© The Author(s) 2025. Published by EDP Sciences and China Science Publishing & Media Ltd.

1. Introduction

The intensification of global energy security and climate change issues has precipitated an urgent demand for the transformation of energy system towards low-carbon, clean, and sustainable models. With the objective of establishing an energy framework characterized as “clean, low-carbon, safe, and efficient”, the new power system has emerged as key infrastructure for achieving dual-carbon goals [1]. Its secure and stable operation is increasingly critical. However, the distinctive features of the new power system, including scale, renewable energy proportion, uncertainty, open interconnectivity, and the coupling of cyber system with physical system, expose it to complex and dynamic threats concerning both cyber and physical security [2].

Figure 1. Energy system cyber-physical attack events: A tree-branch classification of key attack vectors, vulnerabilities, and historical impacts

As shown in Figure 1, this tree-branch classification systematically categorizes core attack types targeting energy systems’ cyber-physical infrastructure [3]. The branching structure associates historical incidents with their exploited vulnerabilities (vuln.) and corresponding impacts. For instance, the 2015 Ukrainian power sector suffered a “Black Energy” attack [4], where hackers exploited Office vulnerabilities to remotely infiltrate the grid’s control system, issuing false circuit breaker trip commands. This led to power outages affecting approximately 220 000 people in three regions of Ukraine. The “3.21” 2018 Brazil blackout [5] resulted from protection missettings and control system failures, causing a loss approximately 21.73 million kilowatts and severely impacted 14 states in northern and northeastern Brazil. The “3.7” 2019 Venezuela blackout [6], suspected to be due to cyber attack, external attack, or corridor fires, affected around 30 million people. The “8.9” 2019 UK blackout [7], caused by the cascading failure of multiple units including offshore wind, distributed photovoltaics, and gas turbines, impacted about one million users. The February 2021 Texas power outage [8] was primarily due to extreme cold weather causing gas source freezing, leading to insufficient gas supply for natural gas units and resulting in shutdowns. These incidents underscore the vulnerability of the new power system in terms of cyber-physical security and highlight the necessity for robust defense measures against fault propagation across energy system.

These security incidents not only reveal the vulnerability of new power system in terms of cyber-physical security but also allow us to identify several major risks it faces:

(1) Cybersecurity attack: The deep integration of smart grid has formed a typical Cyber-Physical Power System (CPPS) with power system and information system. Cybersecurity attack targeting CPPS can compromise system integrity, confidentiality, and availability, potentially affecting stable operation and causing power outages [9].

(2) Information failure threat: In CPPS, information failures can lead to severe physical consequences. This involves analyzing the sources of information failure, the propagation process across domains, and calculating safety assessment indicators, which are key components in establishing a research framework for CPPS security assessment [10]. Therefore, accurate assessment of CPPS security under information failure threat and effective defense measures are essential.

(3) Vulnerability of open system: Cyber-physical convergence has transitioned power system from traditional isolated closed-loop system to an open system connected to external networks. Cybersecurity risks arise in the Cyber space and can propagate to the physical space through the connection between information and physics [2]. This openness increases system vulnerability, exposing power system to more potential threat [11].

(4) Risks from information technology applications: The deep application of information technologies such as cloud computing, the Internet of Things, artificial intelligence, and edge computing in grid physical system supports the operation and control of new power system but may also induce security risks from the cross-propagation of cyber and physical [12]. The introduction of these technologies increases system complexity and uncertainty, thereby raising security risks.

(5) Integrated security issues: As the power grid enters the stage of closely interconnected “power-information-business-man” smart grid, the cybersecurity of information system and the engineering safety of physical system are highly coupled, leading to integrated security issues for CPPS [13]. Existing CPPS security analysis techniques require further summarization and improvement to address these integrated security issues.

Therefore, it is crucial to conduct in-depth investigations into these risks from a scientific perspective. Specially, researching the cyber-physical security risks of new power system is of utmost importance in order to develop effective defense measures and ensure the secure and stable operation of the power system. By addressing these risks, we can enhance the resilience of new power system and mitigate potential threats, thereby safeguarding the overall stability and security of the power grid.

