Mind the air gap: three cybersecurity myths at renewable plants, and what the rules demand, country by country

Carlos Ramírez, of ATA Cybersecurity, the arm of ATA Renewables devoted to protecting renewable assets, collects phrases. He has picked them up on visits to solar plants, wind farms and substations, and on 20 October, at a training session for staff, he boiled the collection down to three: we're isolated from the internet, we have a firewall and nothing has ever happened to us. People say them calmly. In Ramírez's view none of them amounts to being secure, because an attacker needs only one way in.

The good news is that each phrase, once taken apart, points to what to check first. And regulation, until recently a matter for lawyers, now comes with deadlines.

Isolated, give or take a router

The first phrase is the most comfortable, and the easiest to test. On 6 October a Dutch analytics firm and the Netherlands' National Cyber Security Centre (NCSC-NL) presented a count of wind and solar farm systems that should not have been reachable from the internet but were: 8,547 of them, in 35 countries in and around Europe. That is a floor, since only systems that could be traced to a specific farm were counted. Some 2,766, or 35% of the solar cases, were in Spain. At 181 sites, the researchers reckoned, the exposure would have allowed full operational control.

The equipment in a modern plant is smart, Ramírez explained, and “the very fact that it's smart means there's a part of it that can be connected to the internet”. That part might be the 4G router the maintenance contractor installed, a turbine's data card or the monitoring system's web portal. Nor is the network the only route. SCADA, the software that monitors and controls the plant, is now an application with its own code, and the manufacturer's technician who turns up to update a controller with a USB stick may unwittingly open another door.

Time works against the owner. A plant runs for twenty years or more and much of its equipment is never replaced in that span, so unsupported operating systems sit alongside industrial protocols designed when nobody expected visitors. The older the technology, Ramírez reminded his audience, the easier it is to attack.

The firewall was the front door

The second phrase has a recent counter-example. On 29 December 2025 at least 30 wind and solar farms in Poland suffered a destructive attack. According to CERT Polska, one of Poland's national incident response teams, at each affected site a single device served as both VPN and firewall, with its VPN interface exposed to the internet and no multi-factor authentication. Once inside, explains CISA, the US cybersecurity agency, the attackers used default credentials to reach the HMIs (the operators' control screens) and the RTUs (remote terminal units), and damaged the RTUs' firmware. Generation carried on, but communications and remote control between the farms and the DSO, the local distribution system operator, were lost.

The firewall, in other words, was the way in. And it need not even be attacked, Ramírez warned: “send you a phishing email and I'm past every firewall in the company”. Hence his argument that the perimeter today is drawn by identity, meaning who gets in, with which credentials and with what permissions. Reusing passwords across sites is common in the sector, the Polish report adds. Ramírez still finds usernames and passwords on sticky notes in plants, and HMIs left on their default passwords.

It also pays to be clear about what is being protected. In an office, keeping information confidential comes first; at a plant, keeping it running. Ramírez illustrated the point with the Iberian blackout of 28 April 2025 (the official report found no evidence that a cyberattack caused it). At home that day, he was thinking about his email. His colleagues at the plants were thinking about “the availability of the plant, that the plant wouldn't stop, that the plant would start producing again”. In a deliberately simple example, Ramírez noted that anyone who wants to do harm need only falsify the reading of a light sensor: “I tell it it's night and the plant stops generating altogether”.

So far, so quiet

The third phrase is the one heard most often, and recent history contradicts it. At the start of the invasion of Ukraine, in February 2022, a cyberattack on a satellite network left 5,800 turbines from a single manufacturer, some 11 GW in central Europe, without remote monitoring and control. Two months later an attack led a German wind maintenance firm to cut remote monitoring of some 2,000 turbines for a day or two as a precaution. In 2024 around 800 solar monitoring devices in Japan, carrying a known and unpatched flaw, ended up working for bank fraudsters. And in April 2025 someone took over the web panel of a small Norwegian dam that supplies a fish farm and left a valve open for about four hours.

In the power-sector cases, the turbines kept turning and the panels kept producing. Almost every time, operators lost visibility and control, and that is precisely what forces them to react blind. An empty incident log can mean that nothing has happened, or that nobody has noticed. The second now carries legal consequences, because the rules require incidents to be reported within hours.

Same plant, different rulebook

This is where geography comes in. Put the same solar plant, with the same inverters and the same SCADA, on either side of a border and its obligations are very different.

