Security and Resilience of the Digitalized Flexible Grid

TL;DR. Every flexibility mechanism this wiki documents — millions of connected DERs, cloud aggregation platforms, the planned national DHV/FIS data backbone, remote-controlled effektregleringssystem — is also a new dependency and a new attack surface. Sweden is scaling all of them at exactly the moment it is elevating its totalförsvar posture. Two opposing movements result: aggregation concentrates control (one compromised platform ≈ a coordinated multi-MW event), while islanding decentralizes resilience (local microgrids that survive when the system fails). The security of the flexible grid is the management of that tension. This page pulls together threads currently scattered across Island Operation, Energy Storage, Demand Response, Elmarknadshubb, Flexibility, and Svenska kraftnät.

Why flexibility creates a security problem

Flexibility is, physically, the ability to change power flows on command. Digitalized flexibility means that command travels over networks — and anything that can be commanded can be commanded by the wrong party, or by the right party at the wrong scale. Four structural features of the flexible grid create the exposure:

1. Mass-connected end devices. Implicit and explicit DR depends on internet-connected heat pumps, EV chargers, BESS inverters, and solar inverters in the millions. Each is a long-lived (heat pumps: 15–20 years), often poorly patched, consumer-owned endpoint.
2. Aggregation concentrates control. A Virtual Power Plant or aggregator platform exists precisely to dispatch thousands of devices as one. The same architecture that makes small resources market-relevant makes them attackable as one.
3. Centralized data and registries. The DHV/FIS will hold national metering, contract, and flexibility-resource data in one place — efficiency and a single high-value target at once.
4. Remote actuation as a regulated requirement. Art. 6a flexible connections mandate a certified effektregleringssystem that a system operator can act on; controllability is becoming a legal precondition of grid access.

The OT/IT convergence that Energimyndigheten names as the primary risk driver is the through-line: operational technology that was once physically isolated is now reachable from IT networks (Source - Energimyndigheten Cybersäkerhet Energisektorn (web, 2026)).

The quantified threat — critical mass has arrived

The central Swedish finding is that the connected-DER fleet has reached a size where a coordinated attack produces system-level effects, not just local damage. RISE simulated this on the Nordic32 transmission test model (Source - RISE Cyberhot mot Elsystemet (2023), reproduced in Source - Energimyndigheten ER 2025-35 Förbättra Flexibiliteten (2025)):

The attack model: an adversary silently recruits a botnet of devices (via firmware vulnerabilities, compromised cloud services, or credential theft), then triggers a simultaneous step-change in consumption. RISE found a sufficiently large coordinated activation can push Nordic frequency outside normal limits before HVDC response and load shedding can absorb it. The harm is not the bricked device — it is system destabilization. Reference incidents: Ukraine (2015), New Orleans ransomware (2019).

This is generic across DER types. As the Energy Storage › Cybersecurity exposure page notes, the same ~1 GW of batteries that provides flexibility and resilience is itself the attack surface if inadequately secured.

The regulatory response layer — NIS2 in Sweden

The threat analysis now has a regulatory counterpart. Sweden’s Cybersecurity Act (SFS 2025:1506), transposing NIS2, entered force 15 January 2026 (Source - Energimyndigheten Cybersäkerhet Energisektorn (web, 2026)):

• Supervisor: Energimyndigheten is the designated NIS2 supervisory authority for the energy sector — the regulator DSOs, TSOs, generators, suppliers, and aggregators answer to on cybersecurity.
• Incident reporting: to Myndigheten för civilt försvar (MCF) — the successor to MSB for civil-defence functions (a naming change the wiki tracks across pages).
• Incident response: CERT-SE, Sweden’s national CSIRT.
• Six mandatory categories for energy actors: systematic risk management; incident handling; continuity/crisis planning; supply-chain security; security-effectiveness measurement; threat/vulnerability reporting.

A live gap: NIS2 supervises energy operators, but whether appliance manufacturers (heat-pump and EV-charger vendors) fall within the 50-employee / EUR 10M thresholds is unclear — leaving the consumer-endpoint layer, which RISE identifies as the actual attack surface, only partially covered. The EU Cyber Resilience Act is the complementary instrument targeting product security.

The concentration paradox

The efficiency case for digitalized flexibility and the security case point in opposite directions on one axis: concentration of control.

• Aggregation platforms are single points through which multi-MW portfolios are dispatched. CheckWatt’s CM10 fleet, Flower’s API-first DER platform, and any VPP are, from a security view, command-and-control servers for grid-connected actuators. A cloud compromise is a coordinated event by construction — the malicious mirror of the legitimate synchronization risk below.
• The DHV/FIS backbone centralizes national market and flexibility data. The government’s own assignment gives the security dimension unusual prominence: FRA, Försvarsmakten, SÄPO, MCF, and IMY are named required consultees, and the risk analysis must cover security-classified information and totalförsvar implications (Source - Uppdrag Centralt Datahanteringsverktyg (2025), Elmarknadshubb › The security dimension). This is a sharp change from the 2015 elmarknadshubb mandate and reflects how the threat landscape has shifted.

Mitigations recommended across sources push against concentration: network segmentation to limit blast radius, open communication protocols to distribute security responsibility across vendors rather than concentrating it in one proprietary codebase (Flexibility Communication Protocols), and least-privilege / allowlisting controls.

The decentralization counter-movement — resilience through islanding

The opposite design response is to make the grid survive loss of the centre. This is the resilience half of the page, and it is where flexibility resources earn a service that no market currently prices.

Ö-drift maps onto Svenska kraftnät‘s four operating states (Source - Energimyndigheten ER 2025-35 Förbättra Flexibiliteten (2025)):

The resilience capabilities are the same DERs, used differently:

• Distributed redundancy — geographically spread DERs have no single point of failure. The September 2025 Berlin incident (arson on two 220 kV lines → 60-hour outage for 50,000 customers) is the centralized-infrastructure counter-example (Source - Energimyndigheten ER 2025-35 Förbättra Flexibiliteten (2025)).
• Microgrids — Arholma (320 kW / 672 kWh BESS, ~250 residents) and Simris (12-hour islanding test) prove inverter-based island operation in Sweden (Island Operation › Swedish case studies).
• Synthetic inertia — batteries emulating rotational inertia, a preventive resilience capability Svk explicitly needs as synchronous mass declines.

But islanding has its own security and protection exposures, which is why the two movements are genuinely in tension rather than simply complementary:

• An isolated island has no external frequency support. A DER-botnet step-change that the mainland could absorb can destabilize a low-inertia island outright (Island Operation › Cybersecurity threats to island-sustaining DERs).
• Inverter fault currents (~1–2 p.u. vs 6 p.u. synchronous) break conventional protection in island mode, and grid-forming inverters suppress the very signals islanding detection relies on, widening the Non-Detection Zone (Island Operation › Unintentional islanding (oavsiktlig ö-drift)).

So decentralization buys resilience against systemic failure at the cost of harder local protection and a more fragile per-island stability envelope. Neither pure concentration nor pure decentralization is safe; the engineering problem is the balance.

The non-malicious twin — price-signal synchronization

Crucially, the botnet step-change has a benign cousin that produces the same physics without any attacker: implicit demand response synchronization. When enough households respond to the same price signal at the same instant, BRPs cannot forecast the aggregate and Svk faces large unplanned imbalances. A 2013 Elforsk study put the breakpoint at 100,000–700,000 simultaneously responding households — a range Sweden is now entering (Demand Response › Grid risks of demand response at scale). The 15-minute day-ahead MTU (from 30 September 2025) and the post-2026 solar+battery self-consumption switch at ~60 öre/kWh are emerging synchronization triggers of unknown magnitude.

The mitigations are the same in spirit as the cyber controls — desynchronize the fleet:

• Random startup delay (UK mandates up to 600 s for EV chargers), with a carve-out so FCR/FFR response is not blocked.
• NC DR staggered activation — TSOs and aggregators are required not to send simultaneous activation commands (Demand Response › NC DR staggered activation).

That a deliberate attack and an ordinary price signal can drive the same destabilization is the clearest statement of why security and market design cannot be treated separately in a flexible grid.

The total-defence dimension

Sweden’s framing has moved beyond commercial reliability to totalförsvar. FlexAbility’s fourth flexibility category — flexibilitet för beredskap — is the explicit recognition (Source - FlexAbility Delrapport 1 (2025), Flexibility › Flexibility for preparedness (beredskapsflexibilitet)). Concrete manifestations:

• Gotland — Typsituation 4: planning for a three-month island operation capability under MCF’s total-defence scenario “Attack against Gotland,” with heightened-readiness electricity demand assumed at least as high as normal (Island Operation › Gotland — total defence island operation planning). Wind/defence coexistence is analysed via the Försvarsmakten FRaM project.
• Svk civilplikt: a civil-duty workforce of ~1,000 personnel by 2028 (~58.8 MSEK/year from 2026) for electricity supply under war/crisis (Svenska kraftnät › Civil defense — civilplikt).
• Ö-drift as a localization principle: Svk cites civil defence as a reason to site dispatchable production near cities, embedding resilience into connection-planning geography (Island Operation › Framing and context).

The funding model is distinctive: Svk’s elberedskapsanslag compensates the cost of maintaining ö-drift capability — a grants mechanism, not a market payment. No Swedish market prices resilience or ö-drift capability explicitly, even though the same DERs could stack it as a third service alongside balancing and local flex revenue.

Synthesis — the core trade-off and what to watch

The flexible grid’s security posture is a balance between two designs that each fail in opposite ways:

What to watch:

• NIS2 manufacturer scope — whether heat-pump/EV-charger vendors are pulled in (closing the endpoint gap RISE identified) or left to the Cyber Resilience Act.
• DHV/FIS security architecture — how FRA/SÄPO/IMY requirements shape the September 2026 proposal; whether the single national data store becomes a single national target.
• Synchronization monitoring — measured effect of 15-min pricing and solar+battery self-consumption on coordinated load shifts.
• A market price for resilience — whether ö-drift/beredskap capability ever becomes a stackable revenue rather than a grants-funded cost.
• Gotland 3-month capability — whether it is formally funded as elberedskap or remains at planning stage.

The investable and policy reality: flexibility and security scale together, not in sequence. Every increment of digitalized, aggregated, remotely-actuated flexibility adds both a capability and a vulnerability, and Sweden’s total-defence context means the vulnerability side now carries weight it did not a decade ago.

Data gaps

• Whether NIS2 (SFS 2025:1506) captures appliance manufacturers, or only energy operators — the endpoint-security gap
• DHV/FIS security architecture decisions from the September 2026 proposal (FRA/SÄPO/IMY-driven)
• Whether any Swedish market will price ö-drift / beredskapsflexibilitet capability explicitly (currently elberedskap grants only)
• Measured synchronization impact of 15-min pricing and post-2026 solar+battery self-consumption switching
• Has RISE quantified the botnet risk for EV chargers or BESS specifically (not only heat pumps)?
• Gotland 3-month island capability — funded elberedskap commitment or still planning/analysis

Related pages

• Island Operation — ö-drift, microgrids, unintentional islanding, Gotland total-defence planning, protection engineering
• Energy Storage › Cybersecurity exposure — BESS as attack surface and as resilience asset
• Demand Response › Grid risks of demand response at scale — the non-malicious synchronization twin and its mitigations
• Elmarknadshubb › The security dimension — DHV security scope; FRA/SÄPO/MCF/IMY consultees; totalförsvar
• Flexibility › Flexibility for preparedness (beredskapsflexibilitet) — the fourth flexibility category; four operating states
• Flexibility Communication Protocols — open vs proprietary protocols as a security lever
• Svenska kraftnät — elberedskapsmyndighet role; civilplikt; system restoration
• Vehicle-to-Grid — V2G cybersecurity and the mobile-endpoint attack surface