Centrii, which helps energy operators, infrastructure owners and asset managers translate technical risk into financial and operational impact, today published ‘GRIDLOCK ', a risk assessment analysis of cyber-physical exposure in battery energy storage systems (BESS).
Using a Monte Carlo risk analysis methodology of 10,000 simulations across three industry security postures – baseline, moderate and aggressive – the GRIDLOCK: What a Coordinated Battery Attack Would Cost the Grid report quantifies the probability and financial cost of a coordinated attack on BESS between now and 2031.
Credit: Centrii
Battery assets landscape
According to the findings, under industry-average security practices, there is a 92% probability of a major attack on battery storage infrastructure within the next five years. This falls as security investment and enhancements increase. Under voluntary improvement adopted gradually and unevenly across the sector, it falls to 78%, while adopting mandatory IEC 62443 certification and regular attack-readiness drills sees the probability fall to 61%.
The earliest likely attack window also changes as a result, from 2027–28 under the baseline posture to 2029–31 under the most rigorous one. Based on these figures, security investment not only reduces risk, but it also buys time.
Cost of an attack: UK vs. US
In the UK, the effects of an attack are more concentrated than in the US. The modelling finds that compromising 29% of national capacity (around 400 units) could be sufficient to trigger a nationwide outage affecting 67 million people, effectively the entire population. A single major attack is estimated to cost between £2bn and £10bn in financial damage.
Bringing UK battery storage infrastructure up to IEC 62443 Security Level 2 – the standard the modelling shows meaningfully reduces attack probability – is estimated to cost between £400m and £1bn across the national fleet. That is a return on proactive security investment of roughly 5x to 25x.
The research also models a coordinated cyberattack in the US on the battery fleet supporting the grid in Texas, resulting in an estimated $12 to $65 billion in economic damage. By comparison, bringing the ERCOT battery fleet to IEC 62443 Security Level 2 is estimated to cost between $800 million and $2.8 billion. Compromising 5.4% of the ERCOT battery fleet, around 1,500 units, could be enough to destabilise the Texas grid, potentially affecting 30 million people.
Rafael Narezzi, Co-Founder and CEO of Centrii, explains the importance: “A coordinated attack does not need to stop generation to cause a blackout. It only needs to desynchronise the balancing layer, forcing batteries to charge or discharge together, or delaying how they respond to grid signals. Neither action damages a battery. The effect is closer to a distributed denial-of-service attack than a conventional outage – instead of overwhelming a website with traffic, it overwhelms the grid's ability to stay in balance, using energy itself as the disruptive force. The modelled result is a cascading blackout that unfolds in under two minutes.”
He adds: “Every board I speak to already accepts that cyber risk exists. What they haven’t had is a definitive assessment that helps them to reach the right figure. Security spending in operational technology is rarely treated as return-generating, because its value shows up in an event that does not happen. This modelling makes that value visible and measurable. Based on these figures, protecting battery storage is one of the highest-return decisions available anywhere in the business, but it’s also one of the least discussed at board level.”
Risks to grid-balancing infrastructure
The demand for battery storage, which helps balance grids, stores excess wind or solar energy and provides backup electricity during peak demand, is set to rise. According to RenewableUK, the UK Government has estimated that between 23GW and 27GW of battery storage will be required by 2030, a significant increase from approximately 4.5GW in 2024.
While the balancing function in modern battery fleets, often managed remotely through cloud-based platforms, makes them efficient to run at scale, it also exposes them to attacks, according to the Centrii report.
Recent high-profile events in Europe demonstrate how disruptions to grid-balancing infrastructure can escalate quickly. Both illustrate the underlying risks examined by GRIDLOCK that relatively concentrated disruptions to generation or balancing infrastructure can have consequences across a much larger grid:
- In December 2025, state-sponsored actors were reported to have attempted to destabilise regional grid infrastructure in Poland by rapidly cycling wind turbine output rather than damaging equipment.
- In April 2025, the Iberian grid collapsed after 2.5GW of generation was lost in under 20 seconds, leaving parts of Spain and Portugal without power for roughly 10 hours and some areas for longer. Authorities attributed the Iberian outage to technical causes, not a cyberattack.