Cybersecurity in the energy sector: the risks of a remote connection compromising continuity of supply

The energy transition is multiplying connected assets. Research published in October 2026 identified 8,547 Internet-accessible systems in European wind and solar farms that should not have been exposed. Protecting access to energy infrastructure is a matter of operational resilience.

The security of energy supply increasingly depends on the security of the digital systems that make it possible.

Distributed generation, automation, and remote management have transformed the sector. Today, the operation of numerous facilities depends on digital interfaces, supervisory systems, industrial devices, and connections that enable assets to be managed remotely.

This development brings efficiency, but it raises an essential question: are the access points to the systems used to control energy infrastructure adequately protected?

8,547 exposed systems: a warning sign for European renewables

On 6 October 2026, Internet intelligence company Modat presented research into the digital exposure of European solar and wind farms. The study identified 8,547 Internet-accessible systems associated with energy facilities in 35 countries, including administrative systems and control panels that should not have been publicly exposed.

Of these, 7,942 were associated with solar installations. Spain accounted for 2,766, approximately 35% of the total number of identified solar systems. The researchers also noted that around 181 facilities had systems that could potentially allow extensive operational control.

These figures require careful interpretation: the research counted exposed systems, not confirmed cyberattacks. Nor does it mean that all of them could be used to control a facility or that all had been compromised. However, it demonstrates that the exposure of management interfaces is a tangible risk to energy infrastructure.

The conclusion is relevant for operators: an asset may be physically protected while remaining accessible through a misconfigured or inadequately protected digital interface.

In an increasingly distributed energy system, knowing which devices are connected, which services they expose, and who can administer them is a basic security requirement.

Remote access: an operational necessity and a potential entry point

Equipment maintenance, incident resolution, and facility administration make remote access necessary for many energy operators.

The risk arises when such access enables broader connectivity than necessary, relies on inadequately protected devices, or fails to sufficiently restrict the actions each user can perform.

In OT (Operational Technology) environments, the potential consequences go beyond the loss of information. The systems involved may monitor or control physical processes and must meet specific availability, integrity, and operational safety requirements.

Protection therefore cannot be limited to correctly authenticating the user. It must also control the device they are working from, the resources they can access, and the operations they are authorised to perform.

Valid credentials should not become a means of unrestricted access to critical infrastructure.

How to reduce the exposure of critical assets

Protecting energy infrastructure requires a combination of measures: asset inventory, network segmentation, identity and privilege management, strong authentication, monitoring, and response and recovery procedures.

But there is an additional question: is it necessary to connect the user’s device directly to the asset they need to administer?

Isolation-based architectures offer a different model. Instead of establishing direct connectivity between the workstation and the protected system, they enable controlled interaction that limits access to authorised resources and functions.

This approach can reduce the asset’s exposure to a compromised device, hinder certain avenues of propagation, and improve control over privileged sessions.

Its implementation must reflect the characteristics of each facility, including latency, compatibility, availability, and operational safety requirements. Isolation does not replace segmentation, threat detection, or OT-specific controls; it complements them.

The objective is to reduce risk even when one of the preventive barriers fails.

Continuity of supply starts before an incident

Cyber resilience is not merely about preventing attacks. It is about limiting their consequences and maintaining or restoring operations within defined objectives.

The International Energy Agency warns that a successful cyberattack on electricity systems can cause loss of control over devices and processes, physical damage, and service disruptions.

Security managers must therefore work alongside operations teams to identify the assets whose unavailability would have the greatest consequences, assess their dependencies, and verify that contingency and recovery procedures work.

Regulation is also part of this responsibility. NIS2 establishes a European framework for risk management and incident reporting for entities within its scope, including the energy sector. Its specific application must be assessed in accordance with the applicable legal framework and each organisation’s circumstances.

Meeting regulatory requirements is necessary where they apply, but compliance alone does not guarantee operational continuity.

Cosmikal: protecting access to protect operations

At Cosmikal, we design and develop cybersecurity solutions aimed at protecting IT and OT assets through access control and the isolation of workstations from protected systems.

In the energy sector, where availability and control are essential, reducing unnecessary connectivity, governing privileges, and maintaining session traceability help strengthen the protection of critical assets.

The question is not only who can access a facility. It is also what they can reach, what they can do, and how their ability to act is limited if their credentials or device are compromised.

Continuity of supply does not depend solely on protecting physical infrastructure. It also requires controlling the digital connections used to operate it.

Preguntas frecuentes sobre ciberseguridad en el sector energético

¿Cuáles son los principales riesgos de ciberseguridad en el sector energético?

Entre los riesgos relevantes se encuentran los accesos remotos expuestos, las credenciales comprometidas, los privilegios excesivos, los sistemas heredados y las conexiones insuficientemente controladas entre entornos IT y OT. Su impacto potencial depende de los activos afectados y de su función en la operación.

¿Por qué es importante proteger los accesos remotos a sistemas OT?

Porque permiten administrar sistemas que pueden intervenir en procesos físicos. Si un acceso se compromete, un atacante podría intentar alcanzar recursos adicionales o realizar acciones no autorizadas. La autenticación debe complementarse con restricciones de conectividad, privilegios y alcance de las sesiones.

¿Cómo contribuye el aislamiento a la seguridad de una infraestructura energética?

El aislamiento separa el dispositivo del usuario del activo protegido y restringe la interacción a las funciones autorizadas. Puede reducir la exposición frente a amenazas originadas en el puesto de trabajo, aunque debe integrarse con otros controles técnicos y operativos.

¿Qué relación existe entre ciberseguridad y continuidad del suministro?

La ciberseguridad ayuda a prevenir incidentes y limitar su impacto sobre los sistemas que sostienen la operación. La continuidad requiere, además, planes de contingencia, recuperación probada, coordinación entre equipos y medidas adecuadas a la criticidad de cada instalación.

¿Qué deberían revisar los operadores de parques solares y eólicos?

Deberían comprobar el inventario de sistemas conectados, la exposición de interfaces administrativas, los accesos de proveedores, los privilegios, la segmentación de redes y la monitorización de los activos críticos. También es importante revisar las dependencias de los servicios externos y validar los procedimientos de respuesta y recuperación.

Fuentes

• Modat, investigación del 6 de octubre de 2026: To See the Wind and the Sun.
• Comisión Europea, septiembre de 2026: Documentación sobre ciberseguridad de infraestructuras críticas.
• Agencia Internacional de la Energía: Enhancing Cyber Resilience in Electricity Systems.
• Unión Europea: Directiva NIS2. Referencia jurídica para el marco europeo de gestión de riesgos y notificación de incidentes.