Cyber incidents at renewable energy facilities matter to property underwriters because they can impair the systems that monitor, protect and shut down physical equipment, according to Bryan Kent (pictured), executive underwriter, technical risk at Northbridge Insurance.
In an interview with Insurance Business, Kent said that as facilities become more connected and automated, operators have to ask whether a cyber event could contribute to equipment damage or a prolonged outage. He said battery storage and newer technologies such as hydrogen and renewable natural gas (RNG) raise related questions about design, controls and operating experience, and that underwriters weigh the newer technologies differently from established solar and wind projects.
Kent said modern renewable projects increasingly rely on interconnected systems such as supervisory control and data acquisition (SCADA) platforms, battery management systems, energy management systems, remote monitoring technologies and digital protection controls. The technologies give operators greater visibility into asset performance and enable faster detection of and response to operational issues, he said, which helps efficiency and reliability.
Read more: Renewable operators underestimate how long a loss keeps them offline, Northbridge underwriter says
Increased connectivity also raises the stakes for protecting the systems that monitor and control physical assets, Kent said. From a property risk perspective, he said, the concern extends beyond the loss of data.
"Operators must consider whether a cyber incident, technology failure, or communications disruption could impair monitoring, protection, or shutdown functions, potentially contributing to equipment damage, safety concerns, or prolonged operational interruptions," Kent said.
As facilities adopt more advanced automation, "cybersecurity practices need to mature alongside the technology," he added.
He listed appropriate cybersecurity controls, disciplined software update and patch management, strong change management procedures and systems designed with resilience and recovery in mind. Those steps can reduce the likelihood that a cyber event affects critical operations or physical infrastructure, he said.
Kent said cyber insurance can play a role within a broader risk management strategy. Depending on policy terms and conditions, he said, coverage may help address certain costs associated with data restoration, incident response and business interruption from cyber events.
"As renewable energy operations become increasingly digitized, managing cyber risk is becoming an essential component of overall operational resilience," Kent noted.
Kent said battery energy storage systems (BESS) have changed the risk conversation by addressing the intermittent nature of renewable generation. They store excess electricity produced during strong solar or wind output and supply it back to the grid when demand rises or generation falls, he said, which improves grid reliability, project performance and the predictability of revenue. Discussions have shifted from power availability and intermittency to operational flexibility, resilience and efficiency, he said.
BESS also introduces risks of its own, he said. Kent named thermal runaway (a condition in which a battery cell overheats and can trigger a chain reaction affecting adjacent cells) as one of the most significant concerns. No single measure can completely eliminate the risk, he said, so the focus moves to prevention, early detection, containment and limiting propagation if an event occurs.
That makes system design and site layout critical from the outset of a project, Kent said. Battery chemistry, separation distances between units, battery management systems, thermal management controls, gas and smoke detection, emergency response planning and robust fire-propagation testing all play a role.
Kent described a broader shift in renewable energy risk management.
"The most effective risk mitigation strategies are increasingly established during the design phase rather than after construction is complete," he said.
Kent said the move toward hydrogen and RNG changes the underwriting process because the technologies do not have the operating history of solar and wind. For solar and wind projects, insurers can draw on years of performance data and an understanding of common loss trends and operational challenges, he said.
For emerging technologies, underwriting places greater weight on technology maturity, engineering design, the experience of developers and operators, the quality of equipment suppliers, testing protocols, control systems and the strength of the operating and maintenance framework, he said.
Read more: Swiss Re leader warns cutting off oil and gas too aggressively could undermine energy transition
The risks differ as well. Hydrogen facilities raise considerations around electrolyzer technology, high-pressure storage systems, ventilation requirements, gas detection capabilities, explosion protection measures and hazardous-area electrical equipment, Kent said. RNG and biogas facilities involve processing operations and specialized equipment that create exposures distinct from those of solar panels or wind turbines. Underwriters, he noted, "must evaluate a broader range of technical and operational risks when assessing these projects."
Despite those differences, the core approach remains the same, he said.
The objective is to understand the technology, identify risks, assess the controls in place to prevent or contain those risks, and evaluate the potential property damage and business interruption consequences, he added.
"As renewable energy technologies continue to evolve, underwriting practices must evolve alongside them to ensure risks are appropriately understood and managed,” Kent concluded.
