As vehicle-to-grid (V2G) technology evolves, its cybersecurity risks grow—requiring robust, built-in defenses to secure EVs, charging infrastructure, and the grid against complex threats amid the rise of decentralized, connected energy systems.
26 Jul 2025 | 4687 Views | By Abhinav Kalia, ARC Electric
As electric vehicles (EVs) become an integral part of global energy systems, vehicle-to-grid (V2G) technology changes how energy can flow between vehicles and the grid. V2G allows for bidirectional energy flow, advancing the ways vehicles can transfer energy. In addition to being an energy consumer, EVs can act as mobile ...
This is an Autocar Pro Plus article. Subscribe to continue reading.
As electric vehicles (EVs) become an integral part of global energy systems, vehicle-to-grid (V2G) technology changes how energy can flow between vehicles and the grid. V2G allows for bidirectional energy flow, advancing the ways vehicles can transfer energy. In addition to being an energy consumer, EVs can act as mobile energy storage devices that can supply electricity to the grid during peak demand (known as peak shaving). In addition to the obvious benefits of V2G, decentralized energy generation and storage, increased energy resiliency, effective integration of renewable energy, and real-time energy balance, it also creates an entirely new and complex cybersecurity landscape.
As energy systems converge with connected vehicles, this synergy gives way to new vulnerabilities. Electric vehicles and V2G infrastructure involve multiple touchpoints; vehicles, charging stations, grid operators, third-party aggregators and cloud technology. Each touchpoint represents a potential interface for cyber intrusion and if the V2G technology is not secure, the same ability to transfer energy in both directions, can be used to potentially disrupt the energy infrastructure.
Understanding the V2G Attack Surface
The basic design of a V2G system relies on real-time communications between EVs and the grid through charging infrastructure, which normally includes an automated charging capability. As an example, ISO 15118 describes the plug-and-charge model for EV/grid communications while the Open Charge Point Protocol (OCPP) describes the network communications interface with charging stations. While these are standards, they also introduce different levels of the V2G attack surface where data, commands, and energy need to be authorized and secured.
The risks include:
Gaining unauthorized access to charging stations, manipulating charging rates or performing denial of service attacks.
Data spoofing or man-in-the-middle attacks during EV/grid communications and align, integrity of the energy transfer may no longer be honored.
Fleet level operations and ransomware threats targeting the charging networks.
Firmware updates to chargers and/or EVs, which can create back doors into broader utility systems.
For example, if compromised an EV charger may be the inroad to a local substation’s network. And a fleet of EVs are infected with code, it could be weaponized as part of an attack to overload or destabilize sections of the grid.
Security-by-Design in V2G Systems
To address these threats, cybersecurity needs to be embedded within the foundational design of systems. This “security-by-design” approach will require hardware-level to software-level, as well as charging stations to cloud coordination for grid management.
Key elements are:
The Regulatory and Standards Perspective
At a global level, regulators and standards organizations are starting to recognize cybersecurity in V2G deployments. The U.S. Department of Energy, the National Institute of Standards and Technology (NIST), and the European Union Agency for Cybersecurity (ENISA) have all released guidelines which provide their stance on cybersecurity for smart grids/EV infrastructure.
Innovation is happening considerably faster than regulations are written. For instance, although ISO 15118 has provisions for security, implementation of security in ISO 15118 is highly variable. Finally, there is an imminent update of compliance frameworks, threat modeling protocols, and collaboration between OEMs, utilities, and cybersecurity firms.
Building a Resilient V2G Future
As energy systems become more distributed, software-defined, and data-driven, cybersecurity will serve as a foundation for grid stability and public trust. V2G technology's promise is in its ability to decentralize and democratize energy, but that must be grounded on safe and secure infrastructure.
There is no question that investing in proactive cybersecurity strategies is a technical "need" but also a prerequisite to allowing for safe, reliable, and resilient V2G scaling. Cybersecurity must develop from an ancillary program to a design principle as we start to build a grid of the future.
Abhinav Kalia is the CEO and Co-founder of ARC Electric. Views expressed are the author's personal.