The resilience challenges of the renewable energy transition

By Rafael Narezzi

As the global energy transition accelerates, resilience is becoming ever more important. The growing convergence of renewable energy, operational technology (OT), and digital connectivity is creating new vulnerabilities and threats that demand a resilience-first approach from energy leaders.

The transition is reshaping how electricity is generated, distributed, and consumed. Renewable energy technologies and the deployment of distributed, connected assets such as wind farms, solar installations, battery storage facilities, and electric vehicle charging networks are transforming power networks at unprecedented speed. Yet while these developments are critical to achieving net-zero ambitions and national energy security, they are also dramatically expanding the attack surface.

Resilience has become a defining challenge for the energy sector. The ability to withstand disruption, adapt to emerging threats, and maintain operational continuity is now as important as the ability to generate power itself. Increasingly, cyber resilience sits at the heart of this equation.

Protecting critical infrastructure is no longer solely an operational concern. It is a business imperative with implications for energy security, economic stability, and public confidence.

The resilience challenge of a digital energy system

Renewable energy systems rely heavily on digital control systems. Supervisory control and data acquisition (SCADA) platforms, industrial routers, human-machine interfaces (HMIs), and programmable logic controllers (PLCs) allow operators to monitor performance, optimise generation, and manage assets remotely, often across vast geographic areas.

These technologies have delivered significant operational benefits, but they have also increased complexity and introduced cyber risks that were less prevalent in traditional energy environments.

Today, a single operator may manage hundreds of connected remote assets. While this approach improves scalability and efficiency, it can also create systemic risk if vulnerabilities exist across multiple sites.

As a result, resilience can no longer be viewed through the lens of individual assets alone. The challenge is ensuring the security and continuity of increasingly interconnected systems.

A changing threat landscape

Downtime remains one of the biggest operational challenges facing the renewable energy sector. While equipment failures such as gearbox seizures, generator overheating, and pitch system malfunctions continue to be major causes of unplanned outages, operators are also increasingly impacted by factors beyond their direct control, including grid instability and curtailment. At the same time, ageing infrastructure, inconsistent operational processes, and incomplete asset data can all extend outages by delaying fault diagnosis and repair.

Last year’s well-publicised wide-area power outage in Spain saw the Spanish National Cybersecurity Institute question many of the country’s smaller and medium-sized energy providers, notably the solar and wind farms, about their cyber security as part of the investigation. While an attack was eventually ruled out – the issue was an unmanaged surge in voltage – it raised serious questions about the possible cyber security shortcomings of renewable energy assets.

However, other recent incidents have highlighted the growing attention being paid to renewable energy infrastructure by both criminal and state-sponsored threat actors.

In 2022, a ransomware attack disrupted Deutsche Windtechnik and prompted the temporary disconnection of remote access to around 2,000 turbines. This attack didn’t just cause operational delays; it highlighted how fragile the digital backbone of the renewable sector has become.

Similarly, co-ordinated attacks on Poland’s power grid – targeting wind and solar farms – are further evidence that threat actors can target multiple remote locations simultaneously.

These incidents serve as a reminder that distributed energy resources are now viewed as strategically important targets within critical national infrastructure.

At the same time, cyber threats targeting industrial environments continue to evolve. New forms of malware specifically designed for operational technology environments have emerged, capable of interacting directly with industrial control systems.

The significance of these developments extends beyond the technical details. They highlight a broader reality. Operational technology environments are now central to the resilience of modern economies and critical services – and are now prime targets for opportunist as well as nation-state attacks.

The integration imperative

For many years, cyber security discussions within energy organizations focused primarily on preventing breaches and protecting systems. Today, the conversation is evolving.

Organizations must be able to anticipate threats, detect issues quickly, respond effectively, and recover with minimal operational impact.

This shift is particularly important when it comes to renewable energy, where outages can have cascading consequences across multiple assets. A cyber incident affecting a single site may have implications far beyond the immediate asset if visibility, monitoring, and response capabilities are insufficient.

The incidents involving wind energy assets in Poland highlighted how compromised connectivity and insufficient monitoring can create opportunities for attackers. Once edge routers were compromised, attackers could influence dispatch and control layers downstream. This is not a sophisticated espionage story; it is basic connectivity risk compounded by weak monitoring.

In many cases, organizations maintain extensive remote access arrangements with vendors and third parties while lacking comprehensive insight into OT communications and asset behaviour. This visibility gap creates operational blind spots that attackers can exploit.

Improving visibility is not simply a technical objective – it is a resilience imperative. Effective monitoring, asset discovery, and risk contextualisation provide the foundation for detecting threats early and understanding the potential business impact of disruption.

As a result, cyber resilience must be integrated into broader organizational resilience strategies. Security leaders, operations teams, risk managers, and executive leadership must work together to understand how cyber risks translate into operational and business risks.

The financial impact

One of the biggest challenges today is being able to communicate cyber risk in terms that resonate with executive leadership and boards.

Operational disruption and downtime remain a significant concern, but the financial implications of an attack often provide the most compelling case for investment. Lost revenue, contractual penalties, increased insurance costs, regulatory scrutiny, and reputational damage can rapidly transform a cyber incident into a major business crisis.

For example, in the energy sector, estimated losses average $2.5 million per hour of downtime. Similarly, a 98-megawatt wind turbine site could lose $1.9 million from a week of downtime. By quantifying downtime costs in this way, senior executives understand the real financial consequences and can make informed decisions about relatively modest security investments that significantly reduce their risk exposure.

However, the evidence is clear that the impact of downtime extends well beyond lost revenue, encompassing regulatory penalties, contractual breaches, recovery costs, reputational damage, and, in some cases, risks to public safety and grid stability.

This means that organizations need to stop viewing cyber security primarily through a technical lens, given growing dependence on digital infrastructure and increasing regulatory obligations.

Building resilience for the future

The energy transition represents one of the most significant infrastructure transformations of the modern era. Success will depend not only on deploying renewable generation capacity but also on ensuring the resilience of the digital systems that support it.

Proactive asset visibility, continuous monitoring, secure-by-design principles, network segmentation, and early threat detection can reduce the likelihood of prolonged outages while enabling operators to detect, contain, and recover from incidents more quickly. In an industry where even a few hours of disruption can result in substantial financial losses, resilience is increasingly proving to be a commercial advantage as much as a security imperative.

For boards and executive teams, cyber security should no longer be viewed as a supporting function or compliance exercise. It is an enabling capability that underpins operational continuity, stakeholder trust, and long-term organizational resilience.

The future of energy management will undoubtedly be digital. Ensuring that future remains secure, resilient, and capable of withstanding disruption will be essential to delivering the benefits of the energy transition.