In January 2026, a suspected arson attack triggered a power outage in Germany, leaving over 45,000 homes without electricity.1 About seven months later, cyberattacks on water systems across at least seven US states caused operational disruptions, in some cases contributing to loss of water pressure and flooding.2
Critical infrastructure has always been exposed to disruption from natural hazards, physical attacks, espionage, and cybercrime, plus a range of other potential intrusions. What is evolving is the speed, complexity, and confluence of these threats. Physical attacks and natural hazards now coexist alongside threats exploiting digital vulnerabilities, or even those combining physical, cyber, and informational tactics. Advances in AI are further complicating the threat landscape by accelerating both attack and defense. Adversaries can use increasingly capable frontier models, for instance, to identify vulnerabilities and quickly orchestrate attacks, while organizations can use the same technology to test their defenses and identify weaknesses before they are exploited.
It is not only the threats themselves that are changing; so too is the infrastructure on which organizations and economies depend. Traditional critical infrastructure—including power grids, water systems, transportation networks, healthcare, and telecommunications—increasingly relies on a digital technology layer spanning data centers, cloud platforms, and AI computing capacity. This technology layer is becoming critical infrastructure in its own right. As these systems become more interconnected, a disruption to one technology provider or platform can cascade across physical infrastructure, supply chains, and essential services. Organizations must therefore prepare for disruptions that can affect multiple systems simultaneously, stretching operational resilience and incident response capabilities.
Here’s the catch. As physical and technology infrastructure become increasingly interconnected and threats grow in frequency and complexity, do organizations have a sufficiently integrated view of the risks they face and the systems they need to protect?
To examine that question, we surveyed 122 organizations across sectors and geographies in Q1 2026 about the state of critical infrastructure security (see sidebar, “Our survey methodology”). The findings point to a mismatch between the increasingly interconnected nature of these threats and how organizations prepare for them. Nearly all respondents have established capabilities for cyber and IT threats, for example, while preparedness is considerably lower for information and psychological operations, economic and political coercion, and espionage and covert operations—even when organizations regard these threats as relevant.
The challenge extends beyond gaps in preparedness. The responsibility for managing these risks is often fragmented across the organization. The chief information security officer may be responsible for protecting information and technology systems, while security, safety, or infrastructure teams oversee physical assets. The chief risk officer may maintain an enterprise-wide view of risk, while the chief compliance officer focuses on regulatory and compliance exposures. Human resources leaders, meanwhile, may be responsible only for personnel-related risks. Each function may have a well-defined mandate, but budgets, capabilities, and accountability often follow organizational boundaries even as the threats themselves increasingly cut across them.
Our research and experience in this field suggest that many of these gaps can be identified and addressed. Leaders can strengthen their preparedness (before it is tested) if they understand where their organization’s threat exposure is concentrated, where capabilities are lagging behind, and where investment and collaboration need to be further aligned to the latest threat landscape. They must also continue working toward adopting a more integrated approach, although for many this remains an emerging challenge. While the appropriate response may vary, our research identifies six areas where leaders can begin to strengthen resilience.
Technology infrastructure remains a priority, but physical risks demand attention
Surveyed organizations rate technology infrastructure and software as the most relevant targets for disruption across all three threat types—conventional, cyber, and hybrid—ahead of economic and financial systems, physical infrastructure, and supply chains. Recent events reported by respondents show a similar pattern. Among organizations that disclosed whether they had experienced a threat-related event, 87 percent reported at least one in the 24 months leading up to the survey. About three-quarters of these organizations reported an event affecting technology infrastructure, considerably more than any other operational area (Exhibit 1).
Roughly 87 percent of organizations have encountered at least one threat-related event in the past 24 months.
1Question: Have you experienced any threat-related event in the past 24 months? (n = 109).
While organizations recognize the importance of technology infrastructure, they may also need to account for the growing interdependence between digital and physical systems. Manufacturing plants, for example, combine heavy machinery with robotics, automation, and software-driven connectivity. Any disruption to their digital systems can quickly impact physical operations. In fact, whether a threat is state-sponsored espionage, an opportunistic cybercrime, or a physical attack with a digital dimension, each can affect the technology infrastructure on which operations increasingly depend.
Close the capability gaps before they are tested
Organizations appear to be better prepared for some threats than others, even when they consider those threats relevant to their business. Roughly 98 percent of surveyed organizations have established capabilities to manage cyber and IT threats, and 77 percent have capabilities in place for physical and hardware infrastructure (Exhibit 2). That share falls to 59 percent for information and psychological operations, 47 percent for economic and political coercion, and just 32 percent for espionage and covert operations. Yet 64 percent of organizations in our survey consider espionage as a highly relevant threat to their business.
