Recent incidents across Europe, including cyber attacks, drone sightings, and sabotage of subsea cables, show that critical electricity infrastructure is already under pressure. While governments and militaries play the first line of defence, the energy sector makes the second line of defence. Therefore, the power sector needs to prepare for both full-scale war scenarios, hybrid attacks and cyber threats.
Why is power infrastructure a prime target?
Disrupting electricity supply delivers an outsized impact. A single substation outage can cascade into telecom services failures, water shortages and transport disruption. Beyond the immediate economic cost, power outages undermine public trust and societal resilience.
The experience of Ukraine has demonstrated this clearly. The Russian military has been deliberately targeting power Energy infrastructure to sap morale, constrain military operations and weaken the functioning of society. Europe is not directly at war, but malicious actors are already targeting the power grid to disrupt energy supply
The new threat landscape facing power companies
In this context, it is clear that today, energy security means electricity security. Power utilities face different types of security risks:
- Physical attacks and sabotage. Critical nodes such as substations, transformers, cable landing points and generation control systems are increasingly attractive targets. These assets are often difficult to replace, have long lead times and can cause widespread outages when damaged.
- Cyber attacks. Attacks on control systems can directly manipulate physical equipment, triggering shutdowns and damage. Data breaches can leak sensitive information. As the electrical grids become more digital and decentralised, the attack surface continues to grow.
- Hybrid threats below the threshold of war. Cable damage, arson, drones near substations, disinformation campaigns and coordinated cyber incidents can all occur without triggering a formal military response. Their cumulative effect, however, creates an environment of distrust.
How Europe can build a more resilient energy system
Eurelectric highlights several strategic investment priorities for system operators to strengthen Europe’s energy resilience.
Strengthen crisis management and preparedness: A resilient energy system begins long before a crisis occurs. This includes:
- stockpiling essential components
- building fast repair and reconstruction capabilities,
- expanding redundancy through distributed resources and storage,
- conducting regular joint crisis exercises across sectors.
Protect critical energy infrastructure against hybrid threats: Energy assets are frontline targets. Utilities need to combine immediate security measures and long-term secure-by-design planning through close coordination between operators, public authorities and defence actors.
Enhance cyber security and secure communication systems: Energy systems face increasingly sophisticated cyber risks. Investment should focus on resilient communication networks, strong cyber defences, coordinated response frameworks and transparent public communication to maintain trust during crises.
Lessons from Ukraine: how to defend critical infrastructure under fire
Ukraine’s experience shows that power companies carry the operational responsibility to defend critical infrastructure through preparedness, rapid response and smart recovery.
1. Preparation: the real defence
Effective defence starts long before an incident. Utilities that invest in increasing awareness, formal cooperation with authorities and regular crisis exercises are better able to respond when attacks occur. In Ukraine, this translated into:
- Awareness and trusted collaboration between energy companies, ministries and military intelligence. Crisis teams within utilities had access to classified briefings so they could anticipate risks and prepare accordingly.
- Hardening the right assets with fast and affordable solutions – sandbags, gabions, concrete shielding, and drone nets.
- Cyber security as strategic defence. Strong cyber protection for dispatch centres and substations helped prevent systemic collapse from the early stages of the invasion
- Mental resilience. Defending critical infrastructure also means protecting the workforce, which goes through extreme pressure. Key measures included: regular drills and joint exercises, clear emergency protocols.
- Strategic stockpiles and rapid repair capacity. Transformer lead times can exceed 12–24 months in normal conditions. In wartime, supply chains collapse further. Ukraine therefore stockpiled critical components, dispatched storage locations and kept them protected.
2. Response: speed determines impact
Even the best preparation cannot prevent every attack. In Ukraine, damage was inevitable. What mattered was response speed and coordination. A crisis response team must:
- Immediately assess damage
- Coordinate with energy ministries and the military
- Mobilise repair crews
- Restore power where feasible
3. Recovery: build back more resilient
Recovery during conflict is complex. Assets may be retargeted. Temporary solutions may become semi-permanent. Decisions must balance urgency, cost and security risk.
