Brussels Forum: AI and Connected Devices Widen the Cyber Gap

On 12 October 2026, the ninth edition of the Cybersecurity Forum took place in Brussels, organised by E.DSO, EE-ISAC, ENCS and ENISA. The central message: regulation alone cannot close the distance between rapidly evolving threats and the energy sector's practical ability to respond. The factors cited were geopolitically motivated attacks, artificial intelligence and the rapid growth of connected energy technologies.

The context: the ENISA threat landscape

The forum follows the ENISA Threat Landscape 2026, which analysed 8,257 incidents affecting EU Member States and organisations based in the Union in 2025. The report finds that geopolitical developments continue to drive malicious activity, that attackers increasingly use AI, and that claims of OT-related intrusions are rising.

Lessons from Poland

Among the sessions were first-hand accounts of the coordinated attacks of December 2025 against the Polish energy sector. Numerous wind and solar farms were hit, along with a combined heat and power plant supplying heat to nearly 500,000 customers. Electricity production was not interrupted, but communications between the affected facilities and the distribution system operators were lost. The attackers had gained access that could have allowed more serious disruption.

The article reporting the news links the attack to a campaign based on the DynoWiper malware, which ESET attributes to the Russia-aligned group Sandworm. This is a third-party attribution and has not been independently verified here.

Ukraine: AI in support, decisions with people

Ukrainian transmission operator NPC Ukrenergo described how it strengthens cyber resilience while operating a grid under constant attack. It uses AI to help security teams react faster, identify gaps, support staff and assist with reporting, while critical decisions remain with humans. One difficulty remains: skilled cyber teams cannot easily be rebuilt through hiring.

Connected devices: aggregate risk

ENCS researchers showed how an attacker who has already compromised a home router or camera could reach a solar PV inverter or a residential battery on the same network. Some of these devices use control protocols that do not authenticate whoever sends a command, so the attacker might not need to breach the inverter or battery itself.

Compromising a single household would hardly affect the grid. Manipulating thousands of devices at once, however, could cause sudden swings in generation or demand and contribute to wider disturbances.

Recommendations

Key takeaways from the forum:

• Harm van den Brink (ENCS) calls for independent security testing, prioritised by the potential power involved, and for vulnerability management by manufacturers.
• Dimitra Liveri (ENISA) urges the sector to move from protecting individual systems to optimising the whole ecosystem for cyber resilience.
• NIS2 and the Network Code on Cybersecurity remain important, but cannot anticipate every emerging risk.
• Information sharing and cross-sector cooperation help direct scarce specialist resources towards the highest-impact risks.

What this means for those running OT systems

The Polish case is a reminder that losing communication between sites and operators is already an operational impact, even when production continues. Risk assessments should therefore cover visibility and remote control, not just plant availability.

Unauthenticated protocols, multiplied across large fleets of devices, create a risk that is invisible when looking at a single asset. Segmenting networks, isolating consumer devices from control devices, and demanding testing and vulnerability management from suppliers are concrete measures.

Finally, with security staff scarce, priorities should be set by potential impact. AI can speed up analysis and reporting but, as the Ukrainian experience shows, critical decisions must remain under human control. Note: this article summarises the forum and does not describe a new incident.