GridSEAL
A security and evidence layer for EV charging networks. It will sit beside your back-end, catch rogue commands and seal the record your auditor checks.
First release targeted for about Q2 2027About GridSEAL
Securing critical infrastructure,
from EV charging to the grid.
Charging networks, vehicles and the grid are becoming one connected system. We’re building the security layer that keeps its commands verified, limited and provable, beginning with GridSEAL for EV charging networks.
First release targeted for about Q2 2027. We’re taking on design partners now.
Network overviewDemo data
Charge points
14,820
Sites
212
Open incidents
1
NIS2 clock
23:57:30
Site risk
- Critical1 site
- High9 sites
- Medium47 sites
- Low155 sites
Detections
INC-0412 CriticalRule FW-07
Unsigned firmware pushed to 6 DC charge points
Contract certificate from an untrusted root0411
One identity on two TLS client certificates0409
A charging session crosses four links
Each link has a different owner and a different rule. GridSEAL starts at the back-end, where one account can reach a whole network.
Vehicle to charger
In a study of 325 DC chargers, 12% supported TLS on this link.
ISO 15118-20 applies to new or renovated points from 1 January 2027.
The charger
It’s a networked computer on a public site, and its firmware is an update path.
The Cyber Resilience Act binds charger makers.
Charging back-end
GridSEAL starts hereCISA issued at least 15 advisories on these platforms from January to October 2026.
NIS2 binds operators, including their supplier risk.
The grid
Vehicle-to-grid adds commands that move real power, so each one needs limits.
GridSEAL Grid is on our roadmap.
Evidence your auditor doesn’t have to take on trust
GridSEAL links each line of a record to the line before it, then signs the result. Change a line later without the signing key and the record stops matching.
Try to alter this record
Pick a change, or click a line and type your own. The check runs in your browser as you edit.
Checking the record…
102:14:07 Firmware update sent to 6 charge points, with no signature3c26df3e…ad79
202:14:19 Rule FW-07 flagged the update, from account ops-1768ca8fb7…03f0
302:15:41 3 vehicles found charging, so those sessions kept runningb53fa680…d9cc
402:17:12 Action ACT-7781 approved by the duty manager, using a passkey0e7cd33d…3ee8
502:18:41 Update cancelled and ops-17 suspended7e10b2fb…8cbd
602:18:53 Record sealed with 41 evidence items1e6afc94…f2fc
1. Your auditor receives the record
It comes as a file with its signature, and they keep their own copy.
2. They check it on their own computer
A small open-source checker is planned, so they can rerun the checks offline without our system.
3. They read the result
It either matches or it doesn’t. If the stored fingerprints survive, it also shows the first changed line.
Technical detail and limits
This sample uses fictional data, SHA-256 and a throwaway Ed25519 key, and the check above is real. The signature covers the record’s ID, operator, line count and final fingerprint.
It shows that edits after sealing are caught. It doesn’t show key independence, because the public key ships with this page, or trusted timestamps, or that the original entries were complete and true. GridSEAL’s sealed packs and offline checker are planned for the first release, with hybrid ECDSA P-256 and ML-DSA-65 signatures. How auditable records work
Who we build for
Charge point operators
Know your chargers, act without stopping sessions, and show what happened.
See how
Charger makers
CRA reporting has applied since 11 September 2026. Find affected units and keep the clock in view.
See how
Charging-software vendors
Answer your customers’ security reviews without building a security team.
See how
MSSPs and telco SOCs
Add EV-charging detections to the service you already run.
See how
GridSEAL, and the research behind it
GridSEAL Grid
Will secure the whole vehicle-to-grid chain, from vehicle to grid operator, so each dispatch can be verified, bounded and stopped.
Roadmap, design partners onlyRead about V2G
Research prototypes from AEGIS
Separate from GridSEAL, for the charger and the lab. Tested with Pilot 7 on a live 5G-connected charging network.
PST-QEdge
Detection and response at the charger
Research prototype
PST-GridTrace
Inventory of devices, firmware and certificates
Research prototype
PST-ThreatClone
Attack simulation in a sandbox
Research prototype
EV charging is becoming grid infrastructure. Its security has to keep up.
