Investments in cybersecurity need to be supported by additional funding mechanisms, including amendments to the methodology used by Romania’s Energy Regulatory Authority (ANRE) to set electricity distribution tariffs, said Mihaela Suciu, CEO of Distribuție Energie Electrică România (DEER).

The company can currently allocate only part of its investment budget to cybersecurity, while its actual funding needs are considerably higher, she said during the Energy Cybersecurity Forum held in Cluj-Napoca.

“Regarding cybersecurity funding, you were right to point out that we do not yet have full recognition of these costs. We can allocate part of our investment programme to cybersecurity. However, we need significantly more funding, and for distribution operators, whose activities are regulated, this can only be achieved by changing ANRE’s methodology for setting distribution tariffs,” Suciu said.

The DEER CEO noted that distribution operators have been addressing the issue through the Federation of Energy Utilities Companies Associations (ACUE), but no final solution has yet been reached.

“We are discussing this through ACUE, together with all distribution operators. We are making efforts, and several years ago, when we ourselves were under cyberattack, we explained what had happened to us and highlighted the need for investment. We have been discussing the issue ever since, but we have not yet reached a final solution,” she said.

“A larger investment programme puts greater pressure on distribution tariffs”

Mihaela Suciu explained that the main challenge for distribution operators is striking a balance between the need to invest in infrastructure, including cybersecurity, and the impact of these investments on consumers’ electricity bills.

“All investments, connections, network extensions and maintenance activities are reflected in the distribution tariff included in the bill issued by each supplier. A larger investment programme therefore puts greater pressure on the distribution tariff,” the DEER CEO said.

According to Suciu, attracting European funding is one of the main ways to finance investments without placing additional pressure on distribution tariffs.

“We do not want to increase the distribution tariff. That is why I am constantly pushing, including with my colleagues in our large engineering department, for us to attract as much European funding as possible,” she explained.

She stressed that distribution operators are looking for additional funding sources that would not directly translate into higher costs for end consumers.

“That is where the key to striking a balance lies: between increases in end users’ electricity bills and what we can do in terms of investment, because investment is essential,” she added.

DEER CEO: The company had the courage to publicly acknowledge its cyberattack when companies were reluctant to discuss such incidents

The DEER CEO also discussed the company’s experience in dealing with a cyberattack, highlighting the importance of transparency and information-sharing in strengthening cybersecurity across the energy sector.

“In the field of cybersecurity, I believe we were among those who had the courage to publicly disclose, several years ago, that we had suffered a cyberattack. At the time, the industry was not so open. Many companies had already experienced cyberattacks, but these incidents remained hidden. People heard about them through unofficial channels, but nothing was publicly confirmed,” Suciu said.

She acknowledged that, at the time of the incident, the company lacked the experience needed to address all the challenges involved.

“We had the courage to say that we had been attacked and that we wanted to learn more. We did not have the necessary experience and were not prepared to respond to every challenge.”

According to the CEO, the incident prompted the company to improve its cybersecurity approach and explore new solutions.

“We managed to overcome that attack, which was a lesson for us at the time. We learned so much from that experience,” she said.

“We need a common approach and must defend ourselves together”

Mihaela Suciu explained that the Energy Cybersecurity Forum was established precisely because of the need for energy companies to adopt a coordinated approach to cyber risks.

“Four years ago, when we decided to organise this forum, we had a constructive vision: all distribution operators and all players in the energy market need to adopt the same approach and defend themselves together,” she said.

The DEER CEO pointed out that the interconnected systems used by energy producers, distributors and suppliers mean that the cybersecurity of one company also has implications for the others.

“Regardless of whether we operate in supply or generation, there are interconnections between us and between the systems we use. We therefore need to protect ourselves collectively: by protecting each individual company, we also protect everyone with whom we interact,” Suciu explained.

She emphasised that sharing experience and engaging directly with technology providers can help energy companies identify solutions tailored to their specific vulnerabilities.

“By organising the Energy Cybersecurity Forum, we have been able to discover and adopt new solutions that we did not previously have. Nobody has a monopoly on the absolute truth. There were solutions available on the market that I did not even know existed, but we learned about them,” she said.

Suciu encouraged forum participants to examine the solutions presented by specialised technology companies, as these could address specific operational and cybersecurity needs within the energy sector.

Discussions with ANRE continue: “We have not yet reached a final solution”

Returning to the issue of funding, the DEER CEO stressed that the recognition of cybersecurity costs within regulated activities remains unresolved.

In her view, amendments to ANRE’s methodology could create the necessary conditions for financing more substantial investments in the protection of energy infrastructure.

Suciu noted that distribution operators continue to pursue discussions on the matter, despite the fact that a definitive solution has yet to be identified.

“But hope is the last to die. We remain optimistic, and the fact that we are here shows that everyone shares an optimism they want to turn into reality – to make good things actually happen,” the DEER CEO concluded.