The 9th European Cybersecurity Energy Forum is ongoing under the theme “Holding together in a changing world: Grid Cyber Resilience and Preparedness”
The 9th Cybersecurity Energy Forum, jointly organised by European Distribution System Operators (E.DSO), European Energy Information Sharing & Analysis Centre (EE-ISAC), European Network for Cyber Security (ENCS) and ENISA, under the theme “Holding together in a changing world: Grid cyber resilience and preparedness” is taking place on 8 October 2026 in Brussels, Belgium.
The forum focuses on the changing architecture of European electricity networks, where centralised generation is increasingly complemented by distributed resources, demand response and flexibility mechanisms, brings together stakeholders from Europe’s energy sector to discuss how cooperation can strengthen the resilience and preparedness of electricity grids.
Europe’s rapidly digitalising energy system is creating new opportunities for renewable generation and distributed electricity management, but also expanding the potential cyberattack surface. Recent research identified 8,547 internet-facing systems associated with wind and solar installations across 35 European countries, including systems that could potentially expose operational controls. At the same time, smart technologies, digital interfaces and interconnected systems are creating additional dependencies.
ENISA and its partners emphasise that the cybersecurity challenge is therefore shifting from preparing for attacks towards dealing with attacks while maintaining the resilience of critical energy operations. While these findings highlight weaknesses in the protection of distributed renewable infrastructure, they also point to a broader challenge: cybersecurity can no longer be considered solely in terms of preventing compromise. As electricity systems become more decentralised, interconnected and dependent on digital technologies, resilience increasingly depends on the ability to maintain essential functions during an attack and recover rapidly afterwards.
Technically, this shift is significant because the attack surface of the electricity system is no longer concentrated within a limited number of large utilities or central control environments. Distributed energy resources, smart-grid technologies, operational technology, connected devices and digital management platforms create multiple points through which an incident can propagate.
A compromise of an individual component may not necessarily cause a systemic disruption, but the aggregation of vulnerabilities and dependencies can generate cascading effects. The distinction between IT and operational technology security therefore becomes increasingly difficult to maintain. Resilience requires not only preventive controls such as secure configurations, network segmentation, vulnerability management and access control, but also continuous monitoring, incident detection, isolation capabilities, operational continuity measures and tested recovery procedures. Supply-chain security is equally important, as utilities depend on manufacturers, software providers, telecommunications networks and other third parties whose compromise may affect multiple operators simultaneously.
The distributed nature of future grids also raises questions about whether smaller operators and new market participants possess the resources and expertise required to meet increasingly complex cybersecurity expectations. The objective should therefore be a resilience model in which security requirements, operational procedures, crisis management and supply-chain controls are integrated rather than implemented as separate compliance activities.
Why does it matter?
The governance challenge is consequently to translate cybersecurity regulation and technical standards into operational capabilities. ENISA’s work with energy-sector stakeholders already covers risk assessment, incident response, information sharing and cybersecurity requirements for electricity networks, while the wider EU regulatory framework is increasing obligations for critical entities and digital service providers. Yet regulation alone cannot guarantee resilience. Operators need sufficiently clear responsibilities, common risk methodologies, mechanisms for sharing actionable threat information and the capacity to coordinate across the public and private sectors during an incident.
The development illustrates a broader evolution in critical-infrastructure cybersecurity: the central question is increasingly not whether an attack can be prevented, but whether essential systems can continue to function when prevention fails. This is particularly consequential for the energy transition because decentralisation and digitalisation simultaneously increase the number of connected assets and the number of actors responsible for their security.
The European grid therefore represents a useful case study of the transition from perimeter-based cybersecurity towards systemic cyber resilience. The combination of exposed renewable infrastructure, smart-grid technologies, supply-chain dependencies and increasingly interconnected electricity systems demonstrates that resilience must be assessed across the entire ecosystem. The emerging governance model consequently requires technical security, operational continuity, coordinated incident response and regulatory oversight to be treated as mutually dependent components of energy security.
