Europe’s Zero Day: how energy investments and foresight can keep the lights on

"Every time we can do the right thing, it's another chance to save it.” These words, from Robert De Niro’s character in the Netflix thriller Zero Day, resonate deeply across Europe this spring, following the massive and prolonged power outages in Spain and Portugal this week.

In Zero Day, a fictional US President is called out of retirement to lead an investigation into a nation-stopping grid attack – a scenario echoing real-world anxieties on both sides of the Atlantic.

The difference in today’s Europe, however, is that Zero Day remains a warning rather than reality, thanks to years of collaboration, regulation, and shared vigilance that have given governments and businesses the tools to take necessary steps when it matters most – and to do it together.

Maintaining momentum is as much about mindset as it is about investments, according to Marco Carta, Chief Executive Officer and Head of Utilities and Renewables Units at AGICI, a Milan-based research and consulting firm specialised in the utilities sector.

‘Exceptional event’

“The blackout in Spain represents an exceptional event in the history of the European electricity market,” Carta told Energy Connects. Until the ongoing investigation bears its fruits, “it is crucial to avoid unfounded speculation that attributes the cause to single factors such as renewable energy, alleged cyber-attacks, or extreme weather conditions,” he added.

Whatever their actual cause, the disruptions that plunged millions into darkness from Madrid to Lisbon and even Southern France have key implications for the industry and serve as a stark reminder of the industry’s main challenge. They “underscore the importance of continuing decisively on the path of energy transition, while also strengthening the infrastructures and technologies needed to face the challenges associated with an increasingly decarbonised and digitalised electricity system,” Carta said.

“The energy sector is one of the most critical ones for Europe and was therefore rightly categorised as such by the Network and Information Systems (NIS) directive of 2016. The national competent authorities have set useful working structures like the CSIRT network, the NIS Cooperation Group, and the EU-CyCLONe network. But further exchange of best practices, work on taxonomy, and common processes would be useful. I would also see added value to further promote systematic feedback from the respective cybersecurity authority to the notifier of a significant incident."
- Goran Gotev, Adviser for Cybersecurity Policy at Rud Pedersen Public Affairs in Brussels

Grid operators have been investing for years to ensure the security and resilience of the electricity distribution. A recent study by AGICI (The Role of Utilities and Their Networks in Achieving a Net-Zero Economy) highlights that Europe’s top 12 operators invested more than 30 billion euros in 2024, an increase of 6 billion euros compared to 2023. In Italy alone, investments by the main energy network operators exceeded 10 billion euros last year and are expected to rise to 14 billion euros in 2025.

Building security through cooperation

Governments, regulators, utilities, and businesses across the European Union share the responsibility of protecting member nations’ grids from threats ranging from cyber-attacks and terrorism to cross-border dependencies and natural disasters.

“The energy sector is one of the most critical ones for Europe and was therefore rightly categorised as such by the Network and Information Systems (NIS)  directive of 2016,” said Goran Gotev, adviser for Cybersecurity Policy at Rud Pedersen Public Affairs in Brussels. That legislation was the EU’s first move toward a common security strategy for critical infrastructure. Since then, coordinated bodies such as the CSIRT network, NIS Cooperation Group, and EU-CyCLONe have provided the framework to act decisively and collectively across borders.

“The national competent authorities have set useful working structures like the CSIRT network, the NIS Cooperation Group, and the EU-CyCLONe network,” Gotev explained to Energy Connects. “But further exchange of best practices, work on taxonomy, and common processes (i.e., for incident handling and reporting) would be useful. I would also see added value to further promote systematic feedback from the respective cybersecurity authority to the notifier of a significant incident.”

“The blackout in Spain represents an exceptional event in the history of the European electricity market... It is crucial to avoid unfounded speculation that attributes the cause to single factors such as renewable energy, alleged cyber-attacks, or extreme weather conditions. The outages underscore the importance of continuing decisively on the path of energy transition, while also strengthening the infrastructures and technologies needed to face the challenges associated with an increasingly decarbonised and digitalised electricity system."
- Marco Carta, CEO and Head of Utilities and Renewables Units at AGICI

Gotev was quick to clarify that true cooperation means acting wisely together – balancing transparency and discretion. While “actionable and real-time intelligence” is critical to grid security, it does not mean “vast disclosure of actively exploited vulnerabilities, especially if these haven’t been addressed and critical customers haven’t patched their systems,” he said.

No silver bullets, but strong shields

Over the past five years, the EU has enacted landmark policies – from the Cyber Security Act to NIS 2, DORA, and the Cyber Resilience Act. Each aims to ensure the right actions are taken, at the right time, by the right actors.

The challenge now, as Gotev noted, is “identifying how all these provisions will interact with each other and ensure that neither authorities nor essential service providers eventually have to comply with overlapping, sometimes even conflicting, requirements.”

Europe is not at “zero,” years of cross-border cooperation and shared regulation have built the habits of resilience, not just redundancy. “Utilities, supported by national public policies, are decisively focusing on technologies such as energy storage systems and demand response – both essential for continually improving grid stability and ensuring a secure electricity supply in an ever-evolving context,” AGICI’s Carta said.

Looking ahead, the goal is not to avoid every crisis – which would be an impossible task – but to ensure that each time the lights flicker, action and resolve shine brighter than fear.