PinakashieldTech builds security for critical infrastructure, starting at the charging back-end, where one account can reach a whole network. Vehicle-to-grid is next, because once vehicles feed power back, charging commands move real power.
Today
Secure the back-end
GridSEAL will put detection and signed evidence where one account can reach a whole network.
Next
Secure the dispatch
GridSEAL Grid will make each dispatch verifiable, bounded and stoppable, from vehicle to grid operator.
Long term
Secure the commands that move physical systems
We will bring limits, named approval and checkable records to wider critical infrastructure.
What the public record shows
We found no verified attack on an EU charge point operator. The weaknesses are documented, though, and operators now have to show how they manage them.
Jan to Oct 2026
CISA issued at least 15 advisories on EV-charging back-ends. The six from 26 February all list missing authentication on charger connections.
May to Jul 2026
Germany’s BSI published a report on public charging and a position paper. The paper proposes OCPP 2.0 or later with at least Security Profile 2.
2025
A USENIX Security study of 325 DC chargers in four countries found that 12% supported TLS on the vehicle-to-charger link. None supported ISO 15118-20 or mutual TLS.
Scale
The EU27 reached about 1.18 million public recharging points by September 2026. BSI’s 2026 report, using Open Charge Alliance data from August 2025, found that about 91% of OCPP-certified products are certified for version 1.6.
EU research behind the work
Our work comes out of two EU-funded projects, and the prototypes they produced were tested in an EU pilot.
AEGIS
Security for the EV-charging ecosystem in O-CEI Pilot 7, Lombardy. Tested with the pilot on a live 5G-connected charging network, and now complete.
About AEGIS
PATHSHIELD
Secure communications research in 6G-PATH open call 2, on the Fraunhofer FOKUS testbed, including an edge node at Charité, using simulated traffic.
About PATHSHIELD
Co-funded by
the European Union
the European Union
AEGIS received funding from O-CEI (Horizon Europe, Grant Agreement 101189589), open call Challenge P7C3. This reflects only PinakashieldTech OÜ’s view. Neither the O-CEI Consortium nor the European Commission is responsible for any use that may be made of the information it contains. The 6G-PATH project has received funding from the Smart Networks and Services Joint Undertaking (SNS JU) under the European Union’s Horizon Europe research and innovation programme under Grant Agreement No 101139172. This reflects only PinakashieldTech OÜ’s view.
Supported by
All partners
Guides and incident reviews on charging security
Ten security questions for your charging back-end supplier
What to ask before you sign or renew, why each question matters, and what a good answer sounds like.
OCPP security profiles in plain English
How a charger proves who it is to your back-end, what each profile protects, and what no profile covers.
Six charging back-ends, one weakness: the February 2026 CISA advisories
On one day, CISA published six advisories on charging platforms that all listed missing authentication on charger connections.
Questions security teams ask first
More answers, including what we don’t have yet, are on the trust page.
Is GridSEAL available today?
Not yet. The first release is targeted for about Q2 2027, and parts of it have run on a demo bench or in EU research. See what exists today on the GridSEAL page.
Do you install anything on our chargers?
No. GridSEAL will work from a back-end export or a read-only API. An optional network sensor is planned for depots that want one.
What happens if GridSEAL goes offline?
Charging carries on. GridSEAL sits outside the charging path, so an outage on our side doesn’t stop a session.
Does GridSEAL meet our NIS2 duties for us?
No. Your duties stay yours. GridSEAL will produce evidence for specific articles, such as Art. 21 measures and Art. 23 reporting, and a person signs each report.
Can GridSEAL act without a person?
No. Rules detect and a person approves. Actions will run through your charging back-end, and some steps, such as a firmware install, can’t be undone.
What does the health check involve?
It’s free and takes one to two weeks: an outside-in scan plus one read-only export, under an NDA, a DPA and written scan authorisation. You get a written report.
Know where your network stands in two weeks
A free health check: an outside-in scan plus one read-only export, with a written report. Nothing is installed.
What comes next
A six-week paid pilot at one site, with success criteria agreed up front. Then an annual subscription: evidence first, then Detect and Contain.