Behind every modern solar or battery storage project sits a growing stack of digital infrastructure. Inverters, battery management systems, energy management systems, SCADA platforms, remote monitoring tools, aggregators and market interfaces all shape how efficiently and profitably the plant operates.
This digitalisation also changes the nature of project risk. A solar plant or BESS can be physically intact and technically capable of operating, yet still unable to perform its intended function because communication, software, remote access or an external digital service is unavailable. Cyber risk has moved into the operational and financial risk profile of the asset, and now matters to asset owners, investors, lenders and insurers, not just IT teams. The more digital systems are embedded in normal operation, the more important it becomes to understand how they are protected and what happens when they fail.
An asset does not have to be damaged to stop creating value
Consider a co-located solar and battery storage project. The solar modules are undamaged, the battery cells are healthy and the inverters and power conversion systems show no physical defects. Even so, part of the project may have to be taken offline because an unauthorised party has gained access through a compromised service provider account and changed settings in the control environment.
Until the incident has been investigated, operators need to establish exactly what has changed and whether the affected system can safely return to normal operation. During that period, the equipment itself may remain physically intact while the economic function of the asset is disrupted. A BESS may be temporarily unable to participate in energy markets or provide flexibility services. Where the solar and storage systems share control infrastructure or remote-access pathways, parts of the wider energy park may also have to run under restrictions while the integrity of the control environment is verified.
Harry Wolkenfelt: the hidden risks of BESS value stacking
This creates a different loss scenario from the physical risks the renewable energy sector is more used to. Fire, storm, hail and equipment failure usually leave visible evidence and can often be traced directly to damaged components. A cyber incident may leave no visible damage at all while still causing operational disruption and financial loss. That distinction matters more as renewable energy assets rely more heavily on digital control.
Digitalisation changes the way an asset operates
A modern solar or battery project is more than a collection of electrical components. Digital systems increasingly determine how the asset is monitored, controlled, optimised and connected to external markets. Inverters can be configured remotely. Depending on the system architecture, a BESS may rely on coordinated interaction between the battery management system, power conversion system, energy management system, site controller and external control platforms. Commercial operation may also depend on aggregators, optimisation software or market platforms that sit outside the physical boundary of the project.
These systems create considerable value. They allow assets to respond to electricity prices, grid conditions, production forecasts and market signals. They make remote diagnostics possible and enable increasingly sophisticated operating strategies. They also open new interfaces through which the performance of the asset can be affected, which puts the resilience of the digital environment on a par with the reliability of the physical equipment. The relevant question is therefore no longer only whether the physical equipment is reliable. It is also whether the digital environment around that equipment is sufficiently resilient.
That requires an understanding of who can access the asset remotely, which systems are essential for normal operation, which functions can continue locally if external communications are lost and who is responsible for software updates, configuration changes and access rights. It also requires clarity about which external platforms are needed for the project to generate the revenues assumed in its business case. In practice, remote access has to be controlled, changes logged and monitored, and access rights amended or removed when suppliers, service providers or personnel change. These questions now sit inside technical, operational and investment due diligence, alongside the IT work they have always involved.
The risk may sit outside the project
One of the more difficult characteristics of cyber risk is that the source of disruption does not necessarily sit within the asset itself. Solar and battery projects increasingly depend on manufacturers, O&M providers, software vendors, monitoring platforms, aggregators and other external service providers. A project owner can invest heavily in protecting its own systems and still remain exposed to weaknesses elsewhere in the digital chain.
A BESS participating in energy markets through an aggregator is a good example. The battery may remain technically available and its local control systems may continue to operate normally. If the digital platform the aggregator uses to dispatch that BESS into certain markets becomes unavailable following a cyber incident, some commercial services may not be delivered for a period. In that situation, there is nothing physically wrong with the battery. The digital connection between the asset and the commercial function it is expected to perform is what has failed.
Harry Wolkenfelt: Insurability is built, not bought
This distinction matters because the economic value of a modern energy asset rests on the continued availability of the digital services around it as much as on physical availability. As projects become more sophisticated and more dependent on external platforms, third-party dependency becomes part of the project risk profile.
Technical availability does not guarantee service availability
Battery storage makes this particularly visible because a single BESS may generate value from several applications, including energy trading, flexibility services, peak management, solar optimisation and grid management. Many of those functions rely on communication, software and external control. A battery can therefore be technically capable of charging and discharging while unable, for a period, to provide the market or operational service it was intended for.
This creates an important distinction between technical availability and service availability. Traditionally, asset availability has largely been understood as a question of whether equipment is technically capable of operating. In a highly digital energy asset, the ability to deliver a particular service also turns on whether the systems needed to control, optimise or dispatch that equipment are working correctly. The financial consequences can therefore extend well beyond the cost of repairing hardware. When an asset cannot perform the function its business case rests on, revenues may be lost even though there is no physical damage to repair. Digital dependency becomes financial exposure.
