Australia just moved the boxes on its roofs from appliances to endpoints

Australia's rooftop batteries were sold as energy decisions. Under federal rules that took effect in March 2026, they are now something closer to corporate laptops with a side of grid hardware: regulated network endpoints sitting inside the same threat model a security team applies to any other connected device.

ChannelLife's reporting walks through the trigger. The Cyber Security Act 2024 extended baseline protections to a category the legislation calls 'consumer energy resources,' and the Security Standards for Smart Devices Rules 2025, in force since March, pulled batteries and smart inverters into that fold for the first time. A compromised inverter can push or pull active and reactive power, enough on its own to trigger localised blackouts, and the long-running worry is harmonic distortion wearing down transformers at scale.

The category the law uses is the story. Consumer energy resources now sit in the same threat model as enterprise connected devices, and the failure path that follows is the neighborhood's lights, not the homeowner's bill. Most readers will hear 'new cybersecurity rules' and think compliance paperwork for installers. The pattern is bigger: every networked consumer product is on the same slide from appliance to endpoint, and the harm scales with the grid it sits inside.

Anyone with a battery on the roof can now ask their installer the same questions an IT auditor would: where the firmware comes from, what sits inside the communications module, and what is logged. The reframe is silent. The obligation is not.