The main contributions of this paper are as follows:

(1) Analysis of Cyber-Physical Coupling Threat (CPCT): This work provides an in-depth examination of the interplay between information and physical system within new power system, elucidating the security vulnerabilities and challenges precipitated by shifts in power source configuration and grid topology.

(2) Dissection of Traditional Security risks: The manuscript offers a detailed analysis of the security risks inherent in the Sensing-Transmitting-DecisionMaking-Controlling (STDC) closed-loop of new power system, identifying vulnerabilities and potential attack vectors.

(3) Exploration of Emerging risks in Integrated system: This study investigates the novel risks associated with the Generation-Grid-Load-Storage (GGLS) integrated model, assessing their impact on the stability and operational integrity of power system in the context of contemporary threat landscapes.

While this study comprehensively covers the three primary dimensions of cyber-physical risks in new power systems – CPCT, STDC-loop vulnerabilities, and GGLS integration – it acknowledges certain boundaries. First, the analysis prioritizes technical threats (e.g., cyber-attacks, system misconfigurations) over socioeconomic factors (e.g., policy gaps, market manipulation), which are acknowledged as ancillary but critical drivers of systemic risk. Second, due to space constraints, case studies are selectively highlighted (e.g., 2015 Ukraine blackout, 2021 Texas outage) to illustrate key principles, though broader incident databases are referenced in supplementary materials. Third, the review focuses on established threats validated by empirical research, omitting speculative or nascent risks (e.g., quantum computing attacks, AI-generated adversarial samples) that fall outside the current threat landscape. Finally, while the GGLS integration framework is examined in depth, emerging paradigms like vehicle-to-grid (V2G) systems and blockchain-enabled peer-to-peer energy trading are briefly noted but warrant dedicated investigation in future work. By clarifying these boundaries, this review aims to provide a focused yet balanced synthesis of actionable insights for stakeholders in cyber-physical power system security.

Figure 2. Decoding cyber-physical risks in energy systems: A step-by-step analytical framework from macro to micro and traditional to emerging threats

The abbreviations and their full forms in this paper are listed in Table 1. The structure of this paper is organized as follows (Figure 2): Section 2 delves into the analysis of threat emanating from cyber-physical coupling within the context of new power system. Section 3 explores the traditional security risks inherent in the comprehensive closed-loop system, which encompasses sensing, transmission, decision-making, and controlling. Section 4 scrutinizes the emerging risks associated with the integrated model that includes generation, grid, load, and storage. In the concluding section, we synthesize our findings and delineate the new types of risks that new power system are anticipated to encounter in future environmental contexts.

2. Analysis of CPCT in new power system

This section establishes a theoretical foundation for understanding cyber-physical security risks in new power systems by analyzing CPCT. It achieves through three interconnected objectives: Defining CPCT Mechanisms, Providing Empirical Evidence and Characterizing New Risks. A thorough analysis of the coupling between cyber and physical system in the new power system is fundamental for addressing the broad functional safety issues.

2.1. Defining CPCT mechanisms

CPCT is formally defined as the synergistic security risks arising from the bidirectional interaction between cyber and physical domains in energy systems. Specifically, CPCT manifests when vulnerabilities in information systems (e.g., SCADA protocols, IoT devices) directly trigger physical consequences (e.g., grid instability, equipment damage) or when physical disturbances (e.g., power surges, equipment failures) propagate to cyber systems through data corruption or service disruptions. As shown in Figure 3, the dynamic interaction of information and energy flows in the new power system increases the fault correlation between nodes, significantly increasing the likelihood and pathways of cyber-physical security risks spreading across domains, forming typical coupled safety risks [14].

Figure 3. Examples of CPCT in the new power system

This coupling mechanism amplifies risks through three core pathways:

• (1)

  Cross-Layer Vulnerabilities: Exploitation of software/hardware flaws in control systems (e.g., PLCs, inverters) leads to physical malfunctions. For example, the 2015 Ukraine blackout was caused by malware manipulating circuit breaker commands in the SCADA system [5].