Ukraine’s longer-term recovery strategy highlights a structural lesson:
- Distributed renewable energy (wind and solar)
- Battery energy storage systems (BESS)
- Demand-side flexibility
- Pumped hydro and flexible generation
- Emerging technologies such as small modular reactors
These assets proved to be less vulnerable compared to large, centralised ones.
How power companies can defend critical infrastructure today
- Strengthen organisational preparedness. Many of the most effective measures are low-cost. Cross-functional crisis teams, secure backup communication systems, and clear emergency procedures significantly improve response speed and coordination. Protecting personnel safety and mental resilience is equally critical.
- Protect critical assets by design. Physical protection such as reinforced structures, barriers and drone-resistant measures, can drastically reduce damage. New investments should embed resilience by design, including redundancy and ease of repair.
- Build cyber resilience into operations. We should treat cyber security as an operational safety issue, not an IT add-on. Segmentation between IT and OT systems, regular penetration testing and realistic cyber-physical exercises are essential.
The role of collaboration
To make these measures really work, three layers of collaboration are crucial to:
- Utility-to-utility cooperation: sharing equipment, expertise and emergency support across borders.
- Utility-to-state coordination: secure information sharing, joint crisis exercises and clear protocols.
- EU-level coordination: harmonised implementation of legislation, common stress tests and investment frameworks.
How NATO’s 1.5% defence-related spending can support grid resilience
At the 2025 NATO summit, allies agreed to dedicate up to 1.5% of GDP to defence-related spending. For EU countries aligned with NATO, this represents a significant financial opportunity with implications beyond military capabilities. Defence-related investment can also support:
- civilian infrastructure with security relevance
- crisis preparedness and emergency response
- protection of critical services
- resilience of energy and communication systems
Europe’s GDP exceeds €17 trillion. Allocating even just a part of this spending to electricity infrastructure resilience would have an enormous impact.
Applied strategically, defence-related investment can strengthen Europe’s electricity systems across the full security cycle, from prevention to recovery. Key areas include:
- Preparedness and crisis response. Funding can support stockpiling of critical components, rapid repair capabilities and regular joint crisis exercises involving energy operators, public authorities and defence actors. Planning must reflect today’s threat landscape and go beyond traditional security assumptions.
- Protection of critical infrastructure. Investment can combine immediate physical protection with long-term secure-by-design planning, redundancy and resilience across the electricity system.
- Cyber security and secure communications. Electricity systems depend on trusted data and communications. Defence-related funds can support secure, independent communication channels and robust cyber security embedded across operations.
- Clean and resilient energy systems. Focusing on renewables, electrification and grid resilience reduces strategic dependencies and strengthens Europe’s ability to operate under stress.
Policy asks
At the policy level, there are three areas to help support infrastructure protection:
- Implementation of existing rules. For physical security, that means implementing the Critical Entities Resilience Directive (2023), and for cyber, the NIS2 Directive. These can help Member States identify weaknesses and address them.
- Investment and funding. At the EU-level, there should be design criteria that enable access to funding for asset investments. As mentioned, NATO-allied Member States should use the 1.5% GDP spending target for defence-related spending by 2035.
- Governance. Planning and risk assessments should consider all threats, from natural disasters to political tensions and technical weaknesses. They should also consider interactions across energy resources like gas and electricity. especially ‘spillover effects’ of crises in one sector into another.
Conclusion
Defending critical infrastructure is no longer a theoretical exercise. Hybrid threats are already testing Europe’s electricity system, and the lessons from Ukraine show what is at stake. The good news is that power companies can act today. Many no-regret measures exist, from organisational preparedness to targeted asset protection and cyber security by design.
Europe can use part of NATO’s 1.5% defense investment for clean energy. This investment can also support strong grids and updated infrastructure. These actions will help improve Europe’s resilience. This will help reduce dependence on hostile suppliers, lessen hybrid threats, and protect its long-term independence.
Energy security now represents security — and we must treat it accordingly.