Much of cyber policy still speaks the language of intrusion. The implied scene is familiar: a hostile actor presses against the perimeter, defenders repel the attempt, and order is restored. That framing remains useful, but in 2026 it captures too little of what actually places institutions at risk. Across critical infrastructure, the gravest weaknesses are often mundane and cumulative. Devices remain unpatched because outages are expensive. Asset registers drift from reality. Backup systems are tested on paper, not in production. Suppliers retire support for hardware that still controls pumps, substations and diagnostic equipment. The strategic problem is not merely hostile access; it is institutional unreadiness.
This matters because digital dependence has become infrastructural in a literal sense. Hospitals cannot fall back easily to paper when imaging, pharmacy and scheduling systems are interlocked. Water utilities now rely on remote telemetry not as a convenience but as an operating assumption. Rail, ports and distribution grids are managed through layers of software procured over decades, often by different teams under different standards. In such environments, cybersecurity failure rarely begins with a cinematic breach. More often it begins with a maintenance compromise: an overdue firmware update, a service account nobody owns, a contractor connection preserved for convenience, a recovery procedure that assumes staff and systems will be available at the same time.
Maintenance as a security category
There is a conceptual lag in how many institutions organise defence. Security budgets are still easier to justify for visible controls than for unglamorous upkeep. Boards understand a new monitoring system more readily than a three-year programme to reconcile asset inventories, retire unsupported devices and rehearse restoration under degraded conditions. Yet NIST's operational technology guidance and the Cybersecurity Framework 2.0 both point in a less theatrical direction: know what you have, understand dependencies, secure configuration changes, and prepare to recover essential functions under stress.
That emphasis reflects an awkward truth. Attackers benefit from complexity, but so does entropy. In mixed IT and OT estates, systems fail into insecurity by default. Every temporary exception becomes a durable one unless somebody closes it. Every maintenance window deferred for operational reasons becomes a stored risk. Every undocumented integration quietly extends the blast radius of a later incident. In this sense, maintenance is not a back-office discipline adjacent to security. It is one of security's central mechanisms.
The strategic problem is not merely hostile access; it is institutional unreadiness.
Why critical infrastructure is especially exposed
Critical systems inherit a set of constraints that ordinary enterprise cyber programmes often underestimate. Availability usually outranks confidentiality. Equipment lifecycles may run for fifteen or twenty years, while software support cycles are measured in far shorter spans. Shutdowns require regulatory approval, specialist labour or seasonal timing. Safety certification can make apparently simple updates expensive to validate. The result is an environment in which obsolete but essential assets coexist with new digital layers intended to improve observability and efficiency.
That coexistence creates a distinctive form of fragility. Legacy systems were not built for modern identity management, encryption standards or continuous monitoring. Newer management layers, meanwhile, can create single points of coordination whose failure impairs whole operations. The issue is not simply that old systems are insecure. It is that old and new systems together produce hidden interdependence. OECD work on critical infrastructure cybersecurity has stressed this governance challenge: resilience depends on understanding interconnections across operators, suppliers and public authorities, not merely hardening individual nodes.
The strategic problem is not merely hostile access; it is institutional unreadiness.
The false comfort of compliance
Europe's regulatory direction is increasingly serious. NIS2 expands obligations on risk management, incident reporting and supply-chain security. The Cyber Resilience Act seeks to raise baseline security requirements for connected products. These measures matter. They create accountability where voluntarism failed and establish a common expectation that digital safety is part of essential service delivery.
But compliance can also mislead. A control can be documented while the underlying process is weak. An incident response plan can satisfy an audit yet remain detached from operational reality. A supplier questionnaire can be complete while a maintenance dependency remains opaque three tiers down the chain. The distinction is not between regulation and practice, but between formal adherence and operational truth. In resilience terms, the relevant test is always the same: when a component fails unexpectedly, can the institution still deliver its minimum public function safely and within a politically tolerable time?
Hospitals show the pattern most clearly
Healthcare offers the sharpest illustration because its consequences are immediate. Recent academic work, including a 2024 study in Nature Medicine, has shown that ransomware incidents can disrupt care in ways that extend beyond the targeted institution. Yet the lesson is broader than ransomware. Hospitals are dense assemblages of ageing devices, outsourced software, administrative systems and life-critical workflows. A cyber incident becomes dangerous not simply because data are encrypted, but because maintenance debt has narrowed the room for improvisation.
A hospital with current inventories, segmented networks, tested downtime procedures and recent restoration drills is still vulnerable, but it is governable under pressure. A hospital without those disciplines may discover during an incident that scanners depend on an unmonitored server, that biomedical devices share credentials, or that the backup environment has never been restored at realistic scale. In that setting, cyber risk becomes clinical risk. The same logic increasingly applies to water treatment, district heating and municipal services: digital disruption is hazardous where institutions have lost the operational slack needed to absorb failure.
Inventories are political documents
It is tempting to treat asset management as a technical clerical task. In critical infrastructure it is closer to a constitutional record. If an operator cannot state with confidence which devices are connected, which software versions are running, which remote paths are open and which suppliers are indispensable to restoration, then leadership does not truly know what it governs. NIST's guidance on OT security gives asset identification pride of place for good reason. One cannot secure, isolate or recover what one cannot reliably enumerate.
