Australia's home batteries are now a cybersecurity compliance isue

For most of the past decade, a home battery has been treated as an energy decision, a way to store cheap solar during the day and use it after dark, with the main variables being price, warranty and payback period. Under new federal rules taking effect this year, it has also become something else: a network-connected consumer device subject to the same category of scrutiny CISOs already apply to enterprise IoT.

The Legislation Behind the Shift

The Cyber Security Act 2024, which came into force in late 2024, extended baseline protections to what the legislation calls consumer energy resources, a category that explicitly includes home batteries and the smart inverters that manage them. A companion set of rules, the Cyber Security (Security Standards for Smart Devices) Rules 2025, took effect in March 2026 and sets a mandatory security baseline for consumer-grade internet-connected devices more broadly, with batteries and inverters sitting squarely inside that definition for the first time. For an industry used to thinking about smart TVs and doorbell cameras as the entry-level IoT compliance conversation, home energy hardware capable of interacting with the grid is a meaningfully different risk category.

Why the Rules Exist

The reasoning behind the rules is not abstract. Solar inverters that are compromised can be used to manipulate active and reactive power output, which is enough on its own to trigger localised blackouts, and firmware tampering at scale has been shown to introduce harmonic distortion that physically stresses transformers and other grid infrastructure over time. Researchers and officials in several countries, including Australia, have also raised concerns in recent years about undocumented communication components discovered in some imported inverters and battery systems, hardware capable of enabling remote access that was never disclosed to installers or regulators. None of this requires a sophisticated attacker chaining multiple exploits together. A single compromised device with grid-facing controls is, by design, capable of doing more damage than a compromised laptop ever could.

A Fast-Growing Attack Surface

What makes this a live concern rather than a theoretical one is scale. Australia has one of the highest rates of rooftop solar ownership in the world, and battery attach rates have been climbing quickly on the back of falling prices and state-based incentive schemes. South Australia has been at the centre of that shift for longer than most, home to the country's original grid-scale battery at Hornsdale and to some of the earliest virtual power plant trials linking thousands of household batteries together to help stabilise the broader network. A search for solar battery Adelaide turns up exactly the kind of market this regulation was written for, dense residential battery uptake, active VPP participation, and a customer base that is going to be asking installers different questions than they were two years ago.

From Compliance to the Installer Conversation

That last point matters for how the rules actually land. Compliance obligations under the new framework sit primarily with manufacturers and importers, not installers or homeowners, but the practical effect flows downstream regardless. Installers working with well-documented hardware from vendors that can demonstrate compliance are going to have an easier conversation with security-conscious customers than those still moving older or less transparent stock. For a security industry that has spent years arguing that supply chain provenance matters as much as the device itself, this is a rare case of consumer regulation catching up to a principle CISOs have already internalised for enterprise procurement.

Redefining Critical Infrastructure at the Edge

The broader trend worth watching is what this does to the definition of critical infrastructure at the edge. A distributed fleet of millions of small, grid-connected devices sitting in garages and driveways was never going to fit neatly inside frameworks built around substations and control centres, but the cumulative effect of enough compromised endpoints is not meaningfully different from a more conventional infrastructure attack. Treating home batteries and inverters as a genuine IoT security category, rather than a purely consumer product concern, is a reasonable response to a fleet that has grown far faster than most people outside the energy sector seem to have noticed.

A Practical Note for Enterprise Security Teams

There's a narrower, more immediate implication for security teams at organisations that operate their own solar and battery installations, which is an increasingly long list once warehouses, retail sites and commercial properties are included. Those systems typically report telemetry back to a vendor cloud platform and, in growing numbers, participate in virtual power plant arrangements that give a utility or aggregator some degree of remote control over charging and discharging behaviour. That's a legitimate, contracted arrangement, but it's also a third-party integration with write access to physical equipment, which is exactly the kind of connection that would get flagged and reviewed if it involved any other category of operational technology. Treating it any differently just because the equipment sits on a roof rather than in a server room is worth reconsidering.

A Familiar Regulatory Pattern

There's also a familiar pattern here for anyone who has watched IoT regulation evolve in other categories. Rules tend to arrive well after the installed base has already grown large enough to matter, which means the compliance conversation right now is playing catch-up on millions of devices already deployed, not just the ones going in tomorrow. Retrofitting security into a fleet that size is a slower and messier process than building it in from the start, and it is a large part of why the mandatory baseline was framed around manufacturers and import controls rather than relying on voluntary uptake.

For security teams whose day job is enterprise networks, none of this changes much in the short term. But it is a useful data point on where regulation is heading more broadly: toward treating any sufficiently networked, sufficiently numerous device category as a genuine infrastructure risk, whether it sits in a data centre or on a suburban roof.