Industry analysis shows 92% probability of a major attack on UK battery energy storage in next five years at a cost of up to £10bn

Centrii, which helps energy operators, infrastructure owners and asset managers translate technical risk into financial and operational impact, today published ‘GRIDLOCK', a risk assessment analysis of cyber-physical exposure in battery energy storage systems (BESS).

Using a Monte Carlo risk analysis methodology of 10,000 simulations across three industry security postures – baseline, moderate and aggressive – the GRIDLOCK: What a Coordinated Battery Attack Would Cost the Grid report quantifies the probability and financial cost of a coordinated attack on BESS between now and 2031.

According to the findings, under industry-average security practices, there is a 92% probability of a major attack on battery storage infrastructure within the next five years. This falls as security investment and enhancements increase. Under voluntary improvement adopted gradually and unevenly across the sector, it falls to 78%, while adopting mandatory IEC 62443 certification and regular attack-readiness drills sees the probability fall to 61%.

The earliest likely attack window also changes as a result, from 2027–28 under the baseline posture to 2029–31 under the most rigorous one. Based on these figures, security investment not only reduces risk, but it also buys time.

Cost of an attack: UK vs. US

In the UK, the effects of an attack are more concentrated than in the US. The modelling finds that compromising 29% of national capacity (around 400 units) could be sufficient to trigger a nationwide outage affecting 67 million people, effectively the entire population. A single major attack is estimated to cost between £2bn and £10bn in financial damage.

Bringing UK battery storage infrastructure up to IEC 62443 Security Level 2 – the standard the modelling shows meaningfully reduces attack probability – is estimated to cost between £400m and £1bn across the national fleet. That is a return on proactive security investment of roughly 5x to 25x.

The research also models a coordinated cyberattack in the US on the battery fleet supporting the grid in Texas, resulting in an estimated $12 to $65 billion in economic damage. By comparison, bringing the ERCOT battery fleet to IEC 62443 Security Level 2 is estimated to cost between $800 million and $2.8 billion. Compromising 5.4% of the ERCOT battery fleet, around 1,500 units, could be enough to destabilise the Texas grid, potentially affecting 30m people.

Rafael Narezzi, Co-Founder and CEO of Centrii, explains the importance: “A coordinated attack does not need to stop generation to cause a blackout. It only needs to desynchronise the balancing layer, forcing batteries to charge or discharge together, or delaying how they respond to grid signals. Neither action damages a battery. The effect is closer to a distributed denial-of-service attack than a conventional outage – instead of overwhelming a website with traffic, it overwhelms the grid's ability to stay in balance, using energy itself as the disruptive force. The modelled result is a cascading blackout that unfolds in under two minutes.”

He adds: “Every board I speak to already accepts that cyber risk exists. What they haven’t had is a definitive assessment that helps them to reach the right figure. Security spending in operational technology is rarely treated as return-generating, because its value shows up in an event that does not happen. This modelling makes that value visible and measurable. Based on these figures, protecting battery storage is one of the highest-return decisions available anywhere in the business, but it’s also one of the least discussed at board level.”

Risks to grid-balancing infrastructure

The demand for battery storage, which helps balance grids, stores excess wind or solar energy and provides backup electricity during peak demand, is set to rise. According to RenewableUK, the UK Government has estimated that between 23GW and 27GW of battery storage will be required by 2030, a significant increase from approximately 4.5GW in 2024.

While the balancing function in modern battery fleets, often managed remotely through cloud-based platforms, makes them efficient to run at scale, it also exposes them to attacks, according to the Centrii report.

Recent high-profile events in Europe demonstrate how disruptions to grid-balancing infrastructure can escalate quickly. Both illustrate the underlying risks examined by GRIDLOCK that relatively concentrated disruptions to generation or balancing infrastructure can have consequences across a much larger grid:

- In December 2025, state-sponsored actors were reported to have attempted to destabilise regional grid infrastructure in Poland by rapidly cycling wind turbine output rather than damaging equipment.
- In April 2025, the Iberian grid collapsed after 2.5GW of generation was lost in under 20 seconds, leaving parts of Spain and Portugal without power for roughly 10 hours and some areas for longer. Authorities attributed the Iberian outage to technical causes, not a cyberattack.

What is GRIDLOCK?
GRIDLOCK is a public-facing summary of a peer-reviewed Monte Carlo risk assessment run 10,000 times for each of three security postures, drawing each variable from a plausible range rather than a single assumption. It accounts for projected attacker capability growth, battery deployment growth, and realistic compromise rates across cloud, remote-access and supply chain attack paths. All figures are modelled, not observed.
The underlying attack mechanism is independently validated in 'From Balance to Breach: Cyber Threats to Battery Energy Storage Systems', published in Energy Informatics, March 2025 (arXiv:2501.05923).

About Centrii
Centrii (formerly Cyber Energia) helps energy operators and infrastructure owners assess, quantify and act on cyber and operational risk across critical energy environments. Founded in 2022, the company delivers purpose-built solutions for energy assets, including wind, solar, storage, gas turbines and hybrid systems.

Its SaaS platform, Centrii Portal, provides real-time visibility into OT environments, continuous monitoring, risk assessment, and compliance management. The platform aggregates cyber, operational, and generation data to help organisations understand where financial exposure exists across their portfolios — translating technical alerts, vulnerabilities, and operational anomalies into business-relevant insight.

Centrii also supports organisations navigating evolving regulatory and resiliency requirements tied to frameworks such as NERC CIP and NIS2, while helping them to better understand operational resilience, portfolio maturity, and cyber-related financial exposure.

Centrii is headquartered in Houston, TX and London, UK. Learn more at https://centrii.com/

Media contact:
Data and images are available upon request from the Centrii PR team at Origin Comms: centrii@origincomms.com.