Software / AI

BESS Vulnerabilities & Possible Solutions - Software as a Core Risk and Safety Layer Regulation Now Targets Software

Software-Centric Vulnerabilities

Virtualization Reliability Standards 2025 Modernize NERC CIP to cover virtual cyber assets, shared cyber infrastructure and management interfaces, directly addressing software-defined and cloud-like environments.This is relevant for all software systems that support the operation of BESS and are not on-prem.There is a growing distrust in the US against foreign entities of concern FEOC, leading to an increased scrutiny in technology usage and communication oversight.

Remote Access Control: Most BESS cyber risks originate from remote-access weaknesses such as OEM support tunnels, VPNs without MFA, or over privileged accounts.

EU NIS2 Cyber Resilience Act CRA, 2025 “Secure-by-designˮ for software: BESS OEMs and software providers must demonstrate that security is built into their development process. This applies to EMS, BMS firmware, PCS firmware, cloud platforms, and all digital interfaces. SBOM Software Bill of Materials) is required Vendors must provide a complete list of all software components inside their product, including open-source libraries and third-party modules. This allows operators to identify whether a vulnerability affects their BESS.

Firmware Update Risks: Insecure or outdated firmware remains a major theoretical risk for BESS, because BMS and PCS firmware directly control safety limits and grid interaction. Improperly secured update channels could, in principle, allow attackers to modify protection parameters. A public incident 2023) exploited a vulnerability in a communication gateway that was used for software updates in home storage. Cloud Access via API Cloud-based EMS, fleet platforms, and market-dispatch APIs introduce new digital interfaces that were uncommon in earlier storage installations. As BESS fleets become more software-integrated, API hardening has become an essential cybersecurity focus. PCS highly critical hardware: All BESS hardware components are vulnerable, but since the PCS communicates with higher and lower level components, it is the most critical and vulnerable component.

In 2025, the number of regulations targeting software integrity increased. For a 400 MWh sized storage, an outage can cost up to $ 1.2 million in monthly losses. Software is a core safety layer in BESS, as EMS/BMS/PCS firmware control BESS performance and grid reliability. Software comes with cyber risk (via risks like remote access, outdated firmware, weak APIs), operators must evaluate vendors on software maturity (an example checklist on how to implement cybersecurity measures is given here).

Source: energy-storage.news, Fluence, Cellect, Industrialcyber, UL, Eticaag, Öhrström et al, Cyber Resilience Act, Federal Register, CISA, DOE, Brattle

Extracted from the PDF; charts and images may read imperfectly.