• (2)

  Data-Driven Interdependencies: False data injection Attacks (FDIA) on state estimation processes can mislead grid operators, as demonstrated in the 2019 Venezuela blackout where manipulated telemetry data disrupted load balancing [7].

• (3)

  Cascade Failures: Physical disruptions trigger cyber system overloads. The 2021 Texas power outage exemplified this through extreme weather-induced equipment failures cascading into communication network collapses [9].

These attacks typically follow a series of typical processes, often referred to as Coordinated Cyber-Physical Attacks (CCPA). CCPA systematically exploit vulnerabilities in both cyber and physical layers of power systems. These attacks involve multi-stage interactions between cyber intrusion, data manipulation, and physical sabotage, ultimately triggering cascading failures or large-scale outages, as illustrated in Figure 4. This attack process comprises four interdependent stages:

Figure 4. CCPA attack process: Cyber-physical interactions and sequential strategies. Key components include SCADA/EMS systems, state estimation, and physical infrastructure

(1) Initial Reconnaissance & Target Selection: Attackers gather system topology (e.g., via compromised RTUs/PMUs) and identify critical components (e.g., high-load transmission lines, weakly protected communication channels).

(2) Cyber Intrusion & Anomaly Bypass:

• Invade the power system and control SCADA/EMS systems, distorting state estimation results.

• Subvert anomaly detection modules (Sub-function 2.1 in Figure 4) to disable alarms, while simultaneously influencing dispatching decisions (Sub-function 2.2 in Figure 4).

(3) Dynamic Cross-Layer Interaction:

• Cyber Layer: Manipulate load/power flow measurements to mislead Security-Constrained Economic Dispatch (SCED) and induce artificial line overloads.

• Physical Layer: Execute sabotage (e.g., line disconnection) based on the compromised system state.

(4) Cascading Propagation: Combined cyber-physical disruptions propagate through the network, leading to equipment damage, economic losses, or grid collapse (e.g., IEEE 9-bus system failure).

For attacks related to CCPA, please refer to the latest survey articles [15]. Having established the theoretical framework and case precedents for CPCT, this section now shifts focus to its unique manifestations in new power system, where the deep integration of renewables, digital controls, and active distribution networks creates unprecedented attack surfaces and cross-domain propagation pathways.

2.2. Characterizing risks in new power system

The new power system integrates a complex cyber-physical system by extensively connecting various nodes, including new energy sources, traditional power equipment, diverse loads, energy storage devices, communication networks, and information systems. This integration, while enhancing system efficiency and flexibility, introduces a series of new safety challenges. Firstly, the potential for numerous security vulnerabilities or soft/hardware defects in these nodes increases the vulnerability of both power functional safety and cyber security. Secondly, to achieve efficient modulation of generation, grid, load, and storage in the new power system, frequent data exchange between the cyber and physical domains are required, further increasing system complexity and potential risks.

2.2.1. New safety issues triggered by changes in power source structure

With the power source structure shifting from controllable continuous output coal-fired installations to strongly uncertain, weakly controllable output new energy generation installations, the new power system faces a series of new safety issues. Kumar et al. [16] pointed out that the variability and intermittency of renewable energy, due to its dependence on climate conditions, can lead to power supply and demand imbalances, thereby affecting system frequency and voltage. These issues limit the penetration of renewable energy into the system. At the same time, the widespread use of power electronic devices may reduce the inertia of the entire system, causing voltage and frequency stability issues compared to traditional synchronous generators. Walker et al. [17] further pointed out that in photovoltaic system, information transfer is crucial for ramp rate control, voltage regulation, fault identification and isolation, and circuit configuration. Each component of the system can be a potential vulnerability, including advanced meters, inverter control, supervisory control and data acquisition, energy management system, weather monitoring, field sensors, actuators, and communications related to security system.

