Independent cyber-risk evidence on the hardware inside the projects you finance.
Lenders and insurers now answer for the cyber posture of the hardware they finance. 4cet is the neutral party that assembles the evidence — per fleet, per counterparty.
We assess three things: your fleet's setup × the device models in it × the rules of your jurisdiction → and deliver the evidence file your financier can rely on.
Annex to the independent engineer / lender's technical advisor report, plus a CP & covenant checklist item in the facility agreement.
Underwriting information set; open gaps become renewal conditions or named exclusions.
Shared read-only with lender and insurer; remediations tracked across pack revisions.
Depth first, scale second — what's real today vs planned
The problem
The hardware got financed before anyone could vouch for it.
Most utility-scale solar and storage runs on Chinese-made inverters and batteries — internet-connected, remotely updatable devices inside critical infrastructure. Under NIS2 and the EU cyber rules someone has to answer for them, and since May 2026 the wrong vendor can cost a project its EU-funding eligibility.
Increasingly that someone is the lender or insurer, not the operator — and the deal stalls on a diligence question nobody owns.
How it works
One library, assessed once. Evidence that compounds across every fleet.
Device Library
We research each device model once — control surface, comms, remote-access paths, advisory mappings, every fact cited. Every fleet on that model inherits the work.
Evidence Engine
For a fleet, the engine works out which frameworks actually bind it, then reconciles the operator's documents and network behaviour against only those controls.
Counterparty-ready pack
Findings land in the format each seat uses — IE-annex + covenant checklist for lenders, renewal conditions for insurers. Signed, versioned, time-bounded.
150 MW Spanish utility PV fleet · 426 inverters · 21 controls, every finding traceable to source.
Same engine, applied to storage. The 2026 EU funding restriction extends to BESS power-conversion systems — the axis already matters.
Not a vendor, not the manufacturer, not an auditor. We hold no position in the deal — our only product is evidence both sides can rely on.
See the sample evidence pack →