Energy firms must bolster grid resilience against AI-driven cyber threats
European agencies warn that artificial intelligence and connected devices are increasing cyber risks to energy infrastructure, requiring new defensive strategies.
Key points
- ENISA and partners highlight growing threats from AI and operational technology intrusions to European energy grids.
- Attacks on Poland’s energy sector disrupted communications between facilities and distribution operators in late 2025.
- Ukraine’s grid operator uses AI to accelerate incident response while keeping critical decisions under human control.
European energy providers face an urgent need to strengthen their defenses against sophisticated cyber threats, according to a joint warning from ENISA, E.DSO, EE-ISAC, and ENCS. These agencies argue that current regulations are insufficient to handle risks created by artificial intelligence and the rapid expansion of connected energy technologies.
Experts gathered at the 9th Cybersecurity Forum in Brussels emphasized that the gap between evolving threats and practical response capabilities is widening. They noted that geopolitical tensions continue to drive malicious activity, with attackers increasingly incorporating AI tools into their operations. This shift requires energy sector organizations to move beyond compliance checklists and focus on genuine operational resilience.
In plain English
The core issue is that energy grids are becoming more connected and complex, which creates new entry points for attackers. Operational technology, which controls physical equipment, is seeing more intrusion attempts. Recent real-world events demonstrate these vulnerabilities. In December 2025, coordinated cyberattacks targeted Poland’s energy sector, affecting numerous wind and solar farms as well as a combined heat and power plant.
Although electricity generation continued without interruption, the attacks severed communications between the affected facilities and the distribution system operators. This loss of connectivity gave attackers a level of access that could have enabled further disruption, highlighting the fragility of current communication channels.
The background
Ukraine’s national electricity transmission system operator, NPC Ukrenergo, is sharing lessons from operating a grid under sustained attack. Their experience shows how organizations can maintain stability while facing continuous threats. They are using artificial intelligence to help cybersecurity teams react faster and identify security gaps. The AI tools also support staff with reporting tasks, but critical decisions remain in the hands of human operators. This approach addresses a significant challenge in the sector: the difficulty of maintaining specialist cybersecurity expertise when skilled teams are hard to rebuild through traditional recruitment efforts.
What changes now
The expansion of connected energy technologies presents a distinct challenge that differs from traditional IT security issues. ENISA’s Threat Landscape 2026 report analyzed 8,257 cyber incidents affecting EU member states and organizations during 2025. The data confirms that OT-related intrusion claims are increasing. The Brussels forum used live demonstrations of risks affecting connected energy devices to illustrate these dangers. Industry leaders are now examining what greater grid cyber resilience requires in practice, moving from theoretical frameworks to actionable strategies. The focus is on closing the gap between threat evolution and the sector’s ability to respond effectively.
What to do and how to stay safe: ENISA
- Review current communication protocols between operational technology facilities and distribution system operators to ensure redundancy.
- Evaluate how artificial intelligence tools can support cybersecurity teams in identifying gaps without removing human oversight for critical decisions.
- Assess the security posture of newly connected energy devices and technologies for potential intrusion vectors.
- Develop retention strategies for specialist cybersecurity staff to maintain expertise during periods of sustained threat activity.
Step-by-step guide: Stop AI Chatbots Leaking Sensitive Business Data
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the attacks on Poland disrupt electricity generation?
No, electricity generation was not disrupted, but communications between affected facilities and distribution system operators were lost.
How is Ukraine’s grid operator using AI?
NPC Ukrenergo uses AI to help teams react faster, identify gaps, support staff, and assist with reporting while keeping critical decisions human-led.
How many cyber incidents did ENISA analyze in 2025?
ENISA analyzed 8,257 cyber incidents affecting EU Member States and EU-based organizations during 2025.
