Brochures, threat advisories and research for renewable developers, operators and OEMs.
CAPA-TA-2026-003 — Credential-stealing malware is harvesting developer and DevOps accounts, then cloning and exfiltrating cloud source repositories at scale. A clear path from IT repositories into OT for energy operators.
Supply chain mapping and vendor assessment under Australia's enhanced CIRMP Rules: what the new obligations actually require, how to calculate maximum acceptable outage, and why software and hardware bills of materials (SBOMs and HBOMs) give operators verifiable insight that compliance questionnaires cannot.
A practical guide for CISOs and defenders: why AI agents deceive, the three types of deceptive behaviour — survival, the new insider, and goal drift — how to extend your threat model with AI actors, and what to log to hunt these behaviours in agent traces.
An ARENA-funded review of CSIP-AUS — Australia's IEEE 2030.5 profile for DER-to-grid communication — setting out the risks large DER fleets pose to consumers and the power system, operational mitigations for CSIP-AUS clients and servers, and the improvements the standard needs as fleets scale toward ~10 GW of rooftop solar by 2030.
Design it right, prove it's compliant, and defend it in operation. Wind, solar and battery storage on a single platform.
Security built into a renewable site from the first drawing — across three modules: Site Designer (zone-and-conduit architecture from the drawings), the Asset Register (every system and version, allocated to zones), and the Site Journal (the change-controlled record inherited by everything downstream).
Consequence-driven risk for renewables: a small set of High Consequence Events, the crown jewels behind each, and mitigations that break the attack path.
Two-sided assurance for OEM product vendors and renewables operators — attestation, trust and authenticity for every digital system installed in IT and OT critical infrastructure.