Most organizations do not have an established capability to manage resilience against espionage and covert operations.
1Question: Which of the following capabilities exist in your organization to manage resilience against threats? (n = 122).
We’ve found that cyber and physical security have historically received more attention from senior executives, regulators, and the media. Other threats can be more subtle and receive less scrutiny—and, in some organizations, fewer resources for protective measures. Espionage and covert operations, for example, are designed to go unnoticed. Organizations without established capabilities to identify and respond to such threats may struggle to detect an incident already underway.
Organizations can use these findings to prioritize where to strengthen their defenses. Leaders can compare the threats they consider most relevant with the capabilities they have in place, then focus investment on areas where preparedness falls furthest behind perceived exposure.
Bring the full range of threats into enterprise risk management
Organizations have integrated cyberthreats into their enterprise risk management (ERM) frameworks more extensively than conventional and hybrid threats. Approximately 72 percent of surveyed organizations have fully integrated cyber risks into ERM, with a further 18 percent reporting partial integration. Meanwhile 42 percent of the respondents say conventional threats are fully integrated into ERM (Exhibit 3). For hybrid threats, however, only 32 percent report full integration, while 16 percent have formally documented these risks but manage them separately from their core ERM process.
Cyberthreats are extensively integrated into organizations’ enterprise risk management frameworks.
1Question: Are threat-related risks codified in risk taxonomies and integrated into your overall enterprise risk management (ERM) framework and policies? (n = 122).
This uneven integration may leave organizations with blind spots. ERM provides a common framework for identifying and assessing risks across the organization, helping leaders to ensure that potential threats receive appropriate attention. When organizations manage hybrid threats outside the ERM framework, for instance, they may overlook important exposures or fail to give them sufficient attention from senior leadership. These risks may also receive less systematic review or investment than those covered by the ERM.
Organizations that have already integrated cyberthreats into their ERM can build on that foundation. They can extend existing risk assessments and review processes to cover conventional and hybrid threats, giving leaders a more complete view of the risks their business faces.
Match investment to the organization’s threat priorities
Many organizations continue to prioritize investments in areas where they have already developed strong defenses. In our survey, 96 percent of respondents plan to invest most in cyber and information technology defenses over the next one to two years, while 52 percent expect to invest in physical and hardware infrastructure (Exhibit 4). Far fewer plan to invest in other areas: 26 percent in information and psychological operations, 16 percent in economic and political coercion, and 15 percent in espionage and covert operations—even though many organizations consider these threats relevant to their business.
Most organizations are planning to invest in cyber and IT as well as physical and hardware infrastructure defense.
% of respondents (up to 3 options selected)
1Question: In which threat defenses will your organization invest most over the next 1–2 years? (n = 122).
Responsibility for these threats also tends to be spread across different functions, making it harder to address potential gaps. Chief information officers, chief technology officers, and chief security officers, for example, may each oversee parts of an organization’s spending on threat defenses. Without a coordinated view of resources and investment priorities under a single, accountable owner, organizations may struggle to direct resources towards risks that fall between these responsibilities.
As organizations prepare for their next planning cycle, leaders can assess whether the budget allocation reflects the threats they consider most relevant. Where it does not, they can identify which defenses need additional investment and adjust budgets accordingly.
Strengthen intelligence sharing and early-warning systems
Organizations report gaps in their ability to share threat intelligence and access early warnings. Half of surveyed organizations identify better threat-intelligence sharing as a priority, while 40 percent want access to real-time early-warning systems (Exhibit 5). Respondents rank both capabilities ahead of broader industry collaboration or partnerships and dialogue with academic institutions and government authorities.
Better threat intelligence sharing and access to early warning systems are the biggest areas of interest for collaboration among survey respondents.
1Question: What would you want to see concerning collaboration with other stakeholders? (n = 122).
Collaboration across organizations can help address this gap. Threat intelligence and early-warning systems become more useful when companies can share information about emerging threats, including through industry associations and government agencies, where appropriate. Individual organizations may struggle to develop the same breadth of intelligence on their own.
Organizations can begin by participating in or establishing sector-specific intelligence-sharing arrangements, such as information-sharing and analysis centers. Informal networks can also provide a starting point, allowing organizations to exchange relevant threat information while they develop more formal arrangements for sharing intelligence. Other possible support can come from AI-based early warning systems that can quickly detect signs of attack and anomalies and alert human supervisors, who have to manage an enormous and ever-growing amount of data and information (internal and external).
