A great success for the PGS and DSS research team: their study on “PV Inverter Cyber Security – Assessment of the systemic threat to grid stability” has won the 2026 Roland Langthaler Prize.
This further highlights the AIT’s expertise – as Austria’s largest non-university research institution – in the fields of applied energy research and the transformation of electricity grids.
Study assesses the systemic risks to grid stability
Photovoltaics has long since become a central pillar of the European energy transition and, by 2024, was already accounting for 11 per cent of the EU’s electricity mix. During the sunniest midday hours, its share across the entire ENTSO-E grid already averages over 30 per cent, rising to over 50 per cent of the load on peak days. As a result, system control is increasingly shifting to cloud-based manufacturer infrastructures. Modern inverters therefore no longer function merely as power converters, but as networked Internet of Things (IoT) grid-edge devices, the cyber security of which is becoming increasingly relevant to the stability of the electricity grid.
As a study by AIT researchers Stefan Übermasser, Matthias Eckhart, Oliver Jung and Michael Denk (EI-JKU, as co-author) shows, this development is given added significance by a high level of market concentration: just twelve manufacturers account for 85 per cent of the global market, with China clearly dominating global production of photovoltaic products with a 78 per cent share. This also brings the issue of cyber security into sharp focus: vulnerabilities that have come to light at several market-leading manufacturers highlight that a large number of devices could potentially be manipulated from a central location. In continental Europe, an ENTSO-E reference disturbance scenario of 3 GW applies; this means that, in the event of a worst-case power failure, the European electricity grid would have to compensate for a sudden loss of 3,000 megawatts of capacity. A careful assessment of the potential impacts of a possible coordinated manipulation of decentralised generation plants on the grid frequency appears sensible from the perspective of security of supply.
The analysis focuses on a regulatory gap analysis at EU and national level: due to size thresholds, the majority of PV systems do not fall within the scope of the NIS2 Directive, which requires European companies and organisations to comply with strict security standards in order to protect themselves against cyber-attacks, ransomware and digital sabotage. Furthermore, the Cyber Resilience Act currently only requires manufacturers to provide a self-declaration for inverters as standard. As a national case study, the study examined Austria’s current TOR framework in depth. This framework concerns the contribution made by Austria’s energy infrastructure – such as power stations, wind turbines and solar installations – to stabilising the overall European grid.
Specific recommendations for action are derived from this: the assessment of whether grid-connected inverters should be classified as “critical products” under the Cyber Resilience Act; the use of the Network Code on Cyber Security to strengthen manufacturer standards; the clarification of the TOR cybersecurity clause to include minimum technical profiles, along with its extension to Type B installations and product whitelists; and the hardening of security-relevant firmware parameters.
The study was carried out by the AIT Centre for Energy and the Centre for Digital Safety & Security in cooperation with the Energy Institute at Johannes Kepler University (JKU) on behalf of Austrian Power Grid AG (APG) and provides a practical, regulatory-based contribution to securing decentralised energy generation as an integral part of the Austrian and European grid infrastructure.
Success through applied research
The Roland Langthaler Prize was established by Österreichs Energie and VERBUND and was awarded for the second time this year. The prize recognises outstanding strategies, initiatives, scientific work and technological solutions in the energy sector. This year’s Roland Langthaler Prize was held under the theme ‘Resilience in times of global upheaval: How is Europe shaping its energy future?’.
The award ceremony took place on 16 September 2026 as part of the Österreichs Energie Congress at the Hofburg in Vienna.
Link to the press release from Österreichs Energie: https://www.ots.at/presseaussendung/OTS_20260916_OTS0212/roland-langthaler-preis-2026-fuer-arbeit-zur-cybersicherheit-von-pv-wechselrichtern