2.2.2. New safety issues triggered by changes in grid morphology

Changes in grid morphology also bring new safety challenges to the new power system. Traditional grids are mainly characterized by unidirectional step-by-step power transmission, while new grids are transforming into an energy internet that includes AC/DC hybrid interconnected large grids, microgrids, local DC grids, and flexible loads. Nejabatkhah et al. [18] emphasized that cyber-attack can have devastating effects on the stability of microgrids, especially in island mode, where the operation of power electronic dense microgrids depends on efficient and reliable data flows in the network system. Any delay or corruption of data can affect the normal operation of the physical system, endangering the efficiency, stability, and safety of smart grid. Antonov et al. [19] also pointed out that due to the complex connections between microgrid system and multiple entities, as well as the high degree of interaction with various users and administrators, microgrids have a wide attack surface. For example, the Advanced Metering Infrastructure (AMI) alone may have various different attack surfaces.

Furthermore, the digitalization, intelligentization, networking, and highly open interconnectivity characteristics of the new power system further expand the potential attack surface. Khoei et al. [20] provided an attack classification based on the Open System Interconnection (OSI) model and discussed in detail the cyber-attack targeting different layers of smart grid network communication. They pointed out that due to the infrastructure of smart grid connecting a large number of system, their hierarchical structure is crucial within the infrastructure. Smart grid include three main subnetwork: wide area network, neighborhood network, and home network. Gomez and Paradells [21] further pointed out that above these three subnetwork, there are three additional subnetwork, namely field area network, local area network, and building area network, all of which increase system complexity and potential security risks.

Through the above analysis, we can see that the threat faced by the new power system in terms of cyber-physical coupling are multifaceted, involving changes in power source structure and grid morphology. These changes not only bring technical challenges but also impose new requirements on security defense strategies. In the following sections, we will further explore the traditional security risks faced by the new power system in the STDC broad closed-loop, as well as the new risks under the integration of GGLS.

3. Traditional cyber-physical security risks in the STDC broad closed loop of new power system

While CPCT analysis reveals the intertwined nature of cyber-physical threats, this section shifts focus to the orthogonal security challenges rooted in the STDC framework itself. By deconstructing vulnerabilities across each phase of the STDC lifecycle, which is from sensor data integrity to control command execution, this analysis identifies critical attack surfaces that could disrupt the closed-loop’s observability, predictability, and stability.

Figure 5. Cyber-physical fusion in power systems: The STDC loop as the bedrock for grid stability and security

3.1. STDC description

As shown in Figure 5, the STDC closed-loop integrates four interdependent phases that collectively ensure grid visibility and controllability. The STDC closed-loop operates through a cyclical workflow:

• (1)

  Sensing Phase: Deploying IoT sensors to collect real-time grid parameters (voltage, frequency, load).

• (2)

  Transmitting Phase: Transmitting sensor data via communication networks (5G, fiber optics) to control centers.

• (3)

  Decision-Making Phase: Processing data through state estimation, contingency analysis, and optimal power flow calculations.

• (4)

  Controling Phase: Implementing adjustments to generation/load via SCADA/EMS systems.

This structured workflow ensures grid resilience under normal conditions. However, as demonstrated in recent cyber incidents, including the 2015 Ukraine blackout and 2021 Texas outage, compromise at any phase can trigger cascading failures. The following subsections dissect vulnerabilities specific to each STDC phase, supported by historical attack data and technical root cause analyses.

3.2. Risks in STDC

New power system, built upon the foundation of smart grids, still cannot avoid traditional cyber-physical security risks despite their significant structural changes. These risks permeate the STDC broad closed loop of new power system. Figure 6 illustrates the location of these security risks within the system based on attack types and targets.

Figure 6. Traditional cyber-physical security risks in the STDC broad loop of new power system

3.2.1. Security risks in the sensing phase

In the sensing phase of data acquisition, Zhang et al. [22] demonstrated the manipulation of sensor or power reference measurement data through Data Integrity Attack (DIA), which can mislead decision-making system and affect their scheduling outcomes. Additionally, Li et al. [23] showcased how replay attack on sensor control commands can be repeated or delayed, further compromising the authenticity and timeliness of data.