Address the risks of relying on a small number of technology providers
Operators of critical infrastructure increasingly depend on a small number of technology providers for essential services, creating potential points of failure. Half of surveyed organizations report highly concentrated cloud or software provider relationships; among those organizations, over 75 percent say that concentration is within their own country or region (Exhibit 6). Only 9 percent report a highly diversified provider base. Yet strategies for managing these dependencies are less developed: just 24 percent of organizations have a clearly defined strategy for managing digital sovereignty risk, while 52 percent only have a partial strategy (Exhibit 7).
Roughly 50 percent of organizations around the globe have highly concentrated cloud or software providers.
from specific jurisdictions (eg, China, US),1 % of respondents
1Question: To what extent is your organization dependent on cloud or software providers from specific jurisdictions (eg, China, US)? (n = 122).
The concentration extends to AI. Roughly 74 percent of respondents rely on moderately to highly concentrated providers for AI applications, including generative and agentic AI, while only 2 percent report a highly diversified AI provider base (Exhibit 7). A further 14 percent do not know how concentrated their AI provider relationships are. These findings suggest that many organizations may lack a clear view of their exposure.
Strategy for digital sovereignty risks are not common yet, and
concentration of AI providers is quite high in most organizations.
1Question: Do you have a strategy to manage digital sovereignty risks? (n = 122).
2Question: Do you have transparency about concentration of providers of AI use cases (gen AI, agentic AI, etc) across all your business units? (n = 122).
These dependencies can become particularly consequential when organizations rely on the same provider across multiple technology services. For example, a company that relies on a single technology provider for cloud infrastructure, enterprise software, and AI applications could face disruptions across several business functions if the provider experiences a major outage or has a contract dispute. As a relatively small number of large technology companies provide many of these services, a disruption could also affect multiple organizations that depend on the same provider.
The risk is even greater for organizations without large domestic technology providers to fall back on. Europe, for example, may have a more challenging path to digital sovereignty than China or the United States, both of which can lean on homegrown providers.
Organizations can understand their dependencies by mapping their critical product and service offerings against their external cloud, software, and AI infrastructure and providers. This can help leaders identify potential points of failure and determine where alternative providers or contingency arrangements may be needed. Unwinding concentration on technology providers may take time and can depend on the alternative options a company has in the market; however, understanding these dependencies and their business implications before a disruption occurs is a crucial first step.
How to start: Small steps can create a big impact
Addressing these gaps may not require organizations to undertake a major, multiyear transformation. Organizations can take many of the first steps within a single planning cycle.
- Prioritize technology infrastructure. Conduct thorough assessments of cybersecurity, technology, and AI risks, while also identifying potential physical risk break points. Striking the right balance across different attack surfaces of the threat types is crucial here.
- Close gaps in preparedness. Focus on known threats that organizations may not be adequately equipped to manage, particularly less visible risks such as espionage and covert operations. This may require expertise and tools beyond those typically used in risk management. For example, in the case of espionage, an organization could draw on people with backgrounds in intelligence, law enforcement, or the military, and use tools that could detect unusual behavior and anomalies in business transactions.
- Extend ERM discipline across the full threat spectrum. Build on the processes already in place for managing cyber risk to address other types of threats. This could include fully incorporating these risks into existing risk taxonomies as well as other risk and control assessments. This may encourage organizations to openly discuss these risks and assess how prepared they are to address less obvious hybrid threats such as espionage.
- Rebalance investment to risk priorities. Use a comprehensive understanding of the diverse threats facing the organization to guide investment decisions. This can help ensure that resources are directed toward the most significant risks, without overlooking certain threats or focusing too heavily on others.
- Strengthen intelligence-sharing arrangements and invest in early-warning systems. Work with suppliers, providers, customers, and, where appropriate, public sector organizations to build awareness of emerging threats, share relevant information, and improve the overall resilience of critical infrastructure. In addition, AI-based early-warning technologies will be important for navigating the growing threat landscape and sifting through the plethora of data and information organizations collect.
- Identify dependencies on technology providers. Create transparency about potential high dependencies on a single or highly concentrated group of technology providers (across software, hardware, cloud, and AI services). Understanding these dependencies can help organizations identify potential points of failure and inform longer-term strategic decisions.
The threat environment will continue to change. The attack on US water systems and the power outage in Germany described earlier may differ in form, but they nonetheless constitute significant threats to infrastructure. The next disruption may look very different. The challenge for those managing critical infrastructure is to build the resilience required to respond across a converging set of risks—before an incident reveals where the gaps remain.