The problem is that inventories decay fast in environments shaped by contractors, emergency fixes and long procurement cycles. They are therefore not one-off projects but living instruments of authority. The organisations that do this relatively well tend to make inventory accuracy a condition of operational legitimacy. Changes that are not recorded are treated as defects, not administrative oversights. That sounds stern, but the alternative is strategic blindness during an incident.
Attackers benefit from complexity, but so does entropy.
Recovery is harder than response
Public debate often focuses on detecting and containing attacks. For operators of essential services, however, the more punishing phase is restoration. Returning a plant, ward or control centre to service can be slower and riskier than initial triage. Systems must be rebuilt in the right order. Data integrity has to be trusted. Safety must be validated before operations resume. In OT environments, a rushed restoration can create physical hazards or trigger cascading faults.
This is where many resilience claims meet reality. Backups may exist but not for the right systems; they may be offline but too stale; they may be technically restorable but dependent on keys, licences or vendor support unavailable during crisis. Recovery time objectives written into governance papers can collapse once dependencies are mapped honestly. Resilience is what remains after the dashboard goes dark. It depends on spare capacity, manual workarounds, cross-trained staff and pre-authorised decision paths as much as on cyber tooling.
Resilience is what remains after the dashboard goes dark.
The supply chain is now a maintenance chain
Supply-chain security is often discussed in terms of malicious compromise. That matters, but an equally important vulnerability lies in ordinary supplier fragility. Essential operators depend on vendors for patches, remote support, replacement parts, proprietary knowledge and licence continuity. A supplier bankruptcy, sanctions disruption, merger, support withdrawal or credentialing failure can weaken security without any adversary writing a line of code.
This is why maintenance has become a systemic question. The issue is no longer whether one supplier is secure, but whether a service can be repaired, reconfigured and restored when several suppliers are simultaneously constrained. ENISA's work in the electricity sector and broader European resilience policy both point towards the same operational conclusion: cyber preparedness cannot be separated from continuity of maintenance, spares and trusted technical support.
Metrics that matter look unfashionable
Executive reporting still favours counts of alerts, blocked attempts and time to detect. These measures are not useless, but for resilience they can be secondary. The more revealing indicators are often less impressive: proportion of assets with verified owners; percentage of unsupported systems with funded retirement plans; frequency of restoration drills under realistic outage conditions; number of critical suppliers with tested continuity arrangements; median age of remote access exceptions; time required to rebuild a minimum viable service from clean systems.
Resilience is what remains after the dashboard goes dark.
Such measures are harder to present because they expose unresolved liabilities rather than showcasing defensive activity. Yet they align better with the public interest. Citizens are not protected by a high volume of blocked phishing attempts if a municipality cannot restore water billing, dispatch or treatment visibility after a modest systems failure. In sovereign terms, the central question is whether institutions can continue to function while damaged.
The workforce problem is not just shortage
It is commonplace to cite the shortage of cybersecurity professionals. In critical infrastructure, the deeper issue is translation between domains. Security teams may understand threats but not plant operations. Engineers may understand process safety but not identity architecture. Procurement teams may contract for features while underweighting long-term supportability. Senior leadership may receive dashboard summaries that obscure the practical meaning of maintenance debt.
The result is a governance gap, not just a staffing gap. OECD analysis of the changing role of the CISO suggests that cyber leadership increasingly requires cross-organisational authority. In essential services that authority must extend beyond classic information security into asset management, procurement, engineering and continuity planning. Without that integration, cyber programmes remain articulate but shallow, while operational teams continue to make security-relevant decisions in isolation.
From efficiency to graceful degradation
Over two decades, digitisation has rightly pursued efficiency, visibility and automation. The resilience challenge of the late 2020s is to rebalance those gains against graceful degradation. Institutions need architectures that can fail partially without collapsing functionally. That means segmentation designed for manual isolation, not only for theoretical zoning diagrams. It means fallback modes that are slower but safe. It means preserving local operating competence even where central platforms offer convenience. It means accepting that some redundancy which looks wasteful in peacetime is prudent in crisis.
UNDRR's recent work on disaster risk reduction is relevant here because cyber incidents increasingly resemble other systemic shocks: they cascade across dependencies, exploit pre-existing vulnerability and punish organisations that optimised away slack. Resilience therefore cannot be reduced to preventing breach. It is the capacity to absorb disruption, continue core functions and recover without compounding harm.
A more mature security doctrine
The practical implication is not to lower ambition on prevention. It is to broaden the doctrine. Defensive architecture should encompass patching governance, lifecycle funding, supplier continuity, restoration order, safety validation and manual service continuity with the same seriousness once reserved for perimeter controls. NIS2 and related frameworks are beginning to push institutions in that direction, but doctrine matures only when budgets and accountability follow.
For states, this is an uncomfortable but useful shift. It relocates cyber security from the realm of exceptional events to the everyday discipline of institutional care. The hidden risk is maintenance because maintenance is where digital dependency becomes visible. A nation that cannot routinely sustain, map and restore the systems on which daily life depends will remain strategically vulnerable even if its threat intelligence is excellent. The next phase of resilience will belong not to the most theatrical defenders, but to the institutions that learn to govern upkeep as if continuity itself were a security function.