3.2.2. Security risks during transmitting phase

During the data transmission process, Zeller [24] described the Aurora attack, where attackers can arbitrarily open or close generator circuit breakers, causing asynchronous power generation and subsequently inducing power grid oscillations. Liang et al. [25] introduced an FDIA that induces physical line overloads, thereby compromising critical grid components such as protective relays, circuit breakers, and SCADA systems. Yuan et al. [26] defined a specific type of FDIA as Load Redistribution Attack (LRA), which can manipulate the load distribution of the power grid. Soltan and Zussman [27] discussed line outage concealment attack, where the attacker first cause short-term damage such as voltage violations and line overloads, then hide their attack actions by covering measurements in the attacked area through Denial of Service (DoS) or FDIAs.

3.2.3. Security risks in DecisionMaking and Controlling phases

In the DecisionMaking and Controlling phases, Choi et al. [28] discussed the use of DoS attack to flood target networks with false traffic, making it difficult for photovoltaic system control servers to operate normally. Zhao et al. [29] analyzed stealthy attack in smart grids based on consensus protocols. References [30] and [31] mentioned that attackers can enter the SCADA system through methods such as spear-phishing attack, watering hole attack, SQL injection, weak passwords, buffer overflows, and command injection, directly controlling the program interface of the substation system with malicious code, or controlling power equipment by fabricating and tampering with instructions with malicious code.

New power systems face diverse cyber-physical threats across the STDC loop, as summarized in Table 2. These attacks exploit vulnerabilities in both cyber and physical domains, leading to cascade failures or operational disruptions. Through the above analysis, it is evident that new power systems face various traditional security risks in the STDC broad closed loop. These risks not only affect the integrity and reliability of data but can also pose a serious threat to the stable operation of the power system. In the following sections, we will explore the new risks faced by the new power system under the integration of GGLS and further discuss how to synthesize these risks to develop effective defense strategies in the conclusion.

4. New risks in the GGLS integration of new power system

Building upon the foundational analysis of CPCT and traditional STDC-loop vulnerabilities, this section transitions to the emerging risks unique to the GGLS integration paradigm, which is the cornerstone of new power system architectures. These discussions elucidate the intricate balance between GGLS’s operational benefits and its amplified security demands.

4.1. GGLS description

The GGLS integration paradigm represents a transformative shift towards bidirectional energy flow and cross-domain interdependence. As visualized in Figure 7, this integrated architecture connects Distributed Energy Resources (DERs), smart grids, responsive loads, and energy storage systems into a unified ecosystem [32]. The GGLS establishes a carbon-centric architecture to achieve new power system objectives. The core driving force (Carbon) drives three interconnected domains:

• (1)

  Generation-Side: Enhances observability, measurability, and controllability of power sources through digital twins and state estimation.

• (2)

  Grid-Side Energy: Ensures resilience via AC/DC hybrid topology optimization and real-time situational awareness.

• (3)

  Consumer-Side: Analyzes user behavior to enable demand-response interactions and load flexibility.

The Storage module bridges energy supply-demand gaps across timescales, while the Digital layer provides technical foundations including AI-driven optimization and secure data flows. This holistic architecture, illustrated through color-coded functional modules and directional arrows, inherently introduces cross-domain interdependencies that will be systematically analyzed for security risks in subsequent sections.

Figure 7. Carbon-driven multi-domain coordination framework with digital foundation for new power system optimization

4.2. New risks in GGLS

As the structure of new power system evolves, especially under the backdrop of GGLS integration, the system faces a range of new security risks. These risks permeate all parts of power generation, grid, load, and energy storage, as illustrated in Figure 8.

Figure 8. New risks under the integration of GGLS in new power system

4.2.1. Power generation stage

Renewable energy sources (e.g., photovoltaics, wind turbines) introduce intermittency challenges and reliance on inverters, which are susceptible to cyber-physical attacks. For example, new components such as distributed photovoltaic modules are susceptible to inverter attack [33, 34], which may lead to coordination issues between photovoltaic power generation and system operations, and even new risks such as physical access and component theft [35]. Microgrids, due to their singular structure and simple mode, experience significant disturbances when attacked in the power generation part [36].

