Cyber resilience: securing Australia's energy transition

Watch: Cyber resilience and the energy transition

Ross Phillipson explores the cyber security risks and opportunities arising from the energy transition, what they mean for boards and investors and why cyber resilience must be embedded in infrastructure strategy from planning through to operations.

The energy transition is not just transforming how energy is generated, transmitted and stored. It is also driving a digital transformation, with greater connectivity, automation and data creating new opportunities alongside heightened cyber security risks.

From distributed generation and AI-enabled forecasting to increasingly interconnected infrastructure, organisations must consider cyber risk beyond traditional data protection. Operational resilience, supply chain security, safety and governance are becoming central to the long-term performance of energy assets.

Key takeaways

1. Cyber security is becoming an infrastructure governance issue: as energy systems become more digital and interconnected, cyber risk must be considered alongside operational resilience, safety and governance, rather than treated solely as a technology issue.
2. Cyber risk extends beyond personal information and individual assets: digital supply chains, remote access and interconnected infrastructure create risks at the asset, operator and broader ecosystem levels.
3. Boards and investors need greater scrutiny of cyber resilience: cyber policies and risk registers alone are no longer sufficient. Organisations need to understand their critical assets, evolving risk profiles and ability to maintain operations during sustained cyber-attacks.
4. Cyber resilience must be embedded throughout the infrastructure lifecycle: companies seeking to lead the energy transition need to integrate cyber security, operational resilience, safety, supply chain management, governance and compliance from planning and financing through to commissioning and operations.

The energy transition is also a digital transformation

Traditionally, the energy transition has focused on generation capacity, transmission capability, capital investment and environmental approvals. Increasingly, however, energy infrastructure is also undergoing a digital transformation.

Greater connectivity, automation and data are changing how energy systems operate. Distributed generation, battery storage that supports solar generation when the sun goes down and autonomous AI forecasting of energy demand and supply present significant opportunities.

But these capabilities also bring increased cyber security risks and more demanding operational resilience and governance requirements.

Cyber security is therefore no longer simply a technology risk. It is an infrastructure governance issue that needs to be considered as part of the broader energy transition.

Cyber risk extends beyond data protection

Cyber security has traditionally been associated with data risk, including the protection of personal information. In critical infrastructure and energy, however, the potential consequences are much broader.

Cyber threats can create supply chain, operational and safety risks that affect both organisations and the physical assets they operate.

Electricity generation, transmission, gas transmission, telecommunications and data centres increasingly function as part of a highly interconnected ecosystem. This means cyber risk needs to be assessed at three levels:

• Asset level: understanding and managing digital vulnerabilities within individual infrastructure assets, including risks introduced through physical components and connected systems.
• Operator level: considering how cyber threats could affect an organisation's operations, critical systems and ability to maintain essential services.
• Ecosystem level: recognising the risks arising from the connections and dependencies between critical infrastructure assets and operators.

Digital supply chains present particular challenges. Offshore access arrangements can create opportunities for threat actors to access systems remotely and potentially disrupt operations. Similarly, cyber vulnerabilities may be embedded in physical components installed within operational infrastructure but accessible through digital connections.

Emerging threats also require forward-looking consideration. AI-enabled cyber-attacks and risks associated with post-quantum computing and encryption should be considered during the early stages of project development, rather than immediately before commissioning.

Boards and investors face greater scrutiny of cyber resilience

For boards and investors, the increasing digitalisation of energy infrastructure demands greater scrutiny of organisational cyber capabilities and resilience.

Maintaining a cyber security policy or recording cyber risk on a risk register is no longer sufficient. Cyber threats continue to evolve, requiring organisations to develop the maturity needed to understand and respond to changing risks.

This includes understanding the organisation's cyber risk profile, identifying critical assets and assessing how emerging threats could affect those assets.

Crucially, boards and investors need to consider whether critical operations can be maintained during a sustained cyber-attack.

These considerations extend beyond immediate operational and financial impacts. Cyber resilience is increasingly connected to an organisation's social licence to own and operate critical infrastructure over the long term, particularly where those assets serve the national interest.

Building cyber resilience into infrastructure strategy

Companies seeking to lead the energy transition will need to treat cyber resilience as a core infrastructure capability, rather than a standalone technology function.

This means integrating cyber security, operational resilience, safety, supply chain management, governance and compliance into the overarching infrastructure strategy.

These considerations need to be embedded throughout the asset lifecycle, from planning and financing through to commissioning and ongoing operations.

Taking this approach allows organisations to consider digital and operational risks as part of infrastructure development, rather than addressing them only as assets approach completion.