Enpal is a German Energy-Tech company, founded in 2017, that has scaled to serve over 100,000 customers, positioning itself as Europe's leading residential decarbonization platform. Its core operation installs integrated solar packages - including panels, battery storage, EV chargers, smart meters, and heat pumps - into homes, but the attack surface is defined by the digital layer. The proprietary Enpal.One+ platform networks these thousands of physical systems, using AI to optimize energy consumption and actively manage feed-in to the energy market, turning distributed residential assets into a virtual power plant.
For a security team, the threat model is hybrid: protecting customer PII and billing data on a massive scale, while simultaneously defending the operational technology (OT) layer of networked inverters, batteries, and smart meters from manipulation or takeover. The platform's role in real-time energy optimization and market participation means availability and data integrity are non-negotiable; a compromise could disrupt grid-balancing algorithms or physically stress connected hardware. Work spans securing cloud infrastructure, the AI/ML pipeline, APIs, and the IoT endpoints embedded in the 5-in-1 hardware packages deployed across Germany and expanding internationally.
