Digital Cyber-Physical Modeling and Risk-Constrained Multi-Agent Control of Virtual Power Plants with Performance-Linked Resilience Finance

Cyber incidents can disrupt many virtual power plant (VPP) assets through shared software and communication services. This study links preventive finance, cyber defense, dispatch, and restoration in one multi-timescale model. An attacker, a VPP operator, a bond vehicle, and a regulator interact in a partially observable stochastic game. The operator controls hardening, dispatch, isolation, and recovery. The bond provides restricted pre-event capital and releases collateral through an auditable index of service loss, control availability, network stress, and recovery delay. A risk-constrained multi-agent policy enforces power-system feasibility, investor impairment, sponsor affordability, and trigger–loss limits. Tests use transparent synthetic VPP-39 and VPP-118 portfolios and 20 out-of-sample seeds. The proposed design lowers normalized social cost to 0.691 and 0.704 and weighted basis risk to 0.065 and 0.071. It also improves critical-load continuity and restoration relative to self-insurance and three bond baselines. The VPP-118 case recovers in 11.8 h, compared with 14.3 h for the closest rule-based benchmark. Ablations separate the effects of finance and control. Removing the coupon–control link reduces verified hardening from 0.672 to 0.519. Removing the safety projection raises unsafe proposals from 0.4% to 5.9%. These results show that stochastic multi-timescale control can support adaptable and resilient VPP operation while keeping the financial mechanism within explicit risk limits.