Cybersecurity and Vulnerabilities in Switzerland’s Solar-Grid Network
Why connected inverters, supplier concentration and procurement choices now deserve national attention
A strategic warning for a fast-growing solar sector
Switzerland is adding solar capacity at a pace that is reshaping how electricity is produced, monitored and balanced. More than 338,000 photovoltaic systems are connected to the grid, according to Swiss public broadcaster SRF in reporting on a study by the National Test Institute for Cybersecurity (NTC). [1] That expansion brings clear climate and energy benefits, but it also places thousands of network-connected control devices inside homes, businesses and public buildings. The key device is the inverter: it converts the direct current produced by panels into alternating current compatible with the grid, while also managing protection, monitoring and, in many installations, remote commands. [1]
The NTC warning is not that every foreign-made inverter is malicious, nor that a blackout is inevitable. The concern is structural. Many installations depend on a small number of suppliers, and many inverters maintain links to manufacturer cloud services for diagnostics, firmware updates and operational control. A vulnerability, compromised account, faulty update or coercive remote command could therefore affect many systems at once. [1]
Why the inverter has become a cyber-physical target
An inverter is not merely a power-conversion box. It is an operational-technology device connected to sensors, meters, gateways, batteries, installer portals and sometimes utility control systems. The U.S. Department of Energy warns that internet-connected inverters face greater exposure than stand-alone operational equipment, and that a cyber incident can create physical consequences, including loss of power or damage to equipment. [2] [2]
The attack surface can include weak or reused passwords, outdated firmware, exposed web interfaces, insecure application programming interfaces, poorly protected cloud accounts and remote maintenance channels. Technical reviews also identify unauthenticated or weakly protected protocols, including Modbus, DNP3 and SunSpec, as possible paths for interception, replay or manipulation when they are badly configured. [5] [5]
The Swiss exposure: concentration and remote access
The NTC study reported by Swissinfo says that around 100,000 Swiss installations use inverters from China, while Huawei and Sungrow together account for more than 60% of the domestic inverter market. [1] These figures should be read as indicators of concentration risk, not as evidence that a named supplier has attacked Switzerland. Concentration matters because a single software flaw, stolen administrative credential or common update mechanism can create a shared failure mode across otherwise independent sites. [1]
The same reporting describes a hypothetical coordinated shutdown or manipulation of a large manufacturer’s devices. The electrical effect would depend on timing, weather, system size, grid conditions, protection settings and the ability of operators to isolate affected assets. A mass event is therefore a scenario for stress testing, not a forecast. Swiss utilities and regulators should still model it because distributed solar can change voltage, frequency support and local power flows within seconds. [1]
A separate Reuters investigation reported that U.S. experts had found undocumented communication equipment, including cellular radios, in some Chinese-made inverters and batteries. Reuters could not establish how many devices had been inspected, identify the manufacturers or confirm a Switzerland-specific compromise; the U.S. government had not publicly acknowledged the discoveries at the time of publication. [4] The responsible conclusion is narrower: buyers need verifiable inventories of hardware, firmware and communications functions, especially when equipment can reach critical infrastructure. [4]
What a resilient response should look like
A credible response should combine technical controls, procurement rules and operational readiness. Banning a product solely because of its country of origin may reduce one form of exposure while leaving the same weaknesses in another supplier’s equipment. Switzerland needs requirements that can be tested and audited.
Know what is installed. Create an authoritative register of inverter models, firmware versions, owners, installers, cloud endpoints, remote-access permissions and grid connection points. Public authorities cannot manage a dependency they cannot measure.
Reduce unnecessary remote reach. Use outbound allow-lists, strong multifactor authentication, separate administrator accounts, certificate-based access and time-limited maintenance sessions. Where remote operation is not required, disable it rather than relying on a password alone.
Demand secure-by-design equipment. Tender documents should require secure boot, signed firmware, vulnerability disclosure, patch timelines, logging, incident notification, software bills of materials and a documented list of every radio and network function. NIST’s IR 8498 provides seven practical guidelines for small-scale smart-inverter deployments. [3] [3]
Segment the grid edge. Residential and commercial PV devices should not sit on the same trusted network as business systems or utility control assets. Gateways, firewalls and monitoring tools should enforce least privilege and detect unusual commands or synchronized behavior.
Test the coordinated-failure scenario. Grid operators should simulate the loss or misconfiguration of a large cluster of inverters, then verify how quickly they can identify affected models, block malicious traffic, restore safe settings and communicate with installers and customers.
Build a supply chain that can recover. Supplier diversity is useful, but resilience also requires spare hardware, local technical capacity, escrowed configuration data and an update process that does not depend on a single overseas service.
The policy question is trust, not technology alone
Solar power is not the problem. Connected control systems are what change the security equation. A distributed energy system can be cleaner and more flexible than a fossil-heavy system, yet still become fragile if procurement focuses only on purchase price and nominal efficiency. The security of an inverter depends on design, configuration, update practices, operator discipline and the legal environment around the vendor.
Swiss procurement agencies should therefore treat inverter cybersecurity as a lifecycle requirement. A low-cost device that cannot be independently inspected, patched or disconnected may create a larger long-term liability than a more expensive device with transparent security controls. This does not require rejecting all foreign technology. It requires evidence: auditable software inventories, tested access controls, clear accountability and a credible exit plan.
Closing Thoughts
Switzerland has an opportunity to secure its solar expansion before a serious incident forces rushed decisions. The central lesson is simple: every inverter that can receive a remote command is part of the energy system’s cyber perimeter. The answer is not fear of solar power or automatic suspicion of a nationality. The answer is verifiable design, limited access, transparent supply chains and practiced recovery. A resilient energy transition is one that remains dependable when a device fails, a supplier is unreachable or an attacker finds a weakness.
What is the practical takeaway here?
Treat the inverter as critical equipment, not as an appliance. Owners should ask who can reach it remotely, how updates are authenticated, whether the device can operate safely offline and how incidents are reported. Installers, utilities and public buyers should keep accurate inventories, segment networks and require security evidence before equipment is connected.
How does this impact us?
For households, the immediate issue is usually loss of generation or monitoring rather than a nationwide blackout. For utilities and public authorities, the stakes are higher because many small systems can create a common dependency. The choices made today about passwords, cloud access, firmware support and supplier diversity will influence whether Switzerland’s solar growth becomes a source of resilience or a collection of hidden single points of failure.
Video references
The following videos and recordings provide useful context for readers who want to hear the technical discussion directly:
References
[1] Swissinfo / SRF, “Cyber flaws in solar systems pose risks to Swiss power grid,” 17 September 2026. Source
[2] U.S. Department of Energy, “Solar Cybersecurity Basics.” Source
[3] NIST, “Cybersecurity for Smart Inverters Webinar,” 29 January 2025. Source
[4] Reuters, “Rogue communication devices found in Chinese solar power inverters,” 14 May 2025. Source
[5] Riurean et al., “Securing photovoltaic systems as critical infrastructure: A multi-layered assessment of risk, safety, and cybersecurity,” Sustainability, 2025. Source
Comments