK’ that relatively concentrated disruptions to generation or balancing infrastructure can have consequences across a much larger grid:
- In December 2025, state-sponsored actors were reported to have attempted to destabilise regional grid infrastructure in Poland by rapidly cycling wind turbine output rather than damaging equipment.
- In April 2025, the Iberian grid collapsed after 2.5GW of generation was lost in under 20 seconds, leaving parts of Spain and Portugal without power for roughly ten hours and some areas for longer. Authorities attributed the Iberian outage to technical causes, not a cyber attack.
