The frontline of resilience: Critical infrastructure as sovereign capability

Critical infrastructure can no longer sit at the edge of the national security agenda. When adversaries target the systems that sustain civilian life, energy, water, telecommunication and finance, the effects can extend well beyond operational disruption, eroding public trust, destabilising economies and fracturing institutional credibility.

This is because infrastructure does not operate in isolation. Electricity powers telecommunications and telecommunications enable emergency services and financial systems. Water systems depend on digitally managed controls and logistics corridors connect energy markets and supply chains across borders. In such an environment, a disruption in one sector can cascade rapidly into others.

The immediate priority is to understand which assets are most critical, where dependencies are concentrated and how failure in one part of the system could affect continuity elsewhere. Resilience planning must, therefore, account not only for immediate shocks, but also for the cascading failures that can follow when one compromised system destabilises others. The objective is not to eliminate every disruption, but to ensure continuity despite disruption, maintaining essential services even when individual components are compromised.

Key action: Confirm priority assets and dependencies, and establish a senior governance mechanism to oversee infrastructure resilience and response readiness.

Critical infrastructure testing needs to cover a broad spectrum of scenarios and capabilities. Tabletop exercises and compliance-driven audits create a false sense of readiness. True preparedness requires unannounced, cross-sector exercises that push leadership decision-making and operational fallback procedures to their limits, including scenarios where essential services are fully offline. The purpose is not simply to test whether plans exist, but whether they hold under real pressure.

That can start with remote reconnaissance and vulnerability identification and then extend to multi-vector penetration testing to understand where weaknesses may lie. It can go further still, using digital twin simulations to assess system-wide resilience in a controlled environment.

Ultimately, critical infrastructure must be tested through business continuity exercises that simulate the loss of essential services under real operating conditions. Resilience must be embedded into operational policies, procurement, investment planning, and leadership development. It must become part of institutional culture, not simply a matter of regulatory compliance.

Key action: Commission an independently assessed stress test that challenges leadership, operations and continuity plans under severe multi-system failure scenarios.

Digitisation has transformed infrastructure operations. Smart grids, AI-enabled monitoring, predictive maintenance tools and cloud-based command platforms provide unprecedented visibility and efficiency. Yet these same capabilities introduce new dependencies on global vendors, proprietary technologies and complex supply chains. This is changing the nature of resilience and the challenge now is to understand how disruption can move across cyber, physical and supply chain domains at the same time.

Sovereign capability does not imply isolation. It requires maintaining decision-making authority, operational visibility, and governance over the digital architecture to manage critical infrastructure under pressure. Yet many organisations still manage cyber, physical and supply chain risks through separate teams, budgets, and governance structures. That fragmentation creates blind spots. Adversaries can exploit the seams between these silos.

In a more contested operating environment, organisation leaders need a single, integrated threat picture, one command architecture that models how a cyber intrusion can trigger physical failure, which in turn disrupts supply chains and public services simultaneously.

Key action: Bring cyber, physical and supply chain risk leaders into one governance structure, define shared escalation triggers and establish a unified threat view for critical operations.

As critical systems become more digital and interconnected, they are also becoming more vulnerable to cyberattacks, operational disruption and other forms of hybrid warfare. In the UAE, attacks on digital infrastructure tripled from 200,000 to 600,000 since the start of the war, including ransomware and data breaches to targeted data leaks and website defacement.¹ This has expanded both the range of threats and the number of assets that now require protection. Industrial control systems can now be targeted through cyberattacks, telecommunications networks can be exploited to manipulate information flows, supply chains can be disrupted through coordinated economic or digital pressure. Such events rarely occur in isolation; they intersect and amplify one another.

This is precisely why the attack surface can no longer be understood in purely physical terms. It now extends beyond site perimeters to include software dependencies, third-party vendors, operational technology environments and data ecosystems. The objective of modern disruption is often to destabilise - to erode confidence, expose coordination gaps, and exploit systemic interdependencies.

The strategic challenge for leaders is therefore not simply how to digitise faster, but how to retain sufficient control, visibility and decision-making authority over the systems that sustain essential services. Earlier this year, business leaders we surveyed in the region as part of PwC’s 29th Global CEO Survey² indicated that they were reassessing their technology dependencies. 32% of CEOs were planning to reduce reliance on technology providers based in countries they consider less trustworthy – pointing to a strategic shift towards trusted suppliers, local or regional alternatives to strengthen data sovereignty.

In this context, resilience depends not just on digital capability, but on knowing where dependency is concentrated, where continuity could be compromised and where mitigation is needed before disruption occurs.

Key action: Identify critical technology dependencies across essential operations, assess concentration risk, and define mitigation plans for any exposure that could threaten service continuity.

_{1) https://www.thenationalnews.com/future/technology/2026/04/10/iranian-cyber-attacks-move-from-disruptive-to-complex-threats-in-gulf/
2) https://www.pwc.com/m1/en/ceo-survey/29th-ceo-survey-middle-east-findings-2026.html}