When Solar Roofs Become a Cyber Risk
Photovoltaics have become indispensable to Switzerland’s electricity supply. At the same time, every new grid-connected system creates a new digital vulnerability. An analysis by the National Cybersecurity Testing Institute shows that the risk does not lie primarily with individual rooftops. It arises where thousands of inverters are connected via a small number of manufacturers’ clouds.
By the end of 2025, approximately 338,000 grid-connected photovoltaic systems with a peak capacity of about 9.5 gigawatts had been installed in Switzerland. They produced just under 8 terawatt-hours of electricity, covering 13.7 percent of final electricity consumption. On sunny afternoons, they regularly supply more than half of current consumption. On July 4, 2026, their share stood at around 85 percent at 2:00 p.m.
This is changing the architecture of the power grid. Alongside a few large power plants, there are now hundreds of thousands of small, digitally controlled systems. Each one is insignificant for the grid on its own. Together, they form critical infrastructure.
An attack can scale
Over the course of about a year, the NTC examined seven inverters and four energy management systems from eight manufacturers. These devices are in use in thousands of Swiss households and businesses. The experts identified over 50 security vulnerabilities, including seven critical and six high-severity ones. Five of the eleven products tested had at least one critical or high-severity vulnerability.
For four products, the test team succeeded in gaining complete control over the device. Furthermore, for nearly all of the inverters tested, it was possible to change how much electricity the system fed into the grid via a local interface without logging in. In extreme cases, the feed-in could be reduced to zero.
The Cloud as a Lever
The real danger lies not only in individual security vulnerabilities but also in their scope. Many systems are connected via their manufacturers’ cloud platforms. These platforms are used to install firmware updates, monitor systems, and often provide access for maintenance.
If an attack on such a central instance were to succeed, thousands of systems could be affected simultaneously. According to the NTC, six of the documented findings affect a large number of devices via central components. This is precisely what can jeopardize the stability of the power grid.
The company found no evidence of intentionally built-in backdoors. Most manufacturers responded quickly after receiving the confidential report and have already patched the vulnerabilities. Nevertheless, the structural risk remains. Product security alone does not eliminate the dependence on a small number of remote access points.
Security Starts with Installation
The investigation also shows that cybersecurity is crucial during commissioning. Installation companies should set unique access credentials for each system, ensure inverters are not directly accessible from the internet, disable unnecessary interfaces, and isolate the system from the home or corporate network.
For property owners, clear questions must be addressed at handover. Who installs updates? Who responds in the event of an incident? Are unique passwords set? Is remote control truly necessary? For larger systems, the NTC recommends conducting an inventory of all interfaces and remote access points, as well as including mandatory security requirements in requests for proposals.
Regulation is lagging behind
The electricity industry’s minimum ICT standard is aimed at organizations and applies only to generation facilities of 100 megawatts or more that can be controlled via a single system. It is not designed for the roof of a single-family home. However, the problem arises precisely from the aggregate of these small-scale installations.
The NTC therefore recommends minimum requirements for inverters and energy management systems prior to market release, safety requirements as a condition for grid connection, and a clearly defined responsibility for the overall risk. The safe expansion of photovoltaics is not a counter-project to the energy transition. It is a prerequisite for it.