Cyber Resilience as a Pillar of European Energy Security

Europe’s energy system is entering a new era of exposure. Digitalisation, climate stress, geopolitical tensions, and increasingly complex supply chains are creating intertwined vulnerabilities across electricity, gas, oil, and hydrogen networks. Cyber threats are escalating: According to ENISA’s Threat Landscape 2025, energy is consistently among the most targeted sectors for sophisticated cyber operations. At the same time, volatility in electricity wholesale markets and disinformation campaigns can amplify disruptions across the entire energy ecosystem.

Overcome Siloed Approaches

Despite the strengthening of the EU framework through NIS2, the CER Directive, the Cyber Resilience Act, Seveso III, and energy-specific Network Codes, regulatory implementation remains fragmented. Cyber, physical, climate, market, and hybrid risks are often addressed separately, leading to parallel risk assessments and divergent supervisory expectations. Governance fragmentation is linked to overlapping instructions for operators, separate threat models used by different authorities, and inconsistencies in supply chain oversight.

Towards Systemic Cyber Resilience

To embed cyber resilience in energy regulation, the paper identifies a set of actions:

1. Regulatory consolidation in the short term: Prioritise full, harmonised implementation of NIS2, CER, and CRA across Member States before introducing new legislative layers.
2. Creation of a European Programme for Critical Entities Resilience (EPCER): A renewed operational platform to support cross-sector exercises, stress testing, best-practice exchange, and hybrid threat preparedness.
3. Long-term structural evolution: Introduce a DORA-like regime for lifeline infrastructures, starting with energy, to impose stronger vendor oversight, audit rights, substitution strategies, and supervision of systemic digital service providers.

A Strategic Approach

The paper concludes that cyber resilience requires a shift from compliance-driven security to a systemic, anticipatory, and strategically integrated resilience model that empowers Europe’s energy systems to deal with disruptions as much as long-term pressure.