European agencies warn AI and connected devices raise energy sector cyber risks

Cybersecurity experts from ENISA, E.DSO, EE-ISAC, and ENCS stated that Europe’s energy sector must close the gap between evolving threats and practical response capabilities. The groups made these remarks while gathering at the 9th Cybersecurity Forum in Brussels, noting that regulation alone cannot address risks from artificial intelligence and connected technologies.

The forum organizers cited ENISA’s Threat Landscape 2026 report, which analyzed 8,257 cyber incidents affecting EU member states and organizations during 2025. According to Industrial Cyber, the report found that geopolitical developments continue to shape malicious activity, while attackers increasingly incorporate AI into their operations. Operational technology intrusion claims also rose during this period.

Recent Attack Context

Recent incidents on European energy infrastructure serve as practical examples of required cyber resilience. The forum featured discussions on coordinated cyberattacks against Poland’s energy sector in December 2025. These attacks targeted numerous wind and solar farms along with a combined heat and power plant that supplies heat to nearly half a million customers.

Although electricity generation was not disrupted during the Polish attacks, communications between the affected facilities and distribution system operators were lost. Attackers gained a level of access that could have enabled further disruption, according to the forum speakers. This scenario highlights the difference between maintaining power flow and securing control systems against unauthorized access.

Operational Resilience and Workforce Challenges

NPC Ukrenergo, Ukraine’s national electricity transmission system operator, shared how it strengthens cyber resilience while operating a grid under sustained attack. The organization uses artificial intelligence to help cybersecurity teams react faster, identify gaps, support staff, and assist with reporting. Despite using these tools, the operator keeps critical decisions with human personnel.

This approach highlights a growing challenge for the energy sector: maintaining specialist cybersecurity expertise. Skilled teams are difficult to rebuild through recruitment when operating under constant threat. The expansion of connected energy technologies creates additional challenges, as demonstrated by live demonstrations of risks affecting these devices at the forum.

What should you do?

Security professionals should review how their organizations handle communication channels between physical facilities and distribution operators. Ensuring these channels remain secure is vital even if power generation continues. Teams should also evaluate how they integrate AI tools into their security operations while maintaining human oversight for critical decisions.

What to do and how to stay safe

• Audit communication links between physical energy facilities and central distribution operators to ensure they remain secure during incidents.
• Evaluate current AI tools used in security operations to ensure they support staff without replacing human decision-making for critical actions.
• Review workforce strategies to maintain specialist cybersecurity expertise, as recruitment alone may not suffice for rebuilding skilled teams.
• Monitor operational technology systems for intrusion signs, given the reported increase in OT-related claims in the latest threat landscape data.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How many cyber incidents did ENISA analyze in its 2026 report?

ENISA’s Threat Landscape