Executive Summary

• A study from Centrii has found a significant risk of a major attack on battery storage infrastructure by 2031
• The study focused specifically on the Texas ERCOT grid, which operates just over half of the US total, and argued coordinated manipulation of around 5.4% of the BESS could destabilise the grid
• For the UK, the report argued coordinated manipulation of around 29% of BESS – roughly 400 units – could be enough to trigger a national blackout, with between £2bn and £10bn in damage

A report from Centrii has explored the risk of cyber-physical exposure in battery energy storage systems (BESS) – and concluded there is between a 61% and a 92% probability of a major attack on battery storage infrastructure by 2031.

The GRIDLOCK study from the operational technology cybersecurity provider for the energy sector used a Monte Carlo risk analysis methodology of 10,000 simulations and models a coordinated cyberattack on the battery fleet supporting the Texas grid.

A 92% probability of major attack comes under current security postures, while voluntary improvements adopted gradually and unevenly across the sector moves the probability down to 78%. At the most rigorous scenario, assuming mandatory IEC 62443 certification and regular attack-readiness drills, probability falls to 61%.

The Texas ERCOT grid operates 28 GW of BESS capacity, at just over half (53%) of the US total. According to the report, under the operating conditions modelled, coordinated manipulation of around 5.4% of BESS could create a disturbance large enough to destabilise the ERCOT grid.

For Britain, under the same scenario approach, the report argued coordinated manipulation of around 29% of BESS – roughly 400 units – could be enough to trigger a national blackout, with between £2bn and £10bn in damage. The report notes that Britain faces heightened vulnerability due to having a single national rid and concentrated deployment, with four fifths (79%) of its 6.8 GW capacity in England.

The report shows how comparatively little resource is required to cause destabilisation and blackout. The major grid outages in the Iberian Peninsula in 2025, for example, were attributed to multiple interacting technical and operational factors rather than a cyberattack.

Rafael Narezzi, co-founder and CEO of Centrii, noted that while every board he speaks to accepts cyber risk exists, there is no definitive assessment which helps put a financial figure against that exposure.

“Security spending in operational technology is rarely treated as return-generating because its value shows up in an event that does not happen,” said Narezzi. “This modelling makes that value visible and measurable. Based on these figures, protecting battery storage is one of the highest-return decisions available anywhere in the business, but it is also one of the least discussed at board level.”

You can read the full report here.

Picture credit: Created with Magnific