The report, titled Gridlock: what a coordinated battery attack would cost the grid, states that compromising as little as 29% of UK battery storage capacity could trigger a cascading blackout affecting 67 million people. A single major incident could result in £2bn to £10bn in direct economic losses.

Centrii conducted 10,000 risk analysis simulations across low, moderate and aggressive security capabilities. The analysis showed that moderate security measures reduce attack probability to 78%, while mandatory certifications and regular attack-readiness drills lower it to 61%.

Centrii Co-Founder and CEO Rafael Narezzi explains: ‘A coordinated attack does not need to stop generation to cause a blackout. It only needs to desynchronise the balancing layer, forcing batteries to charge or discharge together, or delaying how they respond to grid signals. Neither action damages a battery. The effect is closer to a distributed denial-of-service attack than a conventional outage – instead of overwhelming a website with traffic, it overwhelms the grid’s ability to stay in balance, using energy itself as the disruptive force. The modelled result is a cascading blackout that unfolds in under two minutes.’

Narezzi added: ‘Every board I speak to already accepts that cyber risk exists. What they haven’t had is a definitive assessment that helps them to reach the right figure. Security spending in operational technology is rarely treated as return-generating, because its value shows up in an event that does not happen. This modelling makes that value visible and measurable. Based on these figures, protecting battery storage is one of the highest-return decisions available anywhere in the business, but it’s also one of the least discussed at board level.’

DNV framework addresses energy infrastructure threats

Government projections of battery storage installed volumes cited by trade association RenewableUK target 23GW to 27GW of battery storage by 2030, up from roughly 4.5GW in 2024. However, less than half of 1,000 senior energy professionals work in organisations with a defined or updated resilience strategy, according to a recent DNV industry insights survey.

At the Offshore Northern Seas conference in Norway, DNV urged the energy industry to treat infrastructure resilience as a higher priority. In its report From concern to control, it explains how failures in one area can disrupt value chains, affecting supply and wholesale pricing. Instead, the authors outline a four-step process: analyse risks, prioritise investments, implement measures, and validate across organisational, personnel, physical asset, IT, cyber and supply chain dimensions.  

DNV Energy Systems CEO Ditlev Engel said: ‘As a sector, we must treat resilience as fundamental to everyday operations. Quite simply, it is a strategic and societal necessity, as it protects our ability to provide energy that is reliable, affordable and sustainable. Without integrating security into core investment planning, organisations run the risk of suffering attacks that could impact the grid and other vital infrastructure and disrupt economic and societal stability.’

Engel continued: ‘What we want to do is turn vulnerabilities into areas in which companies can have real confidence. Whether it is the public or private sectors, resilience must be embedded in every step of the energy value chain, or we risk accidents or attacks that could have serious consequences.’

DNV Defence and Security Manager for Northern Europe, Derek Riezebos, added: ‘Risk and threats are constants in the energy sector and few organisations can have complete visibility of their vulnerabilities. But understanding critical dependencies, reducing single points of failure and maintaining response, restart and recovery plans can help organisations move from concern to control.’

Riezebos continued: ‘Recent prolonged blackouts have demonstrated the cascading impact on transport, communications, hospitals and other critical services. Around the world, businesses and governments have a responsibility to ensure that energy systems are resilient and prepared for the worst. Threats to infrastructure are evolving faster than many organisations can adapt, making it increasingly important to ensure safeguards are at a sufficient standard to limit their impact.’

The report provides examples of attacks on infrastructure, including opportunistic cyberattacks, damage to gas pipelines, and LNG terminals and tankers targeted by weapons. Evolving policy and extreme weather events have also indirectly affected the reliability of energy systems.