Walk the floor at All-Energy Australia this week and check out the myriad of home inverters, batteries and EV chargers. Nearly every one of them connects over the internet to its manufacturer’s cloud where that vendor can change its settings, push new firmware or perhaps even switch it off. We all know this, right?
Australia has more than 4.3 million rooftop solar systems, and more than half a million home batteries were installed in the first 13 months of the Cheaper Home Batteries Program. And for much of the day, our entire grid runs on this stuff.
So is it finally time to start calling this critical infrastructure?
Unfortunately the answer is, well, sort of, but just not yet.
2026 was the year governments noticed
On 29 December 2025, attackers struck more than 30 wind and solar farms and a heat and power plant in Poland. They got in through VPN appliances without multi-factor authentication, then used default passwords to load malicious firmware and wipe devices. Nobody lost power. But Dragos called it the first major attack aimed at decentralised energy. Distributed renewables are now on a state actor’s target list.
Governments moved quickly after that:
- Europe restricted EU funding, in April 2026, for energy projects using inverters from high-risk suppliers, then extended the restriction to battery projects. Lithuania already blocks Chinese remote access to any solar, wind or storage site above 100 kW.
- The United States stopped approving new models of foreign-made, internet-connected inverters on 28 July 2026. A month later, a national emergency was declared over the bulk power system.
- Australia brought the enhanced risk management rules under the SOCI Act into force on 10 June 2026. From June 2027, operators of critical assets must manage foreign ownership, control or influence (FOCI) and offshore remote access as material risks. Separately, the Smart Devices Rules have banned universal default passwords on consumer devices since March 2026.
Ten years ago, inverter security was a niche concern for researchers. Now it’s a national security issue in three of the world’s largest markets.
But we’re regulating the box
Almost all of these measures target devices: which inverters can be sold, funded or connected. Device rules have their place, but they miss where the risk concentrates.
No one attacking a modern grid would go after rooftops one at a time. They would go where control of many devices converges: the vendor cloud. In 2024, Bitdefender found flaws in the Solarman monitoring platform that could have let an attacker take over accounts and change inverter settings. Solarman managed about 195 GW of solar, roughly a fifth of the world’s capacity at the time. A single web application stood between an attacker and that much generation. The same year, a manufacturer’s cloud-based authorisation check disabled working Deye inverters in the United States, from another continent.
Three gaps follow from regulating the box:
- The installed base. Every ban applies to new equipment. What is already on roofs and in garages will run until the late 2030s, reporting to the same clouds it does today.
- Batteries and chargers. Behind the meter, battery management systems and EV chargers face few controls in any region, yet they’re controllable generation and load in exactly the same way.
- Origin isn’t security. SMA, a German manufacturer, had the largest number of internet-exposed devices in Forescout’s 2025 survey. The Poland attack went through American VPN appliances. A fleet from a trusted country, run through a poorly secured cloud, is still exposed.
Where Australia stands
Australia is the only one of the three regions that hasn’t banned vendors. Strangely enough, we are also the country that has a very small inverter manufacturing base.
So what’s our game plan then?
Under the current Security of Critical Infrastructure Act (SOCI), a generator becomes a critical electricity asset at 30 MW and only if it is connected to a wholesale market. A virtual power plant of 50,000 home batteries can control far more than that, yet it isn’t a critical asset. The proposed Tranche 2 reforms would close the gap by making large aggregation and dispatch platforms critical assets in their own right, with households explicitly excluded. Legislation is expected in 2027.
Until then, we are in limbo. The intent is there, but not the mechanism.
There are current SOCI obligations that fall on networks and retailers with regard to their critical assets. In this way, DER systems can be viewed as a critical dependency for a critical asset such as a distribution network, and therefore come under SOCI obligations.
But this is all a bit tenuous, particularly if you are expecting everyone to start spending the industry median of ~1% of total value generated on cybersecurity. It’s unlikely that anyone will until there is regulation in place.
What to expect
By 2030, large DER fleets in all three regions are likely to be treated as critical infrastructure, and in Australia that will come through the incoming SOCI changes. Regulation will be looking at the overall impact of compromised systems, not the size of end devices.
For DER manufacturers and fleet operators, keep an eye on the changes in Europe under the Cyber Resilience Act, and start preparing early for what is to come.
This Insight summarises our forthcoming white paper, Distributed energy as critical infrastructure, which compares the threats and regulation across solar, storage and EV charging in the US, Europe and Australia. At All-Energy this week? Get in touch to talk about how we can assist with cyber capabilities for securing your DER fleets.