4.2.2. Electric grid stage

AC/DC hybrid architectures and microgrids create complex interconnection topologies. The direct grid connection of distributed power generation modules exposes measurement data and control commands, making data consistency vulnerable to disruption. Through means such as Global Positioning System (GPS) spoofing attack [34], new load balancing redistribution attack [37], and Automatic Generation Control (AGC) attack [38], an attacker can alter measurement data, affecting decision-making content. Aurora attack [39] and line outage masking attack [40] are methods that can construct control commands to carry out threatening operations. More seriously, time-delay attack, where an attacker injects delays in perception and execution channels, disrupts system decisions and severely affects system stability [36].

4.2.3. Distributed load stage

Demand response systems and energy storage facilities face unique threats. Disruptions to the frequency and voltage of the power system through means such as FDIA are increasingly a concern. FDIA misleads the control system by injecting false data, leading to incorrect scheduling decisions and affecting the safe and stable operation of the power system [41, 42]. In addition to FDIA, pricing attacks are also a potential security threat to power system. Pricing attacks, through illegal means to intervene in the electricity market’s billing system, can lead to economic losses and market trust crises [43].

4.2.4. Energy storage stage

The energy storage subsystem in modern power grids presents unique operational vulnerabilities, particularly when exposed to cyber-physical disruptions targeting its dispatch control infrastructure. Such attacks compromise grid stability through two primary pathways: (1) direct exploitation of energy storage facilities (e.g., battery management system compromises) and (2) indirect manipulation via corrupted dispatch algorithms. For instance, [44] documents how adversarial commands injected into EMS can override optimal charging/discharging schedules, impairing frequency regulation capabilities during peak demand periods. Concurrently, malicious firmware exploits in dispatch software may induce erroneous state estimation outputs, triggering maladaptive energy allocation decisions that exacerbate supply-demand imbalances during off-peak intervals. These combined effects – ranging from localized equipment dysfunction to cascading grid instability – underscore the critical need for cyber-physical resilience in energy storage integration.

4.3. Cyber-physical impact analysis

When attack affect specific components, it can have a physical impact on the operational safety and stability of new power system, leading to safety failures or accidents and ultimately affecting the resilience of the entire system, as shown in Figure 9. Attacks on AMI and Smart Communication Network (SCN) can disrupt the communication infrastructure of the smart grid, with transmitted data including state estimation parameters, control signals for generators, load signals, pricing signals, etc. [45]. An attacker can perform DoS attack, malware propagation attack, data manipulation attack, and even endanger consumer privacy by analyzing customer load profile data. When attack can disrupt machines in control centers responsible for controlling demand response commands and sending remote connect/disconnect commands, they can directly affect grid resilience by changing loads and increasing load times without communication between working units [46].

Figure 9. Diagram of the cyber-physical impact of power system attacks

In summary, the new risks faced by new power systems under the GGLS integration are multifaceted, involving both physical and information security. Moreover, as technology advances, the inherent vulnerabilities of devices and the potential risks of data manipulation have become key variables [47]. These risks not only affect the integrity and reliability of data but also pose a serious threat to the stable operation of power systems. To address these challenges, it is imperative for new power systems to implement robust security measures that can adapt to the evolving landscape of cyber-physical threats, ensuring the resilience and reliability of the energy infrastructure.

5. Conclusion

This paper provides a comprehensive analysis of the security risks in new power system under the cyber-physical integration environment. This study covers cyber attack, information failure threat, vulnerabilities of open system, risks brought by information technology applications, and integrated security issues. By delving into the coupling issues between power system and information system, the paper reveals the security challenges faced by new power system amidst changes in power source structure, grid morphology, and the STDC broad closed-loop. Additionally, this paper analyzes the new risks faced by new power systems under the GGLS integration background, posing a serious threat to the stable operation of power systems. This research not only enhances the understanding of cyber-physical security risks in new power system but also provides a theoretical basis and practical guidance for the development of effective defense measures in the future.

Looking forward, as new power system gradually evolve towards a cloud-edge collaborative architecture, they may encounter a series of new security risks, including but not limited to:

• (1)

  Increased difficulty in defending against unknown vulnerabilities: With the increasing complexity of system, the difficulty of defending against unknown vulnerabilities and unknown attacks (i.e., zero-day attacks) also increases, which may exploit unknown flaws in system design to pose a serious threat to the stability and security of power system [48].