In the European Union the common starting point is the NIS2 directive. It lists electricity among the sectors of high criticality and reaches well beyond generators, taking in suppliers, DSOs, TSOs (transmission system operators), market operators, aggregators, storage providers and charge-point operators, generally from medium-sized companies upwards. It requires risk management and a three-stage report of any significant incident: an early warning within 24 hours, a notification within 72 and a final report within a month. For essential entities, the more tightly supervised of NIS2's two tiers (the other is important entities), the ceiling on fines is no lower than €10 million or 2% of worldwide turnover, whichever is higher.

What varies is the timetable. Member states had until 17 October 2024 to transpose the directive, and Italy made it with a day to spare: its decree has applied since the 16th. In April 2025 ACN, Italy's national cybersecurity agency, told registered companies whether they were essential or important, and the deadline for basic security measures falls in October 2026. Ramírez described the Italian model as a countdown. As soon as the agency sends you the requirements, “you're already up against the clock”, and it can ask you at any moment to explain how you meet them. Germany's law has been in force since 6 December 2025, Poland's and Portugal's since 3 April 2026.

Spain is lagging. On 8 July 2026 the European Commission took Spain, France, Ireland and the Netherlands to the Court of Justice of the EU (CJEU) for failing to notify full transposition. The Netherlands has had its law in force since 15 August; the other three were still outstanding in mid-October. Spain's Law on the Coordination and Governance of Cybersecurity is still an anteproyecto, a draft bill approved by the Council of Ministers on 14 January 2025 that has yet to reach the Cortes, Spain's parliament. The delay buys time, though not much. The law will also apply to plants already in operation, and the usual pattern, according to Ramírez, is an adaptation period of a year or a year and a half, during which a roadmap can serve as the response.

The Cyber Resilience Act (CRA), by contrast, waits for no parliament. It applies directly across the EU and falls on the manufacturers of products with digital elements, such as inverters, controllers or battery systems. Since 11 September 2026 they have had to report, within 24 hours, actively exploited vulnerabilities and severe incidents affecting their products, including those already on the market; the remaining obligations apply from 11 December 2027. For an owner, the CRA becomes a procurement clause. By one ATA Renewables engineer's count, a solar plant has at least seven major equipment suppliers: seven ways in, each worth securing by contract.

Latin America's map is patchier and, in places, stricter than Europe's. Chile counts electricity generation among its essential services and gives operators three hours for the first alert, an eighth of the NIS2 deadline; its grid operator, the Coordinador Eléctrico Nacional, has since 2020 applied a standard based on NERC CIP, North America's mandatory grid cybersecurity rules. Brazil has required electricity-sector players to have a cybersecurity policy since 2022, and Colombia is making progress through agreements issued by its Consejo Nacional de Operación, the body that sets the grid's operating rules. Ecuador published its law in May 2026, with fines of up to 1.5% of turnover and 24 months to adapt. The Dominican Republic has had a regulation for its electricity subsector since 2025, and Uruguay requires incidents to be reported within 24 hours, albeit without fines. At the other extreme, Mexico has a policy only for the federal public administration, and Argentina goes no further than defining critical infrastructure.

Ramírez warned against reading the absence of rules as reassurance. A country having no specific regulation, he said, “doesn't mean they can't hack your plant”. A group with assets on both sides of the Atlantic also faces a less obvious risk. A badly configured plant in a lightly regulated country can serve as a stepping stone into the corporate network and, from there, into the group's European plants.

Fitted as standard

That is where the opportunity lies. The cheapest course is to design security in from the outset, choosing equipment, protocols and network architecture with it in mind before construction, when demanding a certification from a supplier costs one line in the contract. Plants already running have to start from the other end, with an inventory of what is there and how it communicates; then come phased measures that do not stop production, quickest first. None of the basics means rebuilding the plant. Default passwords can be changed, sticky notes taken down, the network segmented, and suppliers' always-on VPNs replaced with access that is multi-factor, time-limited and logged.

For groups with international portfolios, regulatory diversity also works in their favour. Ramírez has seen large operators apply the European minimum at all their plants, including those outside Europe where nobody asks them to, for reasons of plain economics. Twenty firewalls bought at once cost less apiece than two, and with the same solutions everywhere a single security operations centre can watch over the lot.

Beyond the fines lies what no regulation puts a number on. A shutdown costs revenue and reputation, and a plant has people working beside electrical equipment. “For me the main impact is always people,” Ramírez said.

All three phrases come from people who have not looked. Looking first is the best way to keep the third one true.