Summary: Thousands of energy control systems in Europe can be reached from the internet. Network fixes help, but the stronger fix is in device design: devices that only connect out to the cloud, with no inbound admin access, unique credentials and signed updates.
What researchers found
A study by Modat and the Dutch National Cyber Security Centre, presented on 6 October 2026, found 8,547 control systems at European solar and wind parks that can be reached from the internet, across 40 countries. Solar made up 7,942 of them. At about 181 sites, the researchers say an attacker could have taken full control.
Some login pages named the park they protected. One turbine page showed Start and Stop buttons.
Why network advice is not enough
The usual advice is to fix the network: firewalls, VPNs, segmentation. All of it is correct. But most of these devices were built to be reached from outside, and sooner or later someone opens the port, often to make remote support easier.
Operators can’t always secure every site network. Manufacturers can make it matter less.
Design the device so there is nothing to open
For connected energy devices, we use a simple security model from day one:
- Outbound only toward the internet. The device connects out to its cloud. Nothing on the internet can open a connection to it.
- Local access stays local. A local web page or API is fine, but only on the local network: no port forwarding, no UPnP, no default passwords, and a unique credential per device from the factory.
- Remote control through the cloud. Remote actions go through the cloud, with user accounts, permissions and a log of who did what.
- Signed updates. A security fix reaches every site through signed over-the-air updates, without anyone driving there.
Regulation points the same way
The EU Cyber Resilience Act will require connected products to ship without known exploitable vulnerabilities, with secure defaults and a way to deliver security updates. The design choices above are the practical way to meet those requirements for energy devices.
How we can help
We design connected devices for energy and industry with this security model from the start: secure boot, unique device identity from the factory, outbound-only connectivity and signed OTA. To discuss your device, talk to an engineer.
Source: pv magazine report on the study.
