How should renewable energy companies protect themselves from cyber attacks?

Why are renewable energy companies targeted?

Most attacks on smaller renewables businesses aren't sophisticated. They're the same phishing and invoice fraud every business faces: 43% of UK businesses reported a breach or attack in the last 12 months, and phishing was the most common, at 38% (DSIT, April 2026). What makes renewables firms attractive is what they hold and who they work for: grid applications, site designs, landowner agreements, investor models and supplier bank details, and a place in the supply chain of larger developers and utilities.

What supply chain requirements should you expect?

Larger developers, utilities and public bodies increasingly ask suppliers and subcontractors about cyber security in pre-qualification questionnaires. The most common baseline is Cyber Essentials. Under PPN 014 (which replaced PPN 09/23 in February 2025), it's required for central government contracts that involve personal data or OFFICIAL information.

Cyber Essentials covers five controls: firewalls, secure configuration, user access control, malware protection and software updates. Only 5% of UK businesses hold it (DSIT, April 2026), although 61,430 certificates were issued in the year to June 2026, a record. The NCSC reports certified organisations are 92% less likely to claim on their cyber insurance.

How do you keep business IT separate from site systems?

Inverters, battery management systems and site monitoring are operational technology (OT). They're usually specified and supported by the equipment provider or grid operator, not by your IT provider. But they meet your business IT in two places: the network, and the people who log in.

In January 2026 the NCSC and international partners published eight principles for connecting operational technology securely. For a smaller solar or battery business, the practical points are:

• Limit exposure. Site equipment shouldn't be reachable from the internet unless it has to be, and only through the equipment provider's secure route.
• Keep networks separate. Office laptops, guest WiFi and site cameras don't share a network with control equipment.
• Control remote access. Know which third parties can connect to site systems, how, and remove access when contracts end.
• Log and monitor. Record who connects and when.
• Plan to isolate. Know how to disconnect a site quickly if something goes wrong.

The people side is where business IT matters most. Staff often reach cloud monitoring portals from ordinary laptops and phones, sometimes with one shared login. Give every person their own account, turn on multi-factor authentication wherever the portal supports it, and make sure the devices they use are managed and up to date.

The layers of protection every renewables business needs

• Identity: multi-factor authentication (a second check when people sign in) for every user. Only 47% of UK businesses use it (DSIT, April 2026).
• Devices: every laptop, tablet and phone encrypted, updated, centrally managed and protected against viruses and ransomware (endpoint protection).
• Email: filtering against phishing and impersonation. Confirm any change of bank details by phone.
• Data: project files stored centrally, backed up and tested.
• Monitoring: ideally a dedicated security team watching your systems 24/7 (a security operations centre).
• People: regular awareness training on phishing and invoice fraud.