COP31’s Green Transition Depends on a Secure Grid
The renewable grids COP31 is racing to build rely on thousands of small, internet-connected assets, and threat actors are already exploiting them. Getting security right is part of getting the energy transition right.
On Monday, the 2026 UN climate summit began in Antalya, Turkey. The thirty-first Conference of the Parties (COP31) to the UN Framework Convention on Climate Change runs until 20 November, with representatives from around the world facing mounting pressure to accelerate climate action as projections indicate that global temperatures will overshoot the 1.5°C warming threshold set under the Paris Agreement. This year’s edition also coincides with the tenth anniversary of the Paris Agreement entering into force. Meanwhile, the United States, the world’s second largest and historically biggest emitter, will not send an official delegation, as its withdrawal from the Agreement took effect in January, although members of Congress and US businesses will still attend.
Once again, energy security will be among the key topics across both the Global North and the Global South. Many governments are revising their energy and industrial priorities, while local authorities, particularly in the most affected regions, are developing grassroots solutions to cope with worsening heat, floods, falling water levels, and energy price fluctuations. Renewable energy sits at the centre of these plans. It offers more affordable power, jobs, and industrial opportunities, and it cuts dependence on fossil fuel imports. It is simply the most economically and strategically sensible choice.
But the faster renewables are rolled out, the more the success of climate policy depends on how well they are secured. In the race to scale, many renewable energy firms are leaving themselves and their assets exposed to cyber threats, and nation state actors are already exploiting those gaps to preposition themselves on power grids and to carry out deliberate sabotage. Climate change only adds to the problem. Grids already stretched by heatwaves and floods have less room to absorb a cyber incident, so the same breach can do far more damage when the weather is at its worst.
A grid that runs on renewables but can be switched off by a hostile state is neither secure nor sustainable.
Most cybersecurity concerns in the energy sector have historically revolved around the Operational Technology (OT) at the heart of the grid. Incidents in Ukraine have shown what is at stake. The BlackEnergy campaign in 2015 and the Industroyer malware, deployed in 2016 and again in an updated form in 2022, both went after central control systems and showed how much disruption a breach at grid level can cause.
A grid built on renewable energy, however, is a different target. Instead of a handful of large power stations, it relies on thousands of solar parks, wind farms, batteries, and inverters, many of them run by small operators and managed remotely over the internet or satellite links.
This changes what an attack on the grid looks like. Malware and phishing aimed at central control systems remain a threat, but threat actors can now also target platforms that aggregate and dispatch thousands of small generators and are far less standardised than traditional control systems. Feeding false data into the system can mislead forecasts and grid operators, and even move electricity prices. What is more, the sheer number of connected devices makes Denial-of-Service (DoS) attacks harder to defend against, while reliance on GPS for timing opens the door to spoofing that can force equipment out of sync with the grid.
The war in Ukraine has also shown how exposed renewables can be. As we discussed in one of our previous Summit articles, the start of Russia’s full-scale invasion in February 2022 went hand in hand with a breach of the Viasat KA-SAT satellite network, which cut off remote monitoring and control for thousands of wind turbines in Germany. Although the turbines were never the intended target, they lost connection because their operator relied on the satellite network to reach them.
More recently, after the April 2025 blackout cut power to most of Spain and Portugal for up to a day, the Spanish government audited dozens of small renewable power plants and found that many lacked adequate cybersecurity protections. While the outage itself was not caused by a cyber breach, the inquiry exposed how thinly protected parts of the system may be. Spain, one of Europe’s largest adopters of renewable energy, has as many as 4,000 renewable assets with a capacity of one megawatt (MW) or more, and its grid already depends heavily on them.
In late December 2025, in what the Polish government described as the most serious incident in years, Sandworm, a threat actor linked to Russian military intelligence (GRU), breached communications between renewable energy installations across the country. Poland stopped the intrusion before it could trigger a large-scale blackout, but what stands out is that the threat actors targeted smaller power providers rather than the largest operators. That shifts responsibility for grid security from major critical national infrastructure operators alone to practically everyone connected to it.
New technologies such as plug-in solar, legal in the UK since August 2026, could add to the risk. Because households can now connect their own generation directly, more smart devices will come onto the grid, raising the prospect of weaponised mass disconnections and greater reliance on hardware from foreign jurisdictions.
The renewable sector still has some advantages. Much of its infrastructure is new or still being built, so it is far easier to build security in from the start than to bolt it on later. Governments have an opportunity to turn the decentralised nature of renewables to their advantage by implementing zero trust at aggregation points and making basic cybersecurity standards a condition of grid connection for generators of all sizes. This matters because even simple misconfigurations or accidental data leaks can have serious consequences when investors, partners, and regulators expect renewables to show they can withstand geopolitical threats.
As delegates to the climate conference in Antalya negotiate how quickly the world can move away from fossil fuels, cybersecurity belongs in that conversation. A grid that runs on renewables but can be switched off by a hostile state is neither secure nor sustainable, and every successful breach gives ammunition to those who argue the transition is too risky. Getting security right is part of getting the energy transition right.