Cyber-physical security · BESS · BMS · OT
Secure the systems that store and move energy.
A battery site is not a data centre with cells in it. Every control path ends at something physical — a contactor, a charge rate, a protection setpoint. BatterySec assesses both halves together: the way the system can be compromised, and what happens electrically when it is.
01 — The problem
Conventional IT security stops where the consequence starts.
An enterprise security programme is built to protect confidentiality and data integrity. Those matter here too. But in an energy-storage environment the asset that gets damaged is rarely a database — it is a cell, a contactor, an inverter, or a grid commitment.
The systems that decide charge and discharge behaviour — the BMS, the PCS, the EMS — are increasingly reachable from outside the site. Firmware on these devices is designed to be updated remotely, which is exactly what makes it an entry point worth studying. Interference with charge or discharge behaviour is not a data-loss event; it is a thermal and electrical one.
The gap is rarely a missing firewall. It is that nobody has mapped, in one place, which digital paths can reach which physical behaviours — and what the protection layers do when they arrive.
WHAT MAKES IT CYBER-PHYSICAL
The question is not only can an attacker get in. It is: if a command arrives that is technically valid and operationally wrong, what stands between that command and a physical outcome — and is that thing independent of whatever was compromised?
02 — What we assess
From cell chemistry to cloud API, assessed as one system.
Each layer has its own failure modes and its own specialists. Risk concentrates in the joins between them, which is where an assessment scoped to a single layer will not look.
Physical and electrical
Cells, modules, racks, DC distribution, protection and isolation devices, thermal management, enclosure and site access. The layer where consequences are realised.
Embedded control
BMS and PCS firmware, safety limits, setpoint handling, update and signing mechanisms, debug and service interfaces, and the local logic that is supposed to refuse an unsafe instruction.
Site network and supervisory
EMS, SCADA, PLCs, gateways, historians and the industrial protocols between them. Segmentation, authentication on control protocols, and whether an operator action and an attacker action look different in the logs.
Remote access and cloud control
Vendor maintenance access, VPNs and jump hosts, fleet-management platforms, APIs, mobile and web interfaces, and the identity model behind all of them. Usually the shortest path from the internet to a setpoint.
Supply chain and third parties
Integrators, O&M contractors, component vendors and their standing access. Who can reach the system, through what, with which credentials, and what is contractually required of them.
03 — Capabilities
Work we take on.
Scoped to what a specialist can actually deliver, not a menu of everything adjacent to the word security.
Cyber-physical risk assessment
Map the system, identify paths from a digital foothold to a physical or operational consequence, and rank them by what they would actually cost you.
BESS and BMS security review
Battery-specific: charge and discharge command handling, protection independence, state reporting integrity, firmware update and service interfaces.
OT network and segmentation
Site architecture, zone and conduit design in line with IEC 62443 concepts, protocol exposure, and whether segmentation survives a maintenance window.
Remote access and cloud control
The vendor-access path end to end: identity, brokering, session control, what a support engineer can reach, and what is logged when they do.
Architecture and design review
Assessment before construction, when a finding costs a drawing revision rather than a site visit and an outage window.
Threat modelling
Structured modelling against your actual topology and operating model — including insider and contractor paths, not only external intrusion.
Security testing and validation
Targeted testing of the priority paths, agreed in advance, with methods chosen to avoid risk to live plant.
Monitoring and detection design
What to collect from OT and control systems, and how an abnormal control action would become visible rather than being buried in normal traffic.
Supplier and procurement support
Security requirements for BESS, BMS and integrator contracts, and technical review of what a vendor answers.
04 — Approach
Six steps, and you can stop after any of them.
Each stage produces something usable on its own. Nothing depends on committing to the whole programme up front.
Map the system
Single-line and data-flow together. Which devices exist, what they command, who can reach them, and through what.
Model credible paths
From entry point to physical consequence, using your topology and operating model — not a generic threat catalogue.
Evaluate controls and dependencies
Whether each control is independent of what it protects. A protection layer sharing a compromised controller is one layer, not two.
Test the priorities
Agreed scope, agreed methods, agreed blast radius. On live plant this is deliberately conservative.
Produce a remediation plan
Ordered by consequence and effort, written so an engineering team can act on it without a translation layer.
Validate the fix
Re-test what was changed. A finding is closed when the path is closed, not when a ticket is.
05 — Who this is for
Organisations that own the consequence.
Start with your actual system.
Tell us what you operate or build. We will come back with what a review would cover and where we would expect the risk to sit.