As DER deployments expand across the grid, asset owners need practical tools to understand their own security exposure. Specifically, which device commands and registers are reachable by an unauthenticated attacker on their network? As part of a DOE-funded research effort, we built a protocol fuzzing toolkit targeting DNP3, SunSpec Modbus, and IEEE 2030.5, designed to help operators map their unauthenticated attack surface and identify protocol implementation vulnerabilities before someone else does.

Building and using these tools surfaced a consistent and counterintuitive finding: the newer, better-designed protocols are in some ways easier to attack. Legacy Modbus creates friction for the attacker by hiding behind opaque register addresses, forcing an attacker to obtain vendor documentation to know what register 10000 controls. SunSpec Modbus changes this entirely: its self-describing model registers let any client walk the register space and immediately know what each control point represents, without documentation or prior reconnaissance. IEEE 2030.5 adds TLS and client certificates, but presents the same fully self-describing surface the moment a certificate leaks or validation is misconfigured, collapsing instantly to the same exposed state. The interoperability properties that make modern DER protocols easy to integrate also make them easy to target.

In this talk, we'll walk through the attack surface exposed by each protocol, what the fuzzer targets and why, and what the output looks like in practice, including how the self-description properties of SunSpec and IEEE 2030.5 change both the depth of the findings and the speed at which an attacker (or defender) can act on them. We'll then show how we layered AI on top to make the tooling more accessible and the results more actionable, closing with a recorded demonstration of the full pipeline against a simulated DER cluster.