The energy system is getting smarter very quickly. More renewables, more batteries, more digital controls, more connected infrastructure and eventually far more of our homes and businesses talking to the grid.
All brilliant. Until you remember that every clever bit of kit connected to something else is also potentially another way for somebody to get in and cause the energy sector chaos…
That was the slightly unnerving part of my conversation this week with Sean Arrowsmith from NCC Group. We talked cyber attacks, hostile states, AI and whether our rush to build a much more digital energy system is also creating a much bigger security problem.
Sean explained that the old separation between IT systems and the technology actually controlling physical infrastructure is disappearing.
“The digitalisation that’s happening within the energy market more and more, so, you know, the drive for a modern energy system, for net zero purposes, but also for just better management of those systems. So yeah, that convergence between IT and what we call operational technology that controls those physical processes within energy substations, etcetera. Bringing those two together has brought the attack surface out to the attackers and made it more available.”
In plain English, the more connected everything becomes, the more opportunities there are for somebody to have a go.
And this isn’t just about the big established energy companies. We are bringing thousands of new technologies and businesses into the system through renewables, storage and distributed energy and some of them are learning about critical infrastructure as they go.
“You’ve got lots of new firms coming into the energy market in terms of renewables. You’ve got battery and these energy storage solutions. They look relatively innocuous from a technology standpoint but it’s really important that those are architected in the right way and that security is built in at the engineering point in the design phase to make sure that we don’t introduce more risk into the system.”
One example Sean gave me rather summed it all up. You can install sophisticated technology, spend a fortune on the right equipment and then undermine the lot by leaving a default password in place.
That sounds ridiculous but that is exactly why he says cyber security has to be part of the engineering from the beginning, not something somebody remembers to add once everything is built.
“When actually you’re building the kind of systems architecture for these sites, you’re thinking about security in that context from the very start. Because if you build it in from the start, it’s much easier to then implement, get right, and also you don’t have to retrospectively go and re-engineer stuff and take stuff out to fix it.”
Then I asked the obvious question. What happens when AI gets involved?
“Unfortunately that is already a reality. So that kind of level of automation coming in is happening. And it’s happening on both sides and to a certain extent, cyber because of its very nature, there’s always been something of an arms race and we’ll continue to see that go on into the future.”
That phrase stuck with me: an arms race. The good news is Sean isn’t predicting some Hollywood moment where somebody presses a button in a basement and Britain suddenly goes dark. The energy sector increasingly thinks about resilience, containment and how quickly systems recover when something does go wrong.
But there is a fairly obvious lesson here.
We are building a cleaner energy system and at the same time making it far more digital. We just need to make sure that in our rush to make everything smarter, we don’t also make it easier to attack.
Listen to my full conversation with Sean Arrowsmith from NCC Group on the Net Hero Podcast, download the episode wherever you get your podcasts and please subscribe.
Copyright © 2026 Energy Live News LtdELN