• (2)

  Security challenges of cloud-edge collaborative architecture: The cloud-edge collaborative architecture improves system response speed and data processing capabilities by extending data processing and storage from central clouds to edge nodes. However, this also increases the attack surface, as more edge nodes may become targets for an attacker [49].

• (3)

  Risks brought by Large Language Models (LLM): With the increasing application of artificial intelligence and machine learning technologies in power system, the use of large language models may introduce new security risks. These models may be maliciously exploited or may produce misleading results during training and inference processes, thus affecting the decision-making and control of power system [50, 51].

• (4)

  Supply chain attacks: As power system become more dependent on external components and software, the risks of supply chain attack also increases [52, 53]. Attackers may implant malicious software or hardware at some point in the supply chain, thereby causing damage to power system unknowingly.

• (5)

  Data privacy and protection issues: As power system collect and process large amounts of user data, data privacy and protection issues become increasingly important [54]. Any data breach or improper handling may lead to a loss of user trust and even violate data protection regulations.

• (6)

  Cross-industry attacks: As power system become interconnected with other critical infrastructures (such as transportation, communication, and water treatment systems), the risks of cross-industry attack also increases. These attack may spread from one domain to another, causing more extensive damage [55].

To address these potential future risks, new power system need to adopt a more comprehensive and forward-looking security strategy, including strengthening system monitoring, raising security awareness, developing advanced defense technologies, and formulating emergency response plans.

Acknowledgments

We would like to express our gratitude for the constructive suggestions offered by the anonymous reviewers.

Funding

This work was supported by the National Natural Science Foundation of China under Grant 61833015, the Program for Innovation Leading Scientists and Technicians of ZhongYuan under Grant No. 224200510002.

Conflicts of interest

The author declares no conflict of interest.

Data availability statement

No data are associated with this article.

Author contribution statement

Huihui Huang designed this study, performed the experiments, and contributed to the writing of the manuscript. Yunkai Song analyzed the data and helped draft the manuscript. Qiang Wei provided critical materials and tools. Yangyang Geng participated in the design of this study and performed the statistical analysis. Hongmin Wang helped in drafting the manuscript and provided final approval of the version to be published. All authors have read and approved the final manuscript.

References

Huihui Huang is a Ph.D. candidate in the School of Cyber Science and Technology, Information Engineering University, China. His research interests include the application of bilevel optimization in smart grid.

Yunkai Song is a Master’s candidate in the School of Cyber Science and Technology, Information Engineering University, China. His research interests primarily center around the field of demand response in the electricity market and industrial control system security.

Qiang Wei is currently a professor in Information Engineering University, China. His research interests include network security, industrial internet security and vulnerability discovery.

Yangyang Geng is currently a lecturer in the School of Cyber Science and Technology, Information Engineering University, China. His research interests include cyber-physical system security, and network security.

Hongmin Wang is currently pursuing her Ph.D. degree in the Information Engineering University, China. Her research interests include safety and security of industrial control system, including intrusion detection and risks assessment.

All Tables

All Figures

	Figure 1. Energy system cyber-physical attack events: A tree-branch classification of key attack vectors, vulnerabilities, and historical impacts
In the text

	Figure 2. Decoding cyber-physical risks in energy systems: A step-by-step analytical framework from macro to micro and traditional to emerging threats
In the text

	Figure 3. Examples of CPCT in the new power system
In the text

	Figure 4. CCPA attack process: Cyber-physical interactions and sequential strategies. Key components include SCADA/EMS systems, state estimation, and physical infrastructure
In the text

	Figure 5. Cyber-physical fusion in power systems: The STDC loop as the bedrock for grid stability and security
In the text

	Figure 6. Traditional cyber-physical security risks in the STDC broad loop of new power system
In the text

	Figure 7. Carbon-driven multi-domain coordination framework with digital foundation for new power system optimization
In the text

	Figure 8. New risks under the integration of GGLS in new power system
In the text

	Figure 9. Diagram of the cyber-physical impact of power system attacks
In the text