CyberStress developed stress tests to help regulators and grid operators assess the cyber resilience of modern energy systems.
The energy transition is driving the digitalization and interconnection of power grids, creating new attack surfaces. Smart devices, electric vehicle charging stations, and automated energy systems increase efficiency and flexibility, but at the same time create new entry points for attackers. A coordinated attack on a large number of interconnected devices could seriously disrupt grid operations and jeopardize the security of energy supply.
CyberStress developed a stress-testing methodology for power grids based on approaches already used by the European Central Bank to assess the resilience of the financial sector. The project supported authorities in evaluating the energy sector’s resilience to cyberattacks using models that simulate attack scenarios, identify critical vulnerabilities, and assess the potential impact on interconnected energy systems.
The consortium consisted of TU Darmstadt, e-netz Südhessen AG, the University of Cologne, and QGroup GmbH, with the German Federal Network Agency (Bundesnetzagentur) and Amprion as associated partners. A key focus was the investigation of attacks targeting decentralized high-performance devices, such as electric vehicle charging stations, which are outside the direct control of grid operators.
The researchers installed a real-world demonstrator in an actual transformer substation operated by e-netz Südhessen. There, an algorithm developed by TU Darmstadt continuously monitors power flows in real time and detects anomalies that could indicate an attack.
“The real-world demonstrator allows us to reproduce realistic attack scenarios and test detection and mitigation strategies under real-world conditions. This helps lay the foundations for grid operators to identify future risks at an early stage and ensure a reliable energy supply even in an increasingly digital world,” explains Prof. Florian Steinke from the Energy Information Networks and Systems research group at TU Darmstadt.
At the conclusion of the project, CyberStress provided the German Federal Network Agency with concrete recommendations for establishing such stress tests within the legal framework. CyberStress ran from May 2023 to April 2026 and was funded by the German Federal Ministry of Research, Technology and Space (BMFTR).
