Centrii has published GridLock, a risk assessment analysis of cyber-physical exposure in battery energy storage systems (BESS)
Using a Monte Carlo risk analysis methodology of 10,000 simulations across three industry security postures, baseline, moderate, and aggressive, the ‘GridLock: what a coordinated battery attack would cost the grid’ report quantifies the probability and financial cost of a coordinated attack on BESS between now and 2031.
According to the report, under industry-average security practices, there is a 92% probability of a major attack on battery storage infrastructure in the next five years. This falls as security investment and enhancements increase. Under voluntary improvement adopted gradually and unevenly across the sector, it drops to 78%, while adopting IEC 62443 certification and regular attack-readiness drills reduces the probability to 61%.
The earliest likely attack window also shifts, from 2027-28 under the baseline posture to 2029-31 under the most rigorous one. Based on these figures, security investment reduces risk and buys time.
Cost of an attack: UK vs. US
In the UK, the effects of an attack are more concentrated than in the US. The modelling finds that compromising 29% of national capacity could be sufficient to trigger a nationwide outage affecting 67 million people, effectively the entire population. A single major attack could cost between £2bn and £10bn in financial damage.
Bringing UK battery storage infrastructure up to IEC 62443 Security Level 2, the standard the modelling shows reduces attack probability, is estimated to cost between £400m and £1bn across the national fleet, representing a return on investment of 5x to 25x.
The research also models a coordinated cyberattack in the US on the battery fleet supporting the grid in Texas, resulting in an estimated $12 to $65 billion in economic damage. By comparison, bringing the ERCOT battery fleet to IEC 62443 Security Level 2 is estimated to cost between $800 million and $2.8 billion. Compromising 5.4% of the ERCOT battery fleet, around 1,500 units, could be enough to destabilise the Texas grid, potentially affecting 30 million people.
Rafael Narezzi, co-Founder and CEO of Centrii, said, “A coordinated attack does not need to stop generation to cause a blackout. It only needs to desynchronise the balancing layer, forcing batteries to charge or discharge together, or delaying how they respond to grid signals. Neither action damages a battery. The effect is closer to a distributed denial-of-service attack than a conventional outage – instead of overwhelming a website with traffic, it overwhelms the grid’s ability to stay in balance, using energy itself as the disruptive force. The modelled result is a cascading blackout that unfolds in under two minutes.”
He added, “Every board I speak to already accepts that cyber risk exists. What they haven’t had is a definitive assessment that helps them to reach the right figure. Security spending in operational technology is rarely treated as return-generating, because its value shows up in an event that does not happen. This modelling makes that value visible and measurable. Based on these figures, protecting battery storage is one of the highest-return decisions available anywhere in the business, but it’s also one of the least discussed at board level.”
Risks to grid-balancing infrastructure
Demand for battery storage, which helps balance grids, store excess wind or solar energy, and provide backup electricity during peak demand, is set to rise. According to RenewableUK, the UK Government has estimated that between 23GW and 27GW of battery storage will be required by 2030, an increase from 4.5GW in 2024.
While the balancing function in modern battery fleets, often remotely managed through cloud-based platforms, makes them efficient to run at scale, it also exposes them to attacks, according to the Centrii report.
Recent events in Europe demonstrate how disruptions to grid-balancing infrastructure can escalate quickly. Both illustrate the underlying risks examined by GridLock that relatively concentrated disruptions to generation or balancing infrastructure can have consequences across a larger grid:
- In December 2025, state-sponsored actors were reported to have attempted to destabilise regional grid infrastructure in Poland by rapidly cycling wind turbine output rather than damaging equipment.
- In April 2025, the Iberian grid collapsed after 2.5GW of generation was lost in under 20 seconds, leaving parts of Spain and Portugal without power for roughly 10 hours and some areas for longer. Authorities attributed the Iberian outage to technical causes, not a cyberattack.
