Cybersecurity in the Solar Energy Sector: From a Side Issue to a Top Priority

The energy transition is in full swing. Solar energy is no longer a niche market but forms the heart of an increasingly smart and complex energy system. As a leading partner in the construction, monitoring, and maintenance of solar parks, and as an installer of EMS and BESS systems in Belgium, the Netherlands, and France, Solora is strongly committed to innovation and digitalization. But that digitalization also brings with it a significant responsibility: cybersecurity.

In this blog, we take an in-depth look at the risks, trends, and best practices at the intersection of solar energy and digital security. Because anyone who still thinks today that cybersecurity is a concern only for banks or governments will be left behind tomorrow.

1. The Digitalization of Solar Parks: A Blessing and a Concern

Whereas PV systems used to operate largely as stand-alone units, today they are fully integrated with digital tools: from smart inverters and data loggers to cloud-based EMS platforms and integrated battery energy storage systems (BESS). This connectivity offers enormous benefits: better monitoring, smarter control, and more efficient maintenance. But at the same time, it opens the door to unwanted intruders.

Cybersecurity firm Forescout released an alarming report: more than 35,000 PV devices worldwide were identified as having serious vulnerabilities. Most of them were directly accessible via the internet, without proper security. In some cases, not even a password had been set.

What makes PV systems so vulnerable?

• Outdated firmware on inverters and gateways

• Hard-coded passwords or default logins that were never changed

• No or limited network segmentation between devices

• Unencrypted communication between devices and the cloud

• Remote access without multi-factor authentication

The consequences of a cyberattack on a solar farm are not merely financial. In the worst-case scenario, an attacker could use the inverters or EMS to manipulate power feed-in behavior, overload batteries, or shut down the entire system—potentially impacting the grid or even safety.

2. BESS and EMS: Vulnerable Critical Infrastructure

In addition to solar panels, Solora also installs large-scale battery energy storage systems (BESS) and energy management systems (EMS). These systems are also connected, communicate with grid operators, and receive updates via the cloud. Precisely for this reason, they are a prime target for cybercriminals.

Why are BESS and EMS particularly vulnerable?

• BESS systems contain high levels of energy and, if sabotaged, can overheat or discharge.

• EMS platforms coordinate the behavior of an entire site: a single attack can affect multiple systems simultaneously.

• Many EMSs use open APIs or cloud portals that lack adequate security.

• BESS suppliers are often based in Asian regions, where transparency regarding cybersecurity policies is lacking.

According to Energy Storage News, the risk of “command & control” attacks on BESS installations is real: attackers can issue remote commands that cause physical damage or paralyze the entire system.

3. European Policy and Legislation

Fortunately, awareness is also growing among policymakers. The EU has recently introduced stricter regulations for digital security in critical infrastructure:

• The NIS2 Directive (effective as of 2024) requires, among other things, energy companies and their suppliers to conduct risk assessments, report incidents, and implement adequate technical and organizational measures.

• The Cyber Resilience Act requires manufacturers of smart devices (such as inverters and data loggers) to design and maintain their products securely.

• The Network Code for Cybersecurity is being developed to harmonize and secure digital networks in the energy sector.

Industry organizations such as SolarPower Europe and the European Solar Manufacturing Council (ESMC) are also advocating for an “Inverter Security Toolbox”—a type of technical guideline setting out minimum security requirements for solar installations.

4. ISO 27001 and NIS2: Our Structured Approach to Cybersecurity

At Solora, we have made a conscious decision to address cybersecurity not reactively, but structurally and proactively. That is why we are currently in the final phase of our journey toward ISO 27001 certification, the international standard for information security. At the same time, we are actively preparing for NIS2 compliance, even though we are not legally required to do so.

Why? Because we work on critical energy infrastructure, and because our customers—active in industry, logistics, food, and pharmaceuticals—rightly expect their energy partner to handle digital risks just as professionally as physical security.

Within the ISO 27001 framework, we are developing an Information Security Management System (ISMS) that covers the following areas, among others:

• Risk management and business continuity planning for all assets, from inverters to EMS and BESS systems.

• Supplier screening, in which we also factor the origin of hardware (such as Chinese components) into our risk assessment.

• Access control and logging, including segmentation, MFA, and centralized log management.

• Patch management and secure firmware updates.

• Incident response and awareness, with clear procedures and training for our technical teams.

In addition, we are also preparing internally for the NIS2 guidelines. Among other things, these guidelines impose requirements regarding incident reporting, risk management, supply chain security, and governance at the board level. Although Solora is not legally subject to the directive, we are consciously making a significant investment in it—out of the conviction that digital security is a fundamental building block of our reliability as a partner in the energy transition.

Conclusion: Cybersecurity is not an option; it is a prerequisite

For Solora, cybersecurity is not an extra, but a fundamental part of our service offering. A solar park that isn’t secure is simply not complete. Especially now that we’re evolving toward decentralized energy systems with storage, cloud-based control, and cross-border connectivity, security is not only a technical issue but also a strategic one.

The future of solar energy is digital. Let’s make sure it’s secure, too.