Our work across critical national infrastructure in the UK and beyond has shown that one lesson holds true regardless of sector: resilience isn't a technical checkbox. It's an organisational discipline that starts in the boardroom and runs through every part of an organisation.
In a highly digital world where the threat environment is intensifying and failures can have severe consequences – economically and in terms of national security – that fact has never been more acute.
From recovery to continuity
For years, resilience meant answering one question: how fast can you recover? In an always-on economy, that question has changed. People no longer tolerate downtime. They expect continuous and uninterrupted service, not an uncertain recovery period after an outage.
This shift matters most in sectors like payments, energy, water, transport and communications, where a single failure can cascade quickly into a regional or even national event. The UK's payment systems alone process almost 50 billion transactions each year, underpinning salaries, benefits, mortgages and everyday commerce. When these systems falter, the consequences aren't abstract. They're felt immediately by people trying to pay for groceries or access their savings.
As various incidents over recent months and years have shown, the impact of getting it wrong can be significant. For critical national infrastructure organisations, the cost of prevention is now consistently lower than the cost of disruption.
As such, sustained investment in resilience across culture, people, processes and technology is essential to protect economic stability, preserve public confidence, and to promote innovation in an era of radical uncertainty and heightened global threat levels.
Lessons from across the sectors
No sector holds a monopoly on resilience thinking, and looking across critical national infrastructure reveals patterns worth learning from.
In transport for example, where safety is paramount, systems and processes are engineered to failsafe rather than giving a loss of control. The 2025 fire at a substation near Heathrow Airport tested this thinking in practice. Safety systems held, but the airport's reliance on the impacted power supply led to closure, affecting more than 200,000 passengers. The incident highlighted the importance of contingency planning – particularly in regard to infrastructure dependencies – and that this thinking has to extend across the whole ecosystem, not just the parts within an organisation's direct control.
Energy operators face similar pressures. The UK's electricity network uses multiple interconnectors and automated load-balancing to manage demand and outages. The 2025 Iberian Peninsula blackout showed how quickly grid instability can cascade once automatic disconnections start. Resilience planning based on assuming severe but plausible disruption scenarios before they occur is therefore essential in maintaining stability.
Communications infrastructure shows the value of geographic diversity. In 2024, an anchor dragged by a stricken vessel in the Red Sea severed subsea cables carrying around a quarter of Europe-Asia-Africa data traffic. The resulting outages disrupted banking and payment systems across East and West Africa, in part because many institutions lacked pre-arranged backup routes. The lesson is straightforward: redundancy only works if it's planned for in advance.
Building resilience that lasts
Across every sector we've examined, a consistent picture emerges: achieving resilience takes substantial work across every organisational domain. Resilience depends on:
- A culture where staff feel safe raising concerns before they become incidents. Resilience is as much a cultural issue as it is a technical one
- Sustained investment, backed by genuine commitment from the top of the organisation, to keep pace with continuous technological change
- Redundancy and geographic diversity in system design, built in from the outset to help limit disruption and prioritise critical services
- Treating the wider ecosystem of suppliers, partners and customers as part of the resilience challenge, not separate from it
Resilience can't be assumed or added later. It has to be designed in from the outset, tested continuously and owned at board level. The threat landscape will keep evolving, shaped by more sophisticated cyberattacks, geopolitical instability and emerging risks driven by technologies such as AI and quantum computing.
Organisations that treat resilience as a live, evolving discipline, rather than a static requirement, will be the ones best placed to maintain the trust that critical infrastructure depends on. We believe the sectors that share their experiences openly, learning from each other's successes and failures alike, will build a stronger, more resilient foundation for the services we all rely on.
The Asset Management Gap: Why CNI Transformation Can’t Wait
Download the report for more on this research, including the methodology and additional findings.