Cyber risk can also become physical risk
Cyber risk should not be treated only as a business interruption issue. Digital systems increasingly influence the physical operation of renewable energy assets, particularly in battery storage. Control systems are involved in charging and discharging, power management, temperature monitoring, battery supervision and protection. Unauthorised changes to settings, control logic or operating parameters can contribute to unsafe operating conditions.
That does not mean a cyber attacker can cause a battery fire by changing a single setting. Well-designed BESS installations incorporate multiple layers of protection to prevent abnormal operating conditions from escalating into a serious physical event. Depending on the architecture, some safety functions should also remain effective if higher-level control or external communications are lost.
The boundary between cyber risk and technical risk is becoming less distinct. When software and digital controls influence the behaviour of physical equipment, cybersecurity is also part of technical safety and operational reliability. For project owners, insurers and investors, that means cyber risk cannot be assessed separately from the engineering environment the digital systems operate in.
Insurance becomes more complicated
The same shift creates challenges for insurance. Traditional property and business interruption insurance has generally developed around a familiar sequence in which physical damage occurs first and financial loss follows. Cyber incidents can break that sequence, because an asset may become unavailable and lose revenue with no physical damage having occurred.
Depending on the policy wording, cyber insurance may provide cover for certain forms of business interruption following a covered cyber event without physical damage being required. This is known as non-damage business interruption. The situation becomes more complex when a cyber incident causes physical damage, when the disruption originates from an external digital service provider or when the asset remains technically operational but can no longer deliver a contracted service or participate in a particular market.
Risk management, not insurance, will decide the future of solar and BESS
These are materially different loss scenarios and they may be treated differently under cyber, property, engineering and business interruption policies. Holding both a cyber policy and a technical all-risks policy therefore does not automatically mean the full exposure has been addressed. The real question is whether the different covers respond coherently to the actual operational and digital dependencies of the project. This matters particularly where significant revenue streams rely on external platforms or remote digital control.
Insurance cannot solve digital dependency
Insurance remains an important part of the overall risk strategy, but it cannot replace cybersecurity, resilient system architecture, access management, operational continuity or incident response. Not every digital or commercial loss can be transferred to an insurer either. The first task for asset owners and investors is to understand the dependency itself. They need to know which digital systems are critical, which functions can continue if those systems become unavailable, how quickly control can be restored and which third parties are essential to normal operation.
With those dependencies in view, the project can decide which risks should be reduced technically, which require organisational controls, which financial consequences may be insurable and which exposures ultimately need to remain with the project. Insurance can transfer defined financial consequences, but it cannot remove an operational dependency that has not been properly understood or managed.
Cybersecurity is becoming a bankability issue
For lenders and investors, the consequences extend beyond cybersecurity. A project is financed on the expectation that it will generate cash flows over many years. Those cash flows rest on the asset being available and able to perform the functions the business case is built on. As those functions become more digitally controlled, cyber resilience shapes the reliability of future cash flows. A project with poorly controlled remote access, unclear responsibility for software management, heavy reliance on a single external platform or inadequate incident response arrangements introduces additional uncertainty into the operational risk profile.
This does not mean every digital vulnerability threatens project finance or that every asset requires the same level of cybersecurity. The level of risk will turn on the architecture of the project, the functions it performs and the consequences of losing those functions. It does mean that digital dependency belongs in the same risk discussion as equipment reliability, maintenance, fire safety, availability and business continuity. For investors, lenders and insurers, uncertainty around those dependencies can shape how the project is ultimately assessed.
De-risking the digital asset
De-risking now includes cybersecurity. De-risking does not mean trying to prevent every possible cyber incident. No connected energy asset can be completely free of digital risk. It means identifying critical dependencies early, understanding how a digital failure could turn into operational or financial loss and taking measures to keep those risks demonstrably manageable throughout the lifecycle of the project.
A bankable battery needs a digital exit strategy
That requires looking beyond firewalls and passwords. Remote access, third-party dependencies, system architecture, fallback behaviour, software and configuration management, incident response, business continuity and the interaction between cyber and technical insurance all form part of the wider risk picture. The renewable energy sector has spent years improving its understanding of how component quality, installation, inspections and maintenance shape long-term project performance. As solar and battery projects become more digitally integrated, the same discipline will need to be applied to their digital infrastructure.
Because an energy asset does not have to be physically damaged to stop creating value. The equipment may still be working while the project cannot perform as intended. (Harry Wolkenfelt/hcn)
