AI-powered threats put Europe's power system on high alert

Camilla Naschert (0:04)

Welcome to Energy Evolution, a podcast by S&P Global Energy explaining the complexities and opportunities behind the global energy transition.

I'm Camilla Naschert. Today, we're diving into a story at the intersection of two key themes in today's energy economy, artificial intelligence and cybersecurity. And we're explaining how they can affect the very infrastructure that keeps the lights on. The threat to infrastructure is no longer theoretical. In Germany this past September, sabotage attacks on high-voltage substations briefly knocked lignite plants offline. Across the Baltic Sea, at least 11 undersea cables have been damaged since October 2023, with European Intelligence Services pointing fingers at Russian-linked vessels conducting surveillance and sabotage operations. And in the UK, a 15-megawatt gas-fired plant was shut down for four days after a cyber attack, with initial reports suggesting the hackers were linked to Iran. But physical sabotage is only part of the picture. A new threat is emerging too. AI agents are now being used by nation states and criminal groups to conduct cyber attacks, with incidents of AI-driven cyber espionage more than doubling in 2025 compared to human hackers. Energy companies are having to navigate an uncomfortable truth. The same AI tools they are deploying to optimize their grids and cut costs may also be creating new attack surfaces.

So where does that leave Europe's electric utilities? The EU has moved faster than almost any other government on governance. The EU AI Act, the Cyber Resilience Act, and the NIST 2 Directive are all now in force, demanding secure by design products and lifecycle cybersecurity. Germany has strengthened its legal framework through the NIST 2 Implementation Act and the CRITIS Umbrella Act. But a recent policy report from the European Initiative for Energy Security found that security has not kept pace with deployment. The number of incidents reported by critical infrastructure operators in Germany alone rose 60% between 2021 and 2025

So are utilities investing enough? Are they ahead of the threat or perpetually one step behind? That's what we're going to explore today.

We'll look at the threat landscape from loan activists to state-sponsored hybrid warfare, and we'll examine what Europe's utilities are doing to harden their defenses. Our first guest today is Kristian Ruby, CEO of utility trade association Eurelectric. Kristian, welcome to Energy Evolution. So today you're here to share Eurelectric's perspective on the latest developments in cybersecurity as it relates to critical power infrastructure in Europe. So, to start with, what has been your experience over the last year or so? How has the cyber threat landscape evolved, and what are the most significant attack vectors you and your members are seeing today?

Kristian Ruby (3:24)

I'd say first of all, we've seen an increase overall in the amount of attacks and in the amount of successful attacks over time. We do see a constant pressure on our systems from cyber criminals of different kinds, some allegedly, some presumably state-backed, some operating without backing, but landscape in cybersecurity is becoming more complex, and we are seeing a rise in attacks.

Camilla Naschert (3:56)

Now, AI is obviously increasingly helpful for utilities and grid owners on tasks like grid optimization, demand forecasting, predictive maintenance, things like that. But at the same time, attackers do seem to be using it as well to launch more and more sophisticated, more automated attacks.

Can you say anything about how the sector is preparing to defend against AI-related threats and are the defenses working so far?

Kristian Ruby (4:26)

What I can say is that indeed we have seen a rise also in AI-assisted or AI-power powered attacks and what we in particular see is AI acting as a threat multiplier in relation to the cyber threat. We've seen from external studies that the amount of cyber attacks that are AI-assisted or powered one way or the other today is rising sharply. So the adoption of AI in this space, as in many others, is rising fast. And I would say one particular incident that really made an impression on me was this summer when Taiwan reported of a massive agentic attack on some of its critical infrastructure in main institutions. So what happened in this context was that presumably actors in mainland China had been deploying agentic harnesses combined with agentic language models to essentially carry out a series of quite advanced attacks. They succeeded in infiltrating several power companies in Taiwan and also compromising the nuclear safety agency of the country. What that demonstrated to me is that anybody involved in critical infrastructure needs to be really on top of their security game and be ready for some very advanced attack strategies.

This goes of course for countries abroad, but also very much in Europe because we are operating with a hot war on the continent as our backdrop and as a consequence of that, a number of hybrid attacks are also being launched against critical infrastructure operators across the European continent.