10
Loading video...
By Akshay Joshi
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
During wartime, the danger of cyberattacks to national critical infrastructure has long been clear and present. But such threats also lurk in peacetime. Weaknesses across major economies are repeatedly being exposed by attempts to hack into both IT systems and physical industrial equipment. This has profound implications for how governments and businesses should prepare themselves.
Cyberattacks now pose an immediate and ongoing risk to infrastructure that entire countries rely on for everyday life to continue as normal. Communications, energy, retail, transport and water infrastructure are all prime targets which, if successfully compromised, can trigger devastating consequences. Attacks can undermine military readiness, emergency response capacity and civil, political and economic stability—potentially causing shortages, panic buying, price spikes and hefty ransom payments.
Recent incidents in the United States and France show how cyberattacks on seemingly routine digital systems can quickly become threats to essential services. In July 2026, U.S. authorities warned that internet-exposed industrial controllers used by water, energy and municipal systems had been manipulated, causing operational disruption and financial losses. U.S. authorities have also warned that threat actors may seek persistent access to critical infrastructure that could be activated during a future crisis. The scale of the exposure is significant, with the country relying on approximately 50,000 community water systems for more than 80 percent of its population.
Read More on Opinion
...
In good times, an attack may destroy inventory or cause disruptions. But in a crisis, it could impair access to food, energy, health care, communications or public safety precisely when societies are most vulnerable. This reinforces the need for leaders to improve visibility across critical systems, identify persistent access—or hidden footholds inside compromised networks—and test whether essential services can continue and recover if digital networks under attack.
It can no longer be assumed that assaults on critical infrastructure are simply aiming for immediate gain. Instead, threat actors are increasingly attempting to secure “strategic pre-positioning” by secretly gaining access that can be activated at any moment to support broader campaigns. That means that the traditional approach to handling cyberattacks—understood as isolated incidents targeted at a quick win—risks failure. To protect critical infrastructure effectively, then, there must be a much keener focus on this shift toward more sophisticated strategies.
True, not every intrusion signals a broader campaign. But the very possibility of pre-positioning fundamentally changes how leaders should assess and respond to cyber threats.
Public and private sector leaders must therefore ask themselves a series of searching questions. What can be done when the first signs of compromise are detected to limit a threat actor’s options and mitigate harm? How can persistent access be identified and removed before it is activated during a crisis? They must also assess whether critical systems are adequately designed to remain resilient and recover quickly if an attack succeeds. And they must think long and hard about how all the relevant actors across the public and private sectors can share information and coordinate action before pre-positioning leads to real damage.
Governments, infrastructure operators and technology providers cannot act soon enough. Three broad areas require their urgent attention to move away from the overly reactive approach that predominates today while strengthening resilience. These can be roughly summarized as anticipation, preparation and cooperation.
First, when threat actors manage to secure persistent access, this must be identified and rooted out as soon as possible to minimize risks. Organizations need greater visibility into their critical systems, assets and dependencies. They must enhance their ability to spot anomalous activity and persistent access that may otherwise remain dormant. AI adds both a challenge as well as an opportunity: threat actors can use it to identify vulnerabilities at speed and at scale, while defenders can use it to detect anomalous activity and indicators of compromise sooner. The objective should not only be to contain today's incident, but to understand what a threat actor may be planning to do tomorrow.
Second, it is essential to be fully prepared for disruption—it is not enough to rely on prevention. That means enhancing resilience by reducing critical dependencies, such as third-party software risks or complex supply-chain choke points, and strengthening the ability of core systems to withstand and recover from disruption. Critical infrastructure operators should test whether essential functions can continue when systems are compromised, whether alternative operating arrangements exist, and whether recovery plans perform under realistic conditions. True resilience means being able to maintain and restore critical services.
Third, the importance of building collective defense strategies before a crisis breaks out cannot be overstated. Persistent access can span technology providers, infrastructure operators, supply chains and national borders. Governments and industry need trusted mechanisms to share indicators of compromise, understand common dependencies and coordinate action before geopolitical tensions turn latent access into active disruption. Responsibilities, decision-making authorities and legal boundaries should be established before, not during, a crisis.
There is no time to lose. Waiting until pre-positioned access is activated means surrendering this valuable window of opportunity in which defenders have the greatest room to act. Governments and businesses have the chance—now—to seek out persistent access and shut it down; to find hidden dependencies and test whether critical services can withstand disruption; and to come together to mount a united front against cyber threats. As strategic pre-positioning becomes a growing menace, resilience will depend on what leaders do before crisis strikes.
Akshay Joshi is senior director of the World Economic Forum's Centre for Cybersecurity & Frontier Technology. He joined the Forum as a global leadership fellow in 2015, bringing over a decade of experience in management roles in sectors including maritime transport and public relations.
The views expressed in this article are the writer's own.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines