The State of Energy Sector Mergers & Acquisitions in 2026: Cyber Risk is Now a Valuation Metric

In today’s energy market, gigawatts alone don’t determine enterprise value; cyber resilience does. As geopolitical tensions rise and energy grids become more decentralized, 2026 marks the year when cyber security formally crosses the threshold from an operational concern to a deal-shaping financial variable.

The evidence is clear across every major incident and market signal from late 2025 through early 2026: energy assets are now assessed not only for financial performance, but for latent cyber debt, supply chain exposure, and operational continuity under duress. For acquirers, this shift is redefining diligence, valuation, and execution timelines.

From Russia’s disruptive Sandworm campaigns to China’s quiet pre-positioning and Iran’s asymmetric retaliation, state-linked threat actors are no longer probing utilities for intelligence but preparing for leverage.

• Sandworm (Russia) demonstrated in Poland that manipulating renewable energy telemetry can destabilize national grids without touching hardened thermal plants.
• Volt Typhoon (China) is silently embedding itself inside critical US infrastructure using living off the land techniques, compromising SOHO routers and cross-sector telecom providers to establish long-term strategic positions.
• IRGC-aligned groups (Iran) leveraged the January 2026 domestic internet blackout to mask outbound cyber operations targeting OT components across US water and energy environments.

These operations share a common theme.

Adversaries are exploiting the weakest seams in the modernized, decentralized grid: edge devices, third-party telemetry links, and overlooked supply chain components.

Cyber resilience influences asset valuation

In a market shaped by AI-driven electricity demand and aggressive decarbonization, deal volume remains strong. Under the surface, however, pricing has split sharply.

Assets commanding premiums

• Tested network segmentation
• Monitored remote access pathways
• Demonstrated island mode capability
• Strong supply chain visibility

Assets facing discounts or deal breakage

• Ivanti, Cisco, Fortinet, or Mikrotik vulnerabilities
• Legacy OT gateways with unpatched exposure
• High-risk hardware concentrations (e.g., Unitronics PLCs)
• Evidence of prior compromise or pre-positioning

In 2026, acquirers aren’t asking “Can we secure this after the deal?”— 
they’re asking, “Is this already compromised, and how much will remediation cost us?”

Regulators have raised the bar

Regulatory bodies are reframing energy M&A around national security, not antitrust.

The Committee on Foreign Investment in the United States (CFIUS) has expanded its mandate to review cyber posture and supply chain dependencies.

In the UK, the North Sea Transition Authority (NSTA) now evaluates cyber and national security credentials before approving transfers of strategic energy assets.

Elsewhere, supply Chain Readiness Level (SCRL) frameworks are increasingly required for diligence.

When a target cannot prove that its OT environment is free from foreign pre-positioning, deals are delayed, conditioned with costly mitigation requirements, or blocked outright.

The decentralized grid is a double-edged sword

The energy transition has transformed the grid from a centralized, hardened architecture to a vast ecosystem of renewables, batteries, microgrids, and vendor-managed devices.

This decentralization improves sustainability and flexibility but dramatically expands the attack surface.

Attackers now target:

• Telemetry routers at wind and solar sites 
• Battery storage controllers
• Vendor maintenance portals
• Internet-exposed PLCs and inverters

A single misconfigured device can give threat actors a foothold that bypasses traditional defenses. For M&A teams, these edge risks must be surfaced during diligence, not